[B! security] hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hiroponz id:hiroponz

securityã«é–¢ã™ã‚‹hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (100)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹æ”¹è¨‚ã®ãŠçŸ¥ã‚‰ã›
å¾³ä¸¸æœ¬ã“ã¨ã€ã€Œä½“ç³»çš„ã«å¦ã¶ å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ã€ã¯ã€2011å¹´3æœˆã®ç™ºå£²ä»¥é™å¤§å¤‰å¤šãã®æ–¹ã«èªã‚“ã§ã„ãŸã ãã¾ã—ãŸã€‚ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ãŸã ã€ç™ºå£²ã‹ã‚‰æ—¢ã«7å¹´ãŒçµŒéŽã—ã€å†…å®¹ãŒå¤ããªã£ã¦ããŸæ„Ÿã¯å¦ã‚ã¾ã›ã‚“ã€‚ãŸã¨ãˆã°ã€ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã®èª¬æ˜Žã¯ã»ã¨ã‚“ã©ãªã„ã§ã™ã—ã€OWASP Top 10 2017ã§é¸å…¥ã•ã‚ŒãŸå®‰å…¨ã§ãªã„ãƒ‡ã‚·ãƒªã‚¢ãƒ©ã‚¤ã‚¼ãƒ¼ã‚·ãƒ§ãƒ³ã‚„XXEã®èª¬æ˜Žã‚‚ã‚ã‚Šã¾ã›ã‚“ã€‚ãªã«ã‚ˆã‚Šã€Web APIã‚„JavaScriptã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç‰ãŒã»ã¨ã‚“ã©æ›¸ã‹ã‚Œã¦ã„ãªã„ã“ã¨ãŒèª²é¡Œã¨ãªã£ã¦ã„ã¾ã—ãŸã€‚ ãã“ã§ã€ç‰ˆå…ƒã®SBã‚¯ãƒªã‚¨ã‚¤ãƒ†ã‚£ãƒ–ã¨ç›¸è«‡ã—ã¦ã€ã“ã®åº¦æ”¹è¨‚ã™ã‚‹ã“ã¨ã«ã„ãŸã—ã¾ã—ãŸã€‚3æœˆæœ«è„±ç¨¿ã€6æœˆé ƒç™ºå£²ã®è¦‹è¾¼ã¿ã§ã™ã€‚ æ”¹è¨‚ã«ã‚ãŸã‚Šã€ä»¥ä¸‹ã‚’è€ƒãˆã¦ã„ã¾ã™ã€‚ Web APIã¨JavaScriptã«é–¢ã™ã‚‹èª¬æ˜Žã‚’4ç« ã«è¿½åŠ XHR2å¯¾å¿œã«å‘ã‘ã¦CORSã®èª¬æ˜Žã‚’3ç« ã«è¿½åŠ æºå¸¯é›»è©±ã®ç« ã¯ä¸¸ã”ã¨å‰Šé™¤ã—ã¦ã€åˆ¥ã®å†…
hiroponz 2018/03/06
æ°—ã«ãªã‚‹

