[B! security] fn7ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

fn7 id:fn7

securityã«é–¢ã™ã‚‹fn7ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

HMAC: Keyed-Hashing for Message Authentication
H. Krawczyk IBM M. Bellare UCSD R. Canetti IBM 1997å¹´ 2æœˆ HMACï¼š ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸èªè¨¼ã®ãŸã‚ã®éµä»˜ãƒãƒƒã‚·ãƒ³ã‚° (HMAC: Keyed-Hashing for Message Authentication) ã“ã®ãƒ¡ãƒ¢ã®ä½ç½®ä»˜ã‘ ã“ã®ãƒ¡ãƒ¢ã¯ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ»ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã«å¯¾ã—ã¦æƒ…å ±ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã§ã‚ã‚‹ã€‚ã“ã®ãƒ¡ãƒ¢ã¯ã€ä½•ã‚‰ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æ¨™æº–ã‚’è¦å®šã™ã‚‹ã‚‚ã®ã§ã¯ãªã„ã€‚ã“ã®ãƒ¡ãƒ¢ã®é…å¸ƒã«åˆ¶é™ã¯ãªã„ã€‚ è¦æ—¨ ã“ã®æ–‡æ›¸ã§ã¯ã€æš—å·ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã‚’ä½¿ç”¨ã—ã¦ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸èªè¨¼ã‚’è¡Œãªã†ä»•çµ„ã¿ã§ã‚ã‚‹ HMAC ã«ã¤ã„ã¦è¨˜è¿°ã™ã‚‹ã€‚HMAC ã¯ã€MD5 ã‚„ SHA-1 ãªã©ã®åå¾©æš—å·ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã‚’ç§˜å¯†ã®å…±æœ‰éµã¨çµ„ã¿åˆã‚ã›ã¦ä½¿ç”¨ã™ã‚‹ã€‚HMAC ã®æš—å·ã¨ã—ã¦ã®å¼·åº¦ã¯ã€ä½¿ç”¨ã—ã¦ã„ã‚‹ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ãƒ—ãƒãƒ‘ãƒ†ã‚£ã«ä¾å˜ã™ã‚‹ã€‚ 1.ã¯ã˜ã‚ã« ä¿¡é ¼ã§ããªã„ãƒ¡ãƒ‡ã‚£ã‚¢ä¸Šã‚’ä¼é€ã—ã€è“„ç©ã•ã‚Œã‚‹æƒ…å ±ã®
fn7 2010/05/08
HMAC

æš—å·

security
ãƒªãƒ³ã‚¯
ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : ã‚¬ãƒ³ãƒ–ãƒ©ãƒ¼å¯¾ç–ã€Œ.htaccessã€ã«ã‚‚æ³¨æ„ï¼
ã‚¬ãƒ³ãƒ–ãƒ©ãƒ¼å¯¾ç–ã€Œ.htaccessã€ã«ã‚‚æ³¨æ„ï¼ 2010å¹´03æœˆ01æ—¥13:00 ãƒ„ã‚¤ãƒ¼ãƒˆ hiroki_iwai ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ã‚³ãƒ¡ãƒ³ãƒˆÂ byï¼šå²©äº• åšæ¨¹ ãŠéš£ã®ï¼‘ï¼‘ï¼™ãƒãƒ¼ãƒ ã®SEKIéšŠå“¡ã®å‘Ÿãã«ã‚ˆã‚‹ã¨ã€ã€ã€ æ–°åž‹ã‚¬ãƒ³ãƒ–ãƒ©ãƒ¼ã«æ”»æ’ƒã•ã‚ŒãŸã‚µã‚¤ãƒˆã‚’è¤‡æ•°ç¢ºèªã—ãŸã‚ˆã†ã§ã™ã€‚ å…·ä½“çš„ã«ã¯ã€FTPã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ã‚’ç›—ç”¨ã•ã‚Œã€ã€Œ.htaccessã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã¾ã™ã€‚ ã©ã†ã‚„ã‚‰ã€JavaScriptä»¥å¤–ã§ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã®æ–¹æ³•ã«åˆ‡ã‚Šæ›¿ãˆã¦ãã¦ã„ã‚‹æ¨¡æ§˜ã€‚ï¼ˆç¾åœ¨ã€è©³ç´°ç¢ºèªä¸ãƒ»ãƒ»ãƒ»ï¼‰ ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆç®¡ç†è€…æ§˜ã¯ã€ã‚¦ã‚§ãƒ–ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ä»¥å¤–ã«ã‚µãƒ¼ãƒãƒ¼ç‰ã®è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã®ç¢ºèªã‚‚ã—ã¦ãŠã„ãŸæ–¹ãŒè‰¯ã•ãã†ã§ã™ã€‚ ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚ŒãŸ .htaccess ã®å†…å®¹ ----- #Â HostRule RewriteEngine On RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR
fn7 2010/03/01
.htaccess

