[B! ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] hisasannã®ãƒ

hisasann id:hisasann

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹hisasannã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (220)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

VALUE-DOMAIN ã«å˜åœ¨ã—ã¦ã„ãŸ2ç¨®é¡žã®ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯è„†å¼±æ€§ã«ã¤ã„ã¦ - debiruã¯ã¦ãªãƒ¡ãƒ¢
2022å¹´3æœˆ2æ—¥ã«ç¢ºèªã—ãŸ VALUE-DOMAIN ã§ã®ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ãŒå¯èƒ½ãªè„†å¼±æ€§ã«ã¤ã„ã¦çµŒç·¯ã‚’èª¬æ˜Žã—ã¾ã™ã€‚ ã¤ã„ã§ã«2016å¹´ã®è¨˜äº‹ã€ŒVALUE-DOMAIN ã«å˜åœ¨ã—ã¦ã„ãŸã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¹—ã£å–ã‚Šå¯èƒ½ãª CSRF è„†å¼±æ€§ã«ã¤ã„ã¦ã€ã®ç¶šå ±ã‚‚å«ã‚ã¦ã€ã“ã®è¨˜äº‹ã§2022å¹´ç¾åœ¨ã® VALUE-DOMAIN ã®çŠ¶æ³ã«ã¤ã„ã¦ãŠä¼ãˆã—ã¾ã™ã€‚ è„†å¼±æ€§ã‚’2ã¤ç™ºè¦‹ã—ã¾ã—ãŸ ç¬¬ä¸€ï¼šåã‚¾ãƒ¼ãƒ³ä½œæˆã«ã‚ˆã‚‹ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ç¬¬ä¸€ã®è„†å¼±æ€§ã®æ”»æ’ƒã®åŽŸç† VALUE-DOMAIN ã®ãƒãƒ¼ãƒ ã‚µãƒ¼ãƒã«ã¤ã„ã¦ ç¬¬ä¸€ã®è„†å¼±æ€§ ç™ºè¦‹å¾Œã®çµŒç·¯ ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯æ”»æ’ƒã‚’å—ã‘ãŸå ´åˆã®å½±éŸ¿ ç¬¬äºŒï¼šCSRF æ”»æ’ƒã«ã‚ˆã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯æ”»æ’ƒã‚’å—ã‘ãŸå ´åˆã®å½±éŸ¿ CSRF æ”»æ’ƒã«ã‚ˆã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã®å¯¾ç–çŠ¶æ³ VALUE-DOMAIN ãƒ¦ãƒ¼ã‚¶ã®æ–¹ã¸ è„†å¼±æ€§ã‚’2ã¤ç™ºè¦‹ã—ã¾ã—ãŸ ï¼ˆç¬¬ä¸€ï¼‰åã‚¾ãƒ¼ãƒ³ä½œ
hisasann 2022/04/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
NoSQL Injection
hisasann 2020/08/03
MongoDB