security

book
ãƒªãƒ³ã‚¯
CSP Report åŽé›†ã¨å®Ÿãƒ¬ãƒãƒ¼ãƒˆã®è€ƒå¯Ÿ | blog.jxck.io
Intro ã“ã®ãƒ–ãƒã‚°ã§ CSP ãƒ¬ãƒãƒ¼ãƒˆã®åŽé›†ã‚’é–‹å§‹ã—ã¦ã‚‚ã†ã™ã 1 å¹´ã«ãªã‚‹ã€‚ ç¾çŠ¶ã€å¯¾è±¡ãƒ‰ãƒ¡ã‚¤ãƒ³å†…ã§ <input> ã¯ä¸€åˆ‡æä¾›ã—ã¦ãŠã‚‰ãšã€å¤§åŠãŒé™çš„ã«ç”Ÿæˆã•ã‚ŒãŸãƒšãƒ¼ã‚¸ã§ã‚ã‚‹ãŒã€ã“ã®æ¡ä»¶ã§ã‚‚ã€ã‹ãªã‚Šå¤šãã®ãƒ¬ãƒãƒ¼ãƒˆãŒé›†ã¾ã£ãŸã€‚ ä»Šå›žã¯ã€åŽé›†ã—ãŸå®Ÿéš›ã®ãƒ¬ãƒãƒ¼ãƒˆã‚’ä¾‹ã«ã€æ”»æ’ƒã§ã¯ãªã„ã¨æ€ã‚ã‚Œã‚‹ãƒ¬ãƒãƒ¼ãƒˆã¨ã—ã¦ã©ã†ã„ã£ãŸã‚‚ã®ãŒé€ã‚‰ã‚Œã¦æ¥ãŸã‹ã‚’ä¸å¿ƒã«ã€ãã®å†…å®¹ã‚„ãƒ¬ãƒãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã‚µãƒ¼ãƒã€CSP ã®é‹ç”¨ã«é–¢ã™ã‚‹ç¾æ™‚ç‚¹ã®è€ƒå¯Ÿã«ã¤ã„ã¦ã¾ã¨ã‚ã‚‹ã€‚ åŽé›†ç›®çš„ CSP ã®åŸºæœ¬ã¯ã€æ„å›³ã—ãªã„ãƒªã‚½ãƒ¼ã‚¹ã®èªã¿è¾¼ã¿ã‚„ã€Inline Script ã®å®Ÿè¡Œã‚’é˜²ãã“ã¨ã«ã‚ã‚‹ã€‚ ä¾‹ãˆã°ã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¼ã‚Œã«ã‚ˆã‚Š XSS ãŒç™ºç”Ÿã—ã€æ‚ªæ„ã®ã‚ã‚‹ Inline Script ãŒåŸ‹ã‚è¾¼ã¾ã‚ŒãŸå ´åˆã§ã‚‚ã€Inline Script ã‚’ç¦æ¢ã™ã‚‹ãƒãƒªã‚·ãƒ¼ã‚’é©ç”¨ã—ãŸãƒšãƒ¼ã‚¸ã§ã¯ã€ãã®å®Ÿè¡Œã¯ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ Violation(é•å)ã¨åˆ¤æ–ã•ã‚Œãƒ–ãƒãƒƒã‚¯ã•
hiroponz 2018/03/05
èˆˆå‘³æ·±ã„

security
ãƒªãƒ³ã‚¯
RPCã«ç‰¹åŒ–ã—ãŸGoogleã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é€šä¿¡ALTSã¨ã¯ä½•ã‹ - ã¼ã¡ã¼ã¡æ—¥è¨˜
ã¯ã˜ã‚ã« æ˜¨å¹´ã€Googleã‹ã‚‰ Google Cloud Platform ã«é–¢ã™ã‚‹WhitePaperãŒã„ãã¤ã‹å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãã®ä¸ã§Googleã®ã‚µãƒ¼ãƒ“ã‚¹å†…éƒ¨ã§ä½¿ã‚ã‚Œã¦ã„ã‚‹æ–°ã—ã„ALTSã¨ã„ã†ãƒ—ãƒãƒˆã‚³ãƒ«ã‚’èª¬æ˜Žã—ãŸæ–‡æ›¸ã€ŒApplication Layer Transport Securityã€ã¯ã€èªã‚“ã§ã¿ã‚‹ã¨éžå¸¸ã«é¢ç™½ãã€ã‚»ã‚ãƒ¥ã‚¢ãªã‚µãƒ¼ãƒ“ã‚¹é–“é€šä¿¡ã«ã¯æœ¬å½“ã«ä½•ãŒå¿…è¦ãªã®ã‹ã€ã¨ã„ã£ãŸã“ã¨ã‚’æ”¹ã‚ã¦æ·±ãè€ƒãˆã•ã›ã‚‰ã‚Œã‚‹ã‚‚ã®ã§ã—ãŸã€‚ç‰©ç†çš„ãªãƒžã‚·ãƒ³ã‹ã‚‰ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨ã¾ã§ã€ALTSãŒã‚«ãƒãƒ¼ã™ã‚‹ç¯„å›²ã¯å¹…åºƒã„é ˜åŸŸã«æ¸¡ã‚Šã€ã‚ã®å·¨å¤§ãªGoogleã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã‚ˆãã“ã“ã¾ã§ã¾ã¨ã‚ä¸Šã’ãŸã‚‚ã®ã ã¨ãƒ›ãƒ³ãƒˆæ„Ÿå¿ƒã•ã›ã‚‰ã‚Œã¾ã™ã€‚ ä»¥å‰ã‹ã‚‰ã€Googleã¯ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿å†…ã®ã‚µãƒ¼ãƒ“ã‚¹é€šä¿¡ã¾ã§ã‚‚æš—å·åŒ–ã‚’é€²ã‚ã¦ã„ã‚‹ã¨è¨€ã‚ã‚Œã¦ã„ã¾ã—ãŸã€‚ãã‚Œã¯ã€2013å¹´ã«ã‚¨ãƒ‰ãƒ¯ãƒ¼ãƒ‰ãƒ»ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³ãŒæš´éœ²ã—ãŸè³‡æ–™ãŒã€Googleã®ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿å†…éƒ¨ã®é€šä¿¡ãƒ‡ãƒ¼ã‚¿
hiroponz 2018/01/16
alts