Gumblar

security
ãƒªãƒ³ã‚¯
GNU gzipã«è„†å¼±æ€§ã€1.4ãƒªãƒªãƒ¼ã‚¹ | ã‚¹ãƒ©ãƒ‰ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
JVNã®JVNVU#188937 GNU gzip ã«ãŠã‘ã‚‹è¤‡æ•°ã®è„†å¼±æ€§çµŒç”±ã§çŸ¥ã£ãŸãŒã€GNU Projectã®GNU gzip â€” News: gzip-1.4 released (stable/security)ã«ã‚ˆã‚‹ã¨ã€GNU gzip 1.3.14 ï½ž1.3.3 ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«è¤‡æ•°ã®è„†å¼±æ€§ãŒã‚ã‚Šã€ä¿®æ£ãŒã•ã‚ŒãŸ1.4ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸã¨ã®ã“ã¨ã€‚ ã“ã®è¨˜äº‹ã«ã‚ˆã‚‹ã¨ã€è„†å¼±æ€§ã®ã‚ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã¯ã€ç´°å·¥ã•ã‚ŒãŸ gzip åœ§ç¸®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’å‡¦ç†ã•ã›ã‚‹ã“ã¨ã§ã€ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨å¦¨å®³ (DoS) æ”»æ’ƒã‚’å—ã‘ãŸã‚Šã€ãƒ¦ãƒ¼ã‚¶ã®æ¨©é™ã§ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚ŒãŸã‚Šã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ã¾ãŸã€è„†å¼±æ€§ã®ä¸€ã¤ã¯ã€64-bitã‚·ã‚¹ãƒ†ãƒ ä¸Šã§ã®ã¿å½±éŸ¿ã‚’å—ã‘ã‚‹æ¨¡æ§˜ã€‚ gzip 1.3.3ã®ãƒªãƒªãƒ¼ã‚¹ã¯2002å¹´3æœˆ8æ—¥ã§ã€1.3.14ã¯2009å¹´10æœˆ30æ—¥ã®ãƒªãƒªãƒ¼ã‚¹ãªã®ã§ã€ã‹ãªã‚Šé•·æœŸé–“ã®ã‚‚ã®ãŒå¯¾è±¡ã«ãªã‚‹ã€‚ ãªãŠã€2æœˆ5æ—¥ã®3æ™‚ç¾åœ¨ã§COD
fn7 2010/02/06
mod_deflateã¨çµ„ã¿åˆã‚ã›ã‚‰ã‚Œã‚‹ã¨ã€ã‚„ã°ã„ã‚“ã˜ã‚ƒãªã„ã®ã‚“?

gnu

security
ãƒªãƒ³ã‚¯
ã€è©æ¬º/ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã€‘ã€Œãƒã‚°ã‚¤ãƒ³ä¸‰å…„å¼Ÿã®æ´»ç”¨ã‚’ã€Yahoo! JAPANã®ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°å¯¾ç–ã€€
fn7 2010/01/29
security
ãƒªãƒ³ã‚¯
yebo blog: Kaminskyæ°ã®DNSãƒã‚°ãŒãƒªãƒ¼ã‚¯?
2008/07/23 Kaminskyæ°ã®DNSãƒã‚°ãŒãƒªãƒ¼ã‚¯? 2é€±é–“å‰ã«Dan Kaminskyæ°ãŒæŒ‡æ‘˜ã—ãŸDNSã®è„†å¼±æ€§ã¯Black Hatã§å…¬é–‹ã™ã‚‹ã¨ã—ã¦ã„ãŸãŒã€Halvar Flakeæ°ãŒæŽ¨æ¸¬ã—ãŸæ–¹æ³•ã§ã‚ã‚‹ã“ã¨ãŒã‚ã‹ã£ãŸã€‚ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’æ±šæŸ“ã™ã‚‹ãŸã‚ã«ã¯æ¬¡ã®ã‚ˆã†ã«æ”»æ’ƒã‚’è¡Œã†ã€‚æ”»æ’ƒè€…ã¯ã„ã„åŠ æ¸›ãªå¤šæ•°ã®ãƒ‰ãƒ¡ã‚¤ãƒ³å www.ulam00001.com, www.ulam00002.com ã®ã‚ˆã†ã«å•ã„åˆã‚ã›ã‚’è¡Œã†ã€‚ã‚µãƒ¼ãƒã¯ã‚ãƒ£ãƒƒã‚·ãƒ¥ã«ãªã„ãŸã‚ã€ã€Œ.comã€ã®ãƒãƒ¼ãƒ ã‚µãƒ¼ãƒã«å•ã„åˆã‚ã›ã‚‹ã“ã¨ã«ãªã‚‹ã€‚ãã“ã§ã€æ”»æ’ƒè€…ã¯.com ã®æ¨©å¨DNSã‚µãƒ¼ãƒã‚’å½è£…ã—ã¦ã€www.ulam00002.comã®NSã¯ns.google.comã ã‚ˆã¨çŸ¥ã‚‰ã›ã€ns.google.com ãŒ66.6.6.6ã§ã‚ã‚‹ã¨ã™ã‚‹ã‚°ãƒ«ãƒ¼ã‚’åŠ ãˆã¦å¿œç”ã‚’è¡Œã†ã€‚ã™ã‚‹ã¨ã€TXIDãŒä¸€è‡´ã—ãŸå ´åˆã«ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒã¯ãã®ã‚°ãƒ«ãƒ¼æƒ…
fn7 2008/07/27
ã‚ãƒ£ãƒƒã‚·ãƒ¥æ±šæŸ“ã€ã‚ã‹ã‚Šã‚„ã™ã„è§£èª¬

