[B! ã‚ã¨ã§èªã‚€][security] hara_boonã®ãƒ

hara_boon id:hara_boon

ã‚ã¨ã§èªã‚€ã¨securityã«é–¢ã™ã‚‹hara_boonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€2019å¹´ã€‘CTF Webå•é¡Œã®æ”»æ’ƒæ‰‹æ³•ã¾ã¨ã‚ (Webå•é¡Œã®writeupãœã‚“ã¶èªã‚€) - ã“ã‚“ã¨ã‚ãƒ¼ã‚‹ã—ãƒ¼ã“ã‚“ã¨ã‚ãƒ¼ã‚‹ã¶ã„
CTF Advent Calendar 2019 - Adventarã®25æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ 1ã¤å‰ã¯@ptr-yudaiæ°ã®2019å¹´ã®pwnå•ã‚’å…¨éƒ¨è§£ããƒãƒ£ãƒ¬ãƒ³ã‚¸ã€å¾ŒåŠæˆ¦ã€‘ - CTFã™ã‚‹ãžã§ã—ãŸã€‚ ã¯ã˜ã‚ã« å¯¾è±¡ã‚¤ãƒ™ãƒ³ãƒˆ å•é¡Œæ•° èªã¿æ–¹ã€ä½¿ã„æ–¹ Cross-Site Scripting(XSS) SVGãƒ•ã‚¡ã‚¤ãƒ«ã‚’åˆ©ç”¨ã—ãŸCSPãƒã‚¤ãƒ‘ã‚¹ Googleãƒ‰ãƒ¡ã‚¤ãƒ³ã®JSONPã‚’åˆ©ç”¨ã—ãŸCSPãƒã‚¤ãƒ‘ã‚¹ ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹å®Œå…¨æ€§(SRI)æ©Ÿèƒ½ã‚’åˆ©ç”¨ã—ãŸå…¥åŠ›ãƒã‚§ãƒƒã‚¯ãƒã‚¤ãƒ‘ã‚¹ Chrome æ‹¡å¼µæ©Ÿèƒ½ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼KeePassã®æ‚ªç”¨ HTML likeã‚³ãƒ¡ãƒ³ãƒˆã‚’ä½¿ç”¨ã—ãŸã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆ jQuery.getJSONã®JSONPæ©Ÿèƒ½ã‚’ä½¿ç”¨ã—ãŸã‚¹ã‚¯ãƒªãƒ—ãƒˆå®Ÿè¡Œ DOM Clobberingã«ã‚ˆã‚‹ã‚³ãƒ¼ãƒ‰ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ Service Workerã‚’åˆ©ç”¨ã—ãŸã‚¹ã‚¯ãƒªãƒ—ãƒˆå®Ÿè¡Œ XSS Auditoræ©Ÿèƒ½ã®ãƒã‚¤ãƒ‘ã‚¹
hara_boon 2019/12/29
web

SQL

github

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ã“ã‚Œã‹ã‚‰ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
Frontend Conference Fukuoka 2019
hara_boon 2019/11/17
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰

security

ã‚ã¨ã§èªã‚€

javascript
ãƒªãƒ³ã‚¯
æ±äº¬å¤§å¦å¤§å¦é™¢ å¤§æ¾¤æ˜‡å¹³ç‰¹ä»»å‡†æ•™æŽˆãŒã€Œä¿¡é ¼ã§ãã‚‹ã‚µã‚¤ãƒˆã€ã®è¦‹åˆ†ã‘æ–¹ã‚’è§£èª¬ â†’ é–“é•ã„ãŒå¤šã™ãŽã¦ã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒé€†ã«æ³¨æ„å–šèµ·ã™ã‚‹äº‹æ…‹ã«ãƒ»ãƒ»ãƒ»ã€‚
ã€2019/11/09 20:00ã€‘ã‚³ãƒ¡ãƒ³ãƒˆãƒ»ä¸€éƒ¨è¨˜è¿°ã‚’è¿½åŠ ã€‚ ã€2019/11/10 00:20ã€‘Let's Encryptã«é–¢ã™ã‚‹è¨˜è¿°ã‚’è¿½åŠ ãƒ»ä¿®æ£ã€‚ ã€2019/11/10 17:50ã€‘å¤§æ¾¤æ°ã®ã‚³ãƒ¡ãƒ³ãƒˆã‚’è¿½åŠ ã€‚ ã€2019/11/11 12:50ã€‘NISC/IPA/ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°å¯¾ç–å”è°ä¼šã«å¯¾ã—ã€å½“è©²è¨˜äº‹ã¸ã®å¯¾å¿œä¾é ¼ã‚’å®Ÿæ–½ã€‚ ã€2019/11/13 22:09ã€‘ã€Œé©åˆ‡ãªãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºå¯¾ç–ã«ã¤ã„ã¦ã€ã‚’è¿½åŠ ã€‚
hara_boon 2019/11/10
Togetter

ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚ã¨ã§èªã‚€

security
ãƒªãƒ³ã‚¯
ãƒ©ãƒ†ãƒ©ãƒ«ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã®å®Ÿæ…‹ï¼ˆUSENIX Security 2019ã‚ˆã‚Šï¼‰ | NTT Communications Developer Portal
ã“ã‚“ã«ã¡ã¯ã€æŠ€è¡“é–‹ç™ºéƒ¨ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¦ãƒ‹ãƒƒãƒˆã®ç”°ä¸ã§ã™ã€‚ç¤¾å†…ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒ¡ãƒ³ãƒãƒ¼ã§ã€ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢ä¿‚ã®è©±é¡Œã‚’æ›¸ã„ã¦ã„ãã¾ã™ã€‚åˆå›žã¨ãªã‚‹ä»Šå›žã¯ã€Œãƒ©ãƒ†ãƒ©ãƒ«ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã€ã«ã¤ã„ã¦ãŠé€ã‚Šã—ã¾ã™ã€‚ ãƒ©ãƒ†ãƒ©ãƒ«ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã¨ã¯ï¼Ÿ çš†ã•ã‚“ã¯ã€æœ€è¿‘ãƒãƒƒãƒˆã§ã‚‚å–ã‚Šä¸Šã’ã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ããŸã€ã€Œãƒ©ãƒ†ãƒ©ãƒ«ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã€(Lateral Phishing)ã¨ã„ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„…å¨ã‚’ã”å˜çŸ¥ã§ã—ã‚‡ã†ã‹ï¼Ÿ ãƒ©ãƒ†ãƒ©ãƒ«ã¨ã¯æ¨ªæ–¹å‘ã¸ã€ã‚’æ„å‘³ã—ã€ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã§ã¯ã€æ”»æ’ƒè€…ãŒå†…éƒ¨ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã«ä¸æ£ä¾µå…¥å¾Œã€æ„ŸæŸ“ã‚’æ‹¡å¤§ã™ã‚‹è¡Œç‚ºã‚’ã€Œãƒ©ãƒ†ãƒ©ãƒ«ãƒ ãƒ¼ãƒ–ãƒ¡ãƒ³ãƒˆã€ï¼ˆæ¨ªæ–¹å‘ã¸ã®ç§»å‹•ï¼‰ã¨å‘¼ã³ã€ã”å˜çŸ¥ã®æ–¹ã‚‚å¤šã„ã¨æ€ã„ã¾ã™ã€‚ ã€Œãƒ©ãƒ†ãƒ©ãƒ«ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã€ã¯ã€æ”»æ’ƒè€…ãŒçµ„ç¹”å†…ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’ä½•ã‚‰ã‹ã®æ‰‹æ³•ã§ä¹—ã£å–ã‚Šã€ãã®çµ„ç¹”ã®æ£è¦ã‚¢ã‚«ã‚¦ãƒ³ãƒˆï¼ˆãƒ‰ãƒ¡ã‚¤ãƒ³ï¼‰ã‹ã‚‰ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ãƒ¡ãƒ¼ãƒ«ã‚’é€ã‚‹ã‚‚ã®ã§ã™ã€‚æ£è¦ã®å†…éƒ¨ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‹ã‚‰ã®ãƒ¡ãƒ¼ãƒ«ãªã®ã§ã€ç¾åœ¨ã®æ”»æ’ƒæ¤œçŸ¥
hara_boon 2019/09/05
security