network

security
ãƒªãƒ³ã‚¯
Rails, Secure Cookies, HSTS and friends
hiroponz 2017/11/27
rails

security
ãƒªãƒ³ã‚¯
TLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ãŸã‚ã«ï¼ˆæš—å·è¨å®šå¯¾ç–ç·¨ï¼‰ | æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ | IPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
ã€ŒTLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã€ã¯ã€TLSã‚µãƒ¼ãƒã®æ§‹ç¯‰è€…ã‚„é‹å–¶è€…ãŒé©åˆ‡ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’è€ƒæ…®ã—ãŸæš—å·è¨å®šãŒã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹ãŸã‚ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã§ã™ã€‚ã€Œæ§˜ã€…ãªåˆ©ç”¨ä¸Šã®åˆ¤æ–ææ–™ã‚‚åŠ å‘³ã—ãŸåˆç†çš„ãªæ ¹æ‹ ã€ã‚’é‡è¦–ã—ã¦ã€TLSé€šä¿¡ã§ã®å®Ÿç¾ã™ã¹ãå®‰å…¨æ€§ã¨å¿…è¦ã¨ãªã‚‹ç›¸äº’æŽ¥ç¶šæ€§ã¨ã®ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã‚’è€ƒæ…®ã—ãŸ3ã¤ã®è¨å®šåŸºæº–ï¼ˆã€Œé«˜ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åž‹ã€ã€ŒæŽ¨å¥¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åž‹ã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¾‹å¤–åž‹ã€ï¼‰ã‚’è¨ã‘ã¦ãŠã‚Šã€å„ã€…ã®è¨å®šåŸºæº–ã«å¯¾å¿œã—ã¦ã€TLSã‚µãƒ¼ãƒã§è¨å®šã™ã¹ãå…·ä½“çš„ãªè¦æ±‚è¨å®šï¼ˆã€Œéµå®ˆé …ç›®ã€ã¨ã€ŒæŽ¨å¥¨é …ç›®ã€ï¼‰ã‚’æ±ºã‚ã¦ãŠã‚Šã¾ã™ã€‚ æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã¨ã¨ã‚‚ã«é©åˆ‡ãªæš—å·è¨å®šã‚’ã™ã‚‹è³‡æ–™ã®ä¸€ã¤ã¨ã—ã¦ãŠä½¿ã„ã„ãŸã ã‘ã¾ã™ã€‚ ãªãŠã€æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯ã€æš—å·æŠ€è¡“è©•ä¾¡ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆCRYPTRECã§ä½œæˆã•ã‚Œã¾ã—ãŸã€‚ ã€ŒTLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã€ã®å†…å®¹ 1ç« ã¨2ç« ã¯ã€æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ç›®çš„ã‚„SSL/TLSã«ã¤ã„ã¦ã®æŠ€è¡“çš„ãªåŸºç¤ŽçŸ¥è˜ã‚’
hiroponz 2017/11/27
ã‚ã¨ã§èªã‚€

security
ãƒªãƒ³ã‚¯
CircleCI trusts 8 analytics companies with your source code and API tokens | Kevin Burke
hiroponz 2017/10/11
èˆˆå‘³æ·±ã„

security
ãƒªãƒ³ã‚¯
Discovering a Session Hijacking Vulnerability in GitLab | Imperva
hiroponz 2017/09/04
å‚è€ƒã«ãªã‚‹