dns

security
ãƒªãƒ³ã‚¯
HTTPå¿œç”ãƒ‘ã‚±ãƒƒãƒˆã‚’æ‚ªç”¨ã™ã‚‹ARPã‚¹ãƒ—ãƒ¼ãƒ•ã‚£ãƒ³ã‚°ãƒ»ã‚¦ã‚¤ãƒ«ã‚¹
ã€ŒARP spoofing HTTP infection malwareã€ã‚ˆã‚Š December 21ï¼Œ2007 posted by Kai Zhang, Security Researcher 2007å¹´ã¯ï¼ŒARPã‚¹ãƒ—ãƒ¼ãƒ•ã‚£ãƒ³ã‚°ã¨ã„ã†æ‰‹å£ã‚’ä½¿ã†ã‚¦ã‚¤ãƒ«ã‚¹ï¼ˆARPã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒ»ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ãƒ»ã‚¦ã‚¤ãƒ«ã‚¹ï¼‰ãŒæ•°å¤šãç™»å ´ã—ãŸã€‚ã“ã®ç¨®ã®ãƒžãƒ«ã‚¦ã‚¨ã‚¢ã‹ã‚‰ã¯å¤§é‡ã®äºœç¨®ãŒæ´¾ç”Ÿã—ï¼Œä¸å›½ã§åºƒãæµè¡Œã—ã¦ã„ã‚‹ã€‚å…ˆã”ã‚ç†è€…ã‚‰ã¯ï¼Œæ–°ãŸãªç‰¹å¾´ã‚’æŒã¤ARPã‚¹ãƒ—ãƒ¼ãƒ•ã‚£ãƒ³ã‚°ãƒ»ã‚¦ã‚¤ãƒ«ã‚¹ã‚’è¦‹ã¤ã‘ãŸã€‚ ã“ã®æ–°ç¨®ã®ARPã‚¹ãƒ—ãƒ¼ãƒ•ã‚£ãƒ³ã‚°ãƒ»ã‚¦ã‚¤ãƒ«ã‚¹ã¯ï¼ŒHTTPå¿œç”ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«æ”»æ’ƒç”¨URLã‚’æŒ¿å…¥ã™ã‚‹ã€‚ãã—ã¦ï¼Œæ€ªã—ã’ãªã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã§Internet Explorerï¼ˆIEï¼‰ã‚’æ‚ªç”¨ã™ã‚‹ã€‚åŒæ™‚ã«ï¼Œã‚³ãƒ¼ãƒ‰æŒ¿å…¥ã§ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã—ãŸãƒ›ã‚¹ãƒˆãƒ»ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚’HTTPãƒ—ãƒã‚ã‚·ãƒ»ã‚µãƒ¼ãƒãƒ¼ã¨ã—ã¦ä½¿ã†ã€‚ã“ã®ãƒ›ã‚¹ãƒˆã¨åŒã˜ã‚µãƒ–ãƒãƒƒãƒˆã«ã‚ã‚‹ãƒžã‚·ãƒ³ã‹ã‚‰ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ»ã‚¢ã‚¯ã‚»ã‚¹
fn7 2008/01/28
ã“ã†ã„ã†ã®ã‚„ã£ã‹ã„ã ãªãã€ã€