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï½œSmartHRï½œã‚·ã‚§ã‚¢No.1ã®ã‚¯ãƒ©ã‚¦ãƒ‰äººäº‹åŠ´å‹™ã‚½ãƒ•ãƒˆ
å®‰å¿ƒå®‰å…¨ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ãŸã‚ã«ã¯ã€çµ„ç¹”çš„å¯¾ç–ãŒæ¬ ã‹ã›ã¾ã›ã‚“ã€‚SmartHRã§ã¯ã€ç¬¬ä¸‰è€…æ©Ÿé–¢ã«ã‚ˆã‚‹ç›£æŸ»ã‚’ã¯ã˜ã‚ã€å¾“æ¥å“¡ã‚„å§”è¨—å…ˆãŒå®ˆã‚‹ã¹ããƒ«ãƒ¼ãƒ«ã®ç–å®šã€æƒ…å ±æ¼ãˆã„ãƒªã‚¹ã‚¯ã‚’ä½Žæ¸›ã™ã‚‹ã‚ªãƒ•ã‚£ã‚¹ç’°å¢ƒã¥ãã‚Šãªã©ã®å¯¾ç–ã«ã€çµ„ç¹”å…¨ä½“ã§å–ã‚Šçµ„ã‚“ã§ã„ã¾ã™ã€‚ ISO/IEC27001ã®å–å¾— SmartHRã¯ã€æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚·ã‚¹ãƒ†ãƒ ã®å›½éš›æ¨™æº–è¦æ ¼ã€ŒISO/IEC27001ã€ã®èªè¨¼ã‚’2016å¹´3æœˆ22æ—¥ã«å–å¾—ã—ã¦ã„ã¾ã™ã€‚ã•ã‚‰ã«ã€å®šæœŸçš„ã«é–‹å‚¬ã•ã‚Œã‚‹å–ç· å½¹ä¼šãŠã‚ˆã³ISMSãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆãƒ¬ãƒ“ãƒ¥ãƒ¼ã«ã‚ˆã£ã¦ã€å†…éƒ¨çµ±åˆ¶ã®æ•´å‚™ã¨ç›£ç£ã‚’å¾¹åº•ã€‚æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®3è¦ç´ ã§ã‚ã‚‹æ©Ÿå¯†æ€§ãƒ»å®Œå…¨æ€§ãƒ»å¯ç”¨æ€§ã®ç¶æŒã¨æ”¹å–„ã«ã€æ—¥ã€…å–ã‚Šçµ„ã‚“ã§ã„ã¾ã™ã€‚ SOC2 Type2ä¿è¨¼å ±å‘Šæ›¸ã®å—é ˜ ã€ŒSOC2 Type2ä¿è¨¼å ±å‘Šæ›¸ã€ã¯ã€ç±³å›½å…¬èªä¼šè¨ˆå£«å”ä¼š ï¼ˆAICPAï¼‰ãŒå®šã‚ãŸã€ŒTrustã‚µãƒ¼ãƒ“ã‚¹åŽŸå‰‡ã¨è¦æº–ã€ã«æº–æ‹ ã—ã¦ãŠã‚Šã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã«é–¢ã‚
hisasann 2020/05/11
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï½œã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã«ã¤ã„ã¦ã€€cybozu.com
ãŠå®¢æ§˜ã«å®‰å¿ƒã—ã¦ä½¿ã£ã¦ã„ãŸã ããŸã‚ã«ãŠå®¢æ§˜ã®ãƒãƒªã‚·ãƒ¼ã«å¿œã˜ã¦è¨å®šã§ãã‚‹ã‚ˆã†ã€ã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã§ã¯ã€ã•ã¾ã–ã¾ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹æ©Ÿèƒ½ã‚’æä¾›ã—ã¦ã„ã¾ã™ã€‚
hisasann 2020/05/11
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
èª¿ã¹ã¦ã¿ãŸã€ŒDouble Submit Cookieã€ã¨ã¯ï¼Ÿ - ã‚¢ãƒ«ãƒ‘ã‚«ãƒã‚°
ã€ŒDouble Submit Cookieã€ã¯OWASPãŒæå”±ã™ã‚‹CSRFå¯¾ç–ã®1ã¤ã§ã™ã€‚ ã—ã‹ã—ã€Œå®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ã€ã®è‘—è€…ã§ã‚ã‚‹å¾³ä¸¸ã•ã‚“ã¯ã€ãƒ–ãƒã‚°ã§æ¬¡ã®ã‚ˆã†ã«æŒ‡æ‘˜ã—ã¦ã„ã¾ã™ã€‚ Double Submit Cookieã¯ã€ã‚µãƒ¼ãƒãƒ¼å´ã§çŠ¶æ…‹ã‚’ä¿æŒã™ã‚‹å¿…è¦ãŒç„¡ã„ãŸã‚ã€RESTã¨ã®ç›¸æ€§ãŒè‰¯ã„ã¨ã„ã†ã®ã‚‚æœ€è¿‘å¥½ã¾ã‚Œã‚‹ç†ç”±ã‹ã¨æ€ã„ã¾ã™ãŒã€å¤–éƒ¨ã‹ã‚‰ã‚¯ãƒƒã‚ãƒ¼ã‚’å¤‰æ›´ã•ã‚Œãªã„ã“ã¨ã‚’å‰æã—ã¦ã„ã‚‹ã¨ã“ã‚ãŒå¾®å¦™ãªã¨ã“ã‚ã§ã™ã€‚ IEã®ã‚¯ãƒƒã‚ãƒ¼ãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼ãƒã‚°ã¯Windows 10ã§è§£æ¶ˆã•ã‚Œã¦ã„ãŸ | å¾³ä¸¸æµ©ã®æ—¥è¨˜ ã