gitlab

security
ãƒªãƒ³ã‚¯
CDNåˆ‡ã‚Šæ›¿ãˆä½œæ¥ã«ãŠã‘ã‚‹ã€Webç‰ˆãƒ¡ãƒ«ã‚«ãƒªã®å€‹äººæƒ…å ±æµå‡ºã®åŽŸå› ã«ã¤ãã¾ã—ã¦ - Mercari Engineering Blog
æœ¬æ—¥ã‚³ãƒ¼ãƒãƒ¬ãƒ¼ãƒˆã‚µã‚¤ãƒˆã§ãŠçŸ¥ã‚‰ã›ã—ãŸé€šã‚Šã€Webç‰ˆã®ãƒ¡ãƒ«ã‚«ãƒªã«ãŠã„ã¦ä¸€éƒ¨ã®ãŠå®¢ã•ã¾ã®å€‹äººæƒ…å ±ãŒä»–è€…ã‹ã‚‰é–²è¦§ã§ãã‚‹çŠ¶æ…‹ã«ãªã£ã¦ã„ãŸã“ã¨ãŒåˆ¤æ˜Žã—ã¾ã—ãŸã€‚åŽŸå› ã¯ã™ã§ã«åˆ¤æ˜Žã—ã¦ä¿®æ£ãŒå®Œäº†ã—ã¦ãŠã‚Šã¾ã™ã€‚ã¾ãŸã€å€‹äººæƒ…å ±ã‚’é–²è¦§ã•ã‚ŒãŸå¯èƒ½æ€§ã®ã‚ã‚‹ãŠå®¢ã•ã¾ã«ã¯ã€ãƒ¡ãƒ«ã‚«ãƒªäº‹å‹™å±€ã‚ˆã‚Šã€ãƒ¡ãƒ«ã‚«ãƒªå†…ã®å€‹åˆ¥ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«ã¦ã”é€£çµ¡ã•ã›ã¦ã„ãŸã ãã¾ã—ãŸã€‚ ãŠå®¢ã•ã¾ã®å¤§åˆ‡ãªå€‹äººæƒ…å ±ã‚’ãŠé ã‹ã‚Šã—ã¦ã„ã‚‹ã«ã‚‚é–¢ã‚ã‚‰ãšã€ã“ã®ã‚ˆã†ãªäº‹æ…‹ã«è‡³ã‚Šã€æ·±ããŠè©«ã³ã‚’ç”³ã—ä¸Šã’ã¾ã™ã€‚ æœ¬ã‚¨ãƒ³ãƒˆãƒªã§ã¯æŠ€è¡“çš„è¦³ç‚¹ã‹ã‚‰è©³ç´°ã‚’ãŠä¼ãˆã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ 2017å¹´6æœˆ27æ—¥ã€€CDNã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ã®å‹•ä½œã«ã¤ã„ã¦ã€CDNãƒ—ãƒãƒã‚¤ãƒ€ã¨ä»•æ§˜ã«ã¤ã„ã¦ç¢ºèªã—æ¤œè¨¼ã‚’è¡Œã„ã¾ã—ãŸã€‚ãã®çµæžœä¸€éƒ¨è¨˜è¿°ã«å®Ÿéš›ã¨ç•°ãªã‚‹ç®‡æ‰€ãŒã‚ã‚Šã€åŠ ç†ä¿®æ£ã„ãŸã—ã¾ã—ãŸã€‚ æ¦‚è¦ ãƒ¡ãƒ«ã‚«ãƒªWebç‰ˆã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’ã—ã¦ã„ã‚‹CDNã®ãƒ—ãƒãƒã‚¤ãƒ€åˆ‡ã‚Šæ›¿ãˆã‚’è¡Œã„ã¾ã—ãŸã€‚ ãã®éš›æœ¬æ¥ã‚ãƒ£ãƒƒã‚·ãƒ¥ã•ã‚Œã‚‹ã¹ãã§ãªã„
hiroponz 2017/06/23
çŸ¥è¦‹ã

security
ãƒªãƒ³ã‚¯
AutomaticSecurityUpdates - Community Help Wiki
Introduction This is a simple tutorial that will teach you to configure your system to automatically install security updates. There are always some security risks involved in running software upgrades without supervision, but there are also benefits. If you believe it's important to stay up to date with the latest security patches, then you should follow this simple tutorial. There are several op
hiroponz 2017/05/08
ubuntu