network

security

ã‚¦ã‚¤ãƒ«ã‚¹
ãƒªãƒ³ã‚¯
ç¬¬3å›žã€€JSONPã§ã®ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚¢ã‚¯ã‚»ã‚¹ | gihyo.jp
JSONPã®å‹•ä½œåŽŸç† å‰å›žã¯Ajaxã«å˜åœ¨ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¢ãƒ‡ãƒ«ã§ã‚ã‚‹Same-Originãƒãƒªã‚·ãƒ¼ã‚’ç´¹ä»‹ã—ã€ãã®Same-Originãƒãƒªã‚·ãƒ¼ã‚’è¿‚å›žã™ã‚‹æ–¹æ³•ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦è¦‹ã¦ãã¾ã—ãŸã€‚ã¾ãŸã€å›žé¿ã™ã‚‹æ–¹æ³•ã®1ã¤ã‚ã¨ã—ã¦ãƒªãƒãƒ¼ã‚¹Proxyã‚’ç”¨ã„ãŸæ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã—ãŸã€‚ãƒªãƒãƒ¼ã‚¹Proxyã‚’ç”¨ã„ãŸæ–¹æ³•ã§ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çš„ãªå•é¡Œç‚¹ã‚‚ã‚ã‚Šã¾ã—ãŸãŒã€ãã‚‚ãã‚‚Proxyã‚µãƒ¼ãƒã‚’ç”¨æ„ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ãŸã‚ã€ã“ã®æ–¹æ³•ã¯æ‰‹è»½ã«ä½¿ã†ã“ã¨ã¯ã§ãã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§è€ƒãˆå‡ºã•ã‚ŒãŸã®ãŒJSONPï¼ˆJavaScript Object Notation with Paddingï¼‰ã¨ã„ã†æ–¹æ³•ã§ã™ã€‚ ãã‚Œã§ã¯ã¾ãšç°¡å˜ã«JSONPã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ Ajaxã§ä½¿ã‚ã‚Œã‚‹XMLHttpRequestã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã«ã¯å‰å›žèª¬æ˜Žã—ãŸã¨ãŠã‚ŠSame-Originãƒãƒªã‚·ãƒ¼ãŒã‚ã‚Šã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚¢ã‚¯ã‚»ã‚¹ã¯ã§ãã¾ã›ã‚“ã€‚ä¸€æ–¹ã€SCRIPTã‚¿ã‚°
fn7 2007/11/14
ã»ã»ã†ã€‚ã€‚

jsonp

security

ajax

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ã¦ã£ãç…®ãƒ–ãƒã‚° - ã‚ã¾ã‚Šèªžã‚‰ã‚Œã¦ã„ãªã„ Apollo ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ
(2007å¹´10æœˆè¿½è¨˜) ã“ã®è¨˜äº‹ã¯ã€Adobe AIR ã¨å‘¼ã°ã‚Œã¦ã„ã‚‹æŠ€è¡“ã®Î±ç‰ˆæ™‚ç‚¹ã§ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦è¿°ã¹ã¦ã„ã¾ã™ã€‚2007å¹´10æœˆç¾åœ¨ã§ã®æœ€æ–°ç‰ˆã«ã¤ã„ã¦ã®æƒ…å ±ã¯ã€ä»¥ä¸‹ã®ãƒšãƒ¼ã‚¸ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚akihiro kamijo: Adobe AIR ãƒ™ãƒ¼ã‚¿ 2 ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®å¤‰æ›´ç‚¹akihiro kamijo: Adobe AIR ã®ãƒ‡ã‚¸ã‚¿ãƒ«ç½²åæ©Ÿèƒ½ã«ã¤ã„ã¦(è¿½è¨˜ã“ã“ã¾ã§) void element blog: ã„ã‚ã‚“ãªæ„å‘³ã§ã—ã‚ƒã‚Œã«ãªã‚‰ãªã„Apollo ã«ã¦ Apollo ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çš„ã«å±ãªã„ã‚ˆã€ã¨ã„ã†è©±ãŒå‡ºã¦ã„ãŸã®ã§ã€ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚Web æŠ€è¡“ã‚’ä½¿ã£ã¦ã„ã‚‹ã¨ã¯ã„ãˆã€ãƒãƒ¼ã‚«ãƒ«ç’°å¢ƒã§å‹•ãã®ã§ã€ã‚ã‚‹ç¨‹åº¦ã®è¦šæ‚Ÿã‚’ã‚‚ã£ã¦ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ä»Šå›žã¯ã€ãã®å¿ƒæ§‹ãˆï¼ˆï¼Ÿï¼‰ã®ã‚ˆã†ãªã‚‚ã®ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯å°‚é–€ã§ã¯ãªã„ã®ã§ã€ã¤ã£ã“ã¿ã¯å¤§æ“è¿Žã§ã™ã€‚Apollo
fn7 2007/03/28
apollo