çµ„ç¹”

NTT

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è«–æ–‡

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
bash ã®å±é™ºãªç®—è¡“å¼ - ã©ã•ã«ã£ã
â– bash ã®å±é™ºãªç®—è¡“å¼ _ ä½¿ã£ã¦ã‚‹äººãŒã„ã¡ã°ã‚“å¤šã„ã ã‚ã†ã‹ã‚‰ã‚¿ã‚¤ãƒˆãƒ«ã§ã¯ bash ã¨ã—ã¦ã‚‹ã‘ã©ã€ã“ã“ã§å–ã‚Šä¸Šã’ã‚‹ã“ã¨ã¯ zsh ãŠã‚ˆã³ ksh ä¸€æ—(æœ¬å®¶ kshã€pdkshã€mksh)ã«ã‚‚è©²å½“ã™ã‚‹ã€‚ashã€dash ãªã©ã§ã¯è©²å½“ã—ãªã„ã€‚ _ ä»¥ä¸‹ã®ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã¯è„†å¼±æ€§ãŒã‚ã‚‹ã€‚ã‚ã‹ã‚‹ã ã‚ã†ã‹ã€‚ #!/bin/bash # "å“ç›®,å˜ä¾¡,å€‹æ•°" ã®å½¢å¼ã® CSV ã‚’èªã‚“ã§ã€"å“ç›®,åˆè¨ˆé‡‘é¡" ã®å½¢å¼ã§å‡ºåŠ›ã™ã‚‹ csv="foo.csv" while IFS=, read it em price num; do echo "$it em,$((price*num))" done < "$csv" ã“ã‚Œã€ç´°å·¥ã•ã‚ŒãŸ CSV ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é£Ÿã‚ã›ã‚‹ã“ã¨ã§ã€ä»»æ„ã‚³ãƒ¼ãƒ‰ã®å®Ÿè¡ŒãŒã§ãã¦ã—ã¾ã†ã€‚æ•°ã‚ã‚‹è„†å¼±æ€§ã®ä¸ã§ã‚‚ã¨ãã«ãƒ¤ãƒã„ã‚„ã¤ã ã€‚ã©ã“ãŒç©´ãªã®ã‹ã¨ã„ã†ã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ã«ã‚‚ã‚ã‚‹ã¨ãŠã‚Šç®—è¡“å¼ãªã®ã ãŒã€ã—
hara_boon 2019/09/02
æ–‡å—

bash

ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆ

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ä½“ç³»çš„ã«å¦ãµã‚™ãƒ¢ã‚¿ã‚™ãƒ³ Web ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ (#seccamp å…¨å›½å¤§ä¼š 2019 B5) / Learn Modern Web Security Systematically
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚ãƒ£ãƒ³ãƒ•ã‚šå…¨å›½å¤§ä¼š 2019 é–‹ç™ºã¨é‹ç”¨ãƒˆãƒ©ãƒƒã‚¯ã§æä¾›ã—ãŸè¬›ç¾©ã®è³‡æ–™ã®ä¸€éƒ¨ã§ã™ã€‚èª¤ã‚Šã«æ°—ãŒã¤ã„ãŸã‚‰ã€ãœã² @y0n3uchy ã‚ã‚‹ã„ã¯ @lmt_swallow ã«ãŠçŸ¥ã‚‰ã›ãã ã•ã„ã€‚
hara_boon 2019/08/16
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

web

è³‡æ–™

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
1