security
ãƒªãƒ³ã‚¯
GitHub - brunofacca/zen-rails-security-checklist: Checklist of security precautions for Ruby on Rails applications.
Broken Authentication and Session Management are #2 at the OWASP Top 10. Avoid rolling your own authentication unless you know exactly what you are doing. Consider using a gem such as Devise, Authlogic or Clearance. Mitigates dozens of potential vulnerabilities. Enforce a minimum password length of 8 characters or more. Mitigates brute-force attacks. Devise: set config.password_length = 8..128 in
hiroponz 2017/04/25
è‰¯ã„

rails

security
ãƒªãƒ³ã‚¯
OWASP WebGoat | OWASP Foundation
This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Learn the hack - Stop the attack WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities commonly found in Java-based applications that use common and popular open source components. Description Web application security
hiroponz 2017/04/20
security
ãƒªãƒ³ã‚¯
Googleã¯å·¨å¤§ãªã‚¤ãƒ³ãƒ•ãƒ©ã‚’ã©ã†ã‚„ã£ã¦ã‚»ã‚ãƒ¥ã‚¢ã«ä¿ã£ã¦ã„ã‚‹ã‹ã€‚ç‹¬è‡ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒƒãƒ—åˆ©ç”¨ã‚„DoSå¯¾ç–ã€å®‰å…¨ãªã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢é–‹ç™ºãªã©ã€å…¨ä½“åƒã‚’è§£èª¬ã—ãŸãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚’å…¬é–‹
Googleã®ã‚¯ãƒ©ã‚¦ãƒ‰ã¯é–“é•ã„ãªãä¸–ç•Œæœ€å¤§è¦æ¨¡ã®ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚·ã‚¹ãƒ†ãƒ ã§ã™ã€‚è†¨å¤§ãªãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ã¨ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‹ã‚‰æ§‹æˆã•ã‚Œã‚‹ã“ã®å·¨å¤§ãªã‚·ã‚¹ãƒ†ãƒ ã‚’ã€åŒç¤¾ã¯ã©ã†ã‚„ã£ã¦ã‚»ã‚ãƒ¥ã‚¢ã«ä¿ã£ã¦ã„ã‚‹ã®ã‹ã€‚ãã®ã“ã¨ã‚’è§£èª¬ã—ãŸãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã€ŒGoogle Infrastructure Security Design Overviewã€ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã«ã¯ã€Googleã®ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼ã‚’æ§‹æˆã™ã‚‹ãƒ‡ãƒã‚¤ã‚¹ã®1ã¤1ã¤ã«ã¾ã§ç‹¬è‡ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒƒãƒ—ã‚’çµ„ã¿è¾¼ã‚“ã§æ£è¦ã®ãƒ‡ãƒã‚¤ã‚¹ã‹ã©ã†ã‹ã‚’ç›¸äº’ã«èªè¨¼ã™ã‚‹ã¨ã„ã†ç‰©ç†ãƒ¬ãƒ™ãƒ«ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‹ã‚‰ã€ä½•å±¤ã®ã‚‚ã®ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µãƒ¼ã‹ã‚‰ã®æƒ…å ±ã‚’é›†ç´„ã—ã¦Dosæ”»æ’ƒã‚’æ¤œçŸ¥ã™ã‚‹ã¨ã€ãã®é€šä¿¡ã‚’ç ´æ£„ã™ã‚‹ã¨ã„ã£ãŸDoSå¯¾ç–ã€‚ ãã—ã¦ãƒžã‚·ãƒ³ã‚‚å¾“æ¥å“¡ã‚‚ã‚µãƒ¼ãƒ“ã‚¹ã‚‚åŒ…æ‹¬ã™ã‚‹ã‚°ãƒãƒ¼ãƒãƒ«ãªåå‰ç©ºé–“ãªã©ã€ãã‚ã‚ã¦åºƒç¯„ã‹ã¤ç¶¿å¯†ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ–½ç–ãŒèª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ ã‚¯ãƒ©ã‚¦ãƒ‰ãŒã„ã‹ã«é«˜åº¦ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã§
hiroponz 2017/01/16
google