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
æºå¸¯æ¥ç•Œã®èªè¨¼äº‹æƒ… - y-kawazã®æ—¥è¨˜
å·¡å›žã‚µã‚¤ãƒˆã®ä¸€ã¤ã§ã‚ã‚‹é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ã§ä»¥ä¸‹ã®ã‚ˆã†ãªã‚¨ãƒ³ãƒˆãƒªãƒ¼ãŒã‚ã£ãŸã€‚ é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - æºå¸¯é›»è©±å‘ã‘Webã‚¢ãƒ—ãƒªã®è„†å¼±æ€§äº‹æƒ…ã¯ã©ã†ãªã£ã¦ã„ã‚‹ã®ã‹ ã“ã“ã§ã¯ã„ã¤ã‚‚ã®é«˜æœ¨æ°ã®å£èª¿ã§ã€ã€Œæºå¸¯å‘ã‘WEBã‚¢ãƒ—ãƒªé–‹ç™ºã§ã¯æœªã ã«GETãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’æ¸¡ã—ã¦ãŠã‚Šã€ãã‚Œã¯ã“ã‚Œã¾ã§ã‚‚ä½•åº¦ã‚‚ã„ã‹ã‚“ã“ã¨ã ã¨è¨€ã£ã¦ã„ã‚‹ã€‚ã€ã¨ã„ã†ã‚ˆã†ãªå†…å®¹ãŒèªžã‚‰ã‚Œã¦ã„ã‚‹ã€‚ ç¢ºã‹ã«WEB+DBã®è¨˜äº‹ã«å¯¾ã—ã¦é«˜æœ¨æ°ãŒæ³¨é‡ˆã§è¨€ã£ã¦ã„ã‚‹ã‚ˆã†ã«ã€ŒIPã‚¢ãƒ‰ãƒ¬ã‚¹ã«ã‚ˆã‚‹åˆ¶é™ã«é–¢ã—ã¦æ›¸ã„ã¦ã„ãªã„ã€ã¨ã„ã†ç‚¹ã«é–¢ã—ã¦ã¯WEB+DBå´ã®è½ã¡åº¦ã ã¨æ€ã†ã€‚å®Ÿéš›ã“ã‚Œã‚’è¡Œã‚ãªã„é™ã‚Šç«¯æœ«IDã‚„ãƒ¦ãƒ¼ã‚¶ID*1ã«ã‚ˆã‚‹èªè¨¼ãŒæ„å‘³ã‚’ãªã•ãªããªã£ã¦ã—ã¾ã†ã‹ã‚‰ã ã€‚*2 ä½†ã—ã€ã‚ãƒ£ãƒªã‚¢æ¯Žã«IPã‚¢ãƒ‰ãƒ¬ã‚¹åˆ¶é™ã‚’ã™ã‚‹é™ã‚Šã«ãŠã„ã¦ã¯ç«¯æœ«IDã‚„ãƒ¦ãƒ¼ã‚¶IDã¯å½è£…ä¸å¯èƒ½*3ãªã®ã§ã€ã‚€ã—ã‚ä»–äººã§ã‚‚å…¥åŠ›å¯èƒ½ãªãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰èªè¨¼ã‚ˆã‚Šã‚‚å¼·åŠ›ãªèªè¨¼ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚é€†ã«ã„ãˆã°ãã®èª
fn7 2007/02/26
æºå¸¯ã§ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«ã¤ã„ã¦ã®è€ƒå¯Ÿã€‚ã¨ãã«é«˜æœ¨å…ˆç”Ÿã¸ã®æ‰¹åˆ¤ã¯ã©ã†ã§ã‚‚ã„ã„

æºå¸¯

web

security
ãƒªãƒ³ã‚¯
ãã‚Œ Unicode ã§
UTF-7 ã‚’ä½¿ã£ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨˜è¿° +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-+AC8-SCRIPT+AD4- IE ã¯ã€æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒä¸æ˜Žã§ UTF-7 ã£ã½ã„æ–‡å—åˆ—ãŒã‚ã‚Œã°ã€è‡ªå‹•åˆ¤åˆ¥ã§ UTF-7 ã¨ãªã‚‹ã€‚
fn7 2006/12/13
ã“ã‚Œã¯ã™ã”ã„

security

web

XSS
ãƒªãƒ³ã‚¯
1