security
ãƒªãƒ³ã‚¯
5åˆ†ã§ã‚ã‹ã‚‹ Perl and web security
yapcjapan2016_lt.md 5åˆ†ã§ã‚ã‹ã‚‹ Perl and web security ma.la CSRFã¨ã‹XSSã¨ã‹ CSRF: ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®æ©Ÿèƒ½ä½¿ã£ã¦ä¸‹ã•ã„ XSS: Xslateã¨ã‹è‡ªå‹•ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¦ä¸‹ã•ã„ã€jsã®å‹•çš„ç”Ÿæˆã¯ã™ã‚‹ãª çµ‚ã‚ã‚Š æœ¬é¡Œ YAPCãªã®ã§Perlå›ºæœ‰ã®å•é¡Œã«ã¤ã„ã¦è§£èª¬ã—ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸€èˆ¬çš„ãªæµã‚Œ ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿å—ã‘å–ã‚‹(ãƒ•ã‚©ãƒ¼ãƒ ã¨ã‹JSONã¨ã‹) ä½•ã‚‰ã‹ã®å‡¦ç†ã‚’ã™ã‚‹ ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã™(HTMLã¨ã‹JSONã¨ã‹) ãƒ•ã‚©ãƒ¼ãƒ ã‚„JSONã‚’å®‰å…¨ã«å—ã‘å–ã‚‹ã«ã¯ paramã¯scalarã§å—ã‘å–ã‚Šã¾ã—ã‚‡ã† Why $params = { name => $r->param("name"), value => $r->param("value"), } ã“ã‚Œã‚’ã‚„ã‚‹ã¨ ?name=hoge&name=fuga ã§å£Šã›ã‚‹ã€‚ list context
hiroponz 2016/12/11
security
ãƒªãƒ³ã‚¯
GitLab disclosed on HackerOne: Read files on application server,...
GitLab CE/EE versions 8.9, 8.10, 8.11, 8.12, and 8.13 are vulnerable to an arbitrary file read vulnerability. The vulnerability could be exploited to gain access to the application's secrets. These secrets could be used to gain command execution access on the application server. The CVSS for the vulnerability in versions 8.9, 8.10, 8.11, and 8.12 is determined to be 8.4...
hiroponz 2016/11/04
æ”»æ’ƒæ‰‹æ³•ã®å‚è€ƒã¨ã—ã¦

security
ãƒªãƒ³ã‚¯
Rails Webconsole DNS Rebinding - Ben's Blog
The webconsole gem which ships with the Rails development server allows remote code execution via DNS Rebinding. I reported this issue to Rails on April 20th 2015. However, it may have been reported to them earlier because Homakov also found the issue independently and tweeted about it here: There are lots of dangerous interactions with localhost: I tweeted that with DNS rebinding we can RCE via R
hiroponz 2016/07/13
rails

security
ãƒªãƒ³ã‚¯
OAuth 2.0 ã® code ã¯æ¼ã‚Œã¦ã‚‚å¤§ä¸ˆå¤«ã£ã¦ãƒ›ãƒ³ãƒˆ!? - OAuth.jp
æ˜¨æ—¥ã®Covert Redirect ã§ Query æ¼ã‚Œã‚‹ã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹!?ã‚„OAuth 2.0 ã®è„†å¼±æ€§ (!?) â€œCovert Redirectâ€ ã¨ã¯ã«ã‚ã‚‹ã‚ˆã†ã«ã€OAuth 2.0 ã® code ãŒæ¼ã‚Œã¡ã‚ƒã†ã“ã¨ã‚‚ã€ã‚ã‚Šãˆã¾ã™ã€‚ æ¼ã‚Œãªã„ãŸã‚ã«ã‚„ã‚‹ã¹ãã“ã¨ã¯ã€ä¸Šè¨˜ã®è¨˜äº‹ã‚„Facebook Login ã§ Covert Redirect ã‚’é˜²æ¢ã™ã‚‹ãªã‚“ã‹ã§ã‚‚ç´¹ä»‹ã—ã¦ã‚‹ã®ã§ã€ãã¡ã‚‰èªã‚“ã§ãã ã•ã„ã€‚ ã§ã€ä»Šå›žã®å†…å®¹ã¯ã€Œcode ãŒæ¼ã‚ŒãŸã‚‰ä½•ãŒã¾ãšã„ã®ã‹ã€ã«ã¤ã„ã¦ã§ã™ã€‚ ã€Œcode ã¯æ¼ã‚Œã¦ã‚‚å¤§ä¸ˆå¤«ã€èª¬ ã€ŒCovert Redirectã€ã«ã¤ã„ã¦ã® John Bradley æ°ã®è§£èª¬ï¼ˆè¿½è¨˜ã‚ã‚Šï¼‰ã«ã‚‚ã€ã“ã†ã‚ã‚Šã¾ã—ãŸãã€‚ OAuth ã¨ OpenID Connect ã«ã¯è¤‡æ•°ã® response_type ãŒã‚ã‚‹ã‚“ã ã‘ã©ã€ã•ãã®ãƒªãƒãƒ¼ãƒˆã®è‘—è€…ã¯ã€æœ€ã‚‚ä¸€èˆ¬çš„ãª response_type ãŒ
hiroponz 2016/04/21
security

OAuth
ãƒªãƒ³ã‚¯
Run bundler-audit Regularly on Your Rails Apps with Rake
Rails developers responsible for maintaining production apps will regularly run bundler-audit to alert them to known vulnerabilities in the Ruby gems their apps depend on. Thank you to postmodern for creating and maintaining this vital tool for the Ruby community. bundler-audit is a command line tool with a database of known gem vulnerabilities. It can update its database with the latest vulnerabi
hiroponz 2016/02/03
Gemfile.lockã‚’ãƒã‚§ãƒƒã‚¯ã—ã¦ãƒ‘ãƒƒãƒãƒ¬ãƒ™ãƒ«ã®è„†å¼±æ€§ã‚’ãƒ¬ãƒãƒ¼ãƒˆã—ã¦ãã‚Œã‚‹gem

rails

security
ãƒªãƒ³ã‚¯
ãƒãƒƒã‚·ãƒ¥è¡çªã§TLSã‚’ç ´ã‚‹SLOTHæ”»æ’ƒ(CVE-2015-7575)ã¨ã¯ä½•ã‹ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. ç°¡å˜ãªSLOTHæ”»æ’ƒã®ã¾ã¨ã‚ æœ€åˆã«ç°¡å˜ãªã¾ã¨ã‚ã‚’æ›¸ã„ã¦ãŠãã¾ã™ã€‚é•·æ–‡ã«ãªã‚Šãã†ãªã®ã§ã€èªã‚€ã®ãŒå¤§å¤‰ãªæ–¹ã¯ã“ã“ã ã‘è¦‹ã¦ãŠã„ã¦ãã ã•ã„ã€‚ MD5ãƒãƒƒã‚·ãƒ¥ã¯æ—¢ã«å®‰å…¨ã§ã¯ãªãã€è¨¼æ˜Žæ›¸ã®ç½²åæ–¹å¼ã§ã®åˆ©ç”¨ã¯åœæ¢ã•ã‚Œã¦ã„ãŸãŒã€å¾Œæ–¹äº’æ›ã®ãŸã‚ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ãƒ‡ãƒ¼ã‚¿ã®ç½²åæ–¹å¼ã«RSA-MD5ãŒä»Šã§ã‚‚åˆ©ç”¨ã§ãã‚‹TLSå®Ÿè£…ãŒå¹¾ã¤ã‹å˜åœ¨ã—ã¦ã„ãŸ(Firefox NSS, Javaç‰)ã€‚ å…ˆé€±ã€INRIAã‚°ãƒ«ãƒ¼ãƒ—ã‹ã‚‰ãƒãƒƒã‚·ãƒ¥è¡çªã‚’åˆ©ç”¨ã—ã¦å®Ÿéš›ã«TLSã‚’ç ´ã‚‹æ”»æ’ƒ(SLOTH)ãŒå…¬é–‹ã•ã‚ŒãŸã€‚ãã‚Œã‚’å—ã‘ã€ã„ãã¤ã‹ã®å®Ÿè£…ã§RSA-MD5ã‚’å®Œå…¨ã«åˆ©ç”¨ä¸èƒ½ã«ã™ã‚‹ä¿®æ£ãŒè¡Œã‚ã‚ŒãŸ(CVE-2015-7575)ã€‚ SLOTHã§ã¯ã€SHA1ã‚„TLSã€IKEã€SSHã«å¯¾ã™ã‚‹æ”»æ’ƒã«ã¤ã„ã¦ã‚‚è©•ä¾¡ã‚’è¡Œã„ã€å¹¾ã¤ã‹ã¯å…¨ãç¾å®Ÿçš„ã«ä¸å¯èƒ½ãªãƒ¬ãƒ™ãƒ«ã§ã¯ãªã„ã“ã¨ãŒç¤ºã•ã‚ŒãŸã€‚MD5ã¨SHA-1ã§TLSãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã®å®Œå…¨æ€§ã‚’æ‹…ä¿ã—ã¦ã„ã‚‹TLS1.0/
hiroponz 2016/01/13
security
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)ã¨ãã®å¯¾ç–
æœ¬è³‡æ–™ã¯ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹è„†å¼±æ€§ã®ã²ã¨ã¤ã€CSRF (ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª) ã®ä»•çµ„ã¿ã¨ãã®å¯¾ç–ã«é–¢ã™ã‚‹èª¬æ˜Žè³‡æ–™ã§ã™ã€‚ ã¾ãŸã€CSRF å¯¾ç–ã®ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ã„ãã¤ã‹ã«ã¤ã„ã¦ã€ãã®æ¦‚è¦ã¨é©ç”¨ä¾‹ã‚‚ç´¹ä»‹ã—ã¦ã„ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã®æ–¹ã€…ãŒã€CSRF è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç†è§£ã‚’æ·±ã‚ã€ã‚ˆã‚Šã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®é–‹ç™ºã®ä¸€åŠ©ã¨ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ è‡ªç¿’ç”¨ã®è³‡æ–™ã‚„å‹‰å¼·ä¼šã§ã®è³‡æ–™ã¨ã—ã¦ã”æ´»ç”¨ãã ã•ã„ã€‚ 2015 å…¬é–‹æ—¥ ã‚¿ã‚¤ãƒˆãƒ« PDF
hiroponz 2015/10/07
å¾Œã§èªã‚€

security
ãƒªãƒ³ã‚¯
AWS ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£è³‡æ–™ï¼ˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸‰éƒ¨ä½œï¼‰ã‚’èªã‚“ã - ã‚ˆã†ã¸ã„ã®æ—¥ã€…ç²¾é€²XP
è‡ªåˆ†ãƒ¡ãƒ¢ã€‚ è¿½è¨˜ aws.typepad.com DDoS ã«é–¢ã™ã‚‹ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚‚æ—¥æœ¬èªžè¨³ã•ã‚Œã¦å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã€‚å¾Œã»ã©èªã¿ã¾ã›ã†ã€‚ tl;dl ã“ã¡ã‚‰ã«ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹è³‡æ–™ã‚’ãƒ€ã‚¦ãƒãƒ¼ãƒ‰ã—ã¦èªã‚“ã§ã¿ãŸã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ—ãƒã‚»ã‚¹ã®æ¦‚è¦ AWS ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã‚³ãƒ³ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ AWSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ å†…å®¹ã‚’ã¡ã‚ƒã‚“ã¨æŠŠæ¡ã¯å‡ºæ¥ã¦ã„ãªã„ãŒã€ä»¥ä¸‹ã«é›‘ã«ãƒ¡ãƒ¢ã‚‹ã€‚ æ„Ÿæƒ³ç‰ èªã‚“ã§ã¿ã¦ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ—ãƒã‚»ã‚¹ã®æ¦‚è¦ ã¯ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ï¼ˆå…¨ 27 ãƒšãƒ¼ã‚¸ï¼‰ã§ã»ã¼æ–‡å—ã ã£ãŸãŒã€å„ AWS ãƒªã‚½ãƒ¼ã‚¹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®Ÿè£…ã«ã¤ã„ã¦è§¦ã‚Œã‚‰ã‚Œã¦ã„ãŸ AWS ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã‚³ãƒ³ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ã¨ AWSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã«ã¤ã„ã¦ã¯ä¸Šè¨˜ã®ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚’ã‚ã‹ã‚Šã‚„ã™ãè§£èª¬ã™ã‚‹ã‚ˆã†ãªæ§‹æˆã«ãªã£ã¦ã„ãŸ ãƒ”ãƒƒã‚¯ã‚¢ãƒƒãƒ—ã‚ãƒ¼ãƒ¯ãƒ¼ãƒ‰ è²¬ä»»åˆ†æ‹…ãƒ¢ãƒ‡ãƒ«ï¼ˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…±æœ‰ãƒ¢ãƒ‡ãƒ«ï¼‰â†’ AWS ã¯ã‚¤ãƒ³ãƒ•ãƒ©éƒ¨åˆ†ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«è²¬ä»»ã‚’æŒã¤ ã‚»ã‚ãƒ¥ãƒª
hiroponz 2015/09/01
aws

security

document
ãƒªãƒ³ã‚¯
1 2 3 4 5 æ¬¡ã®ãƒšãƒ¼ã‚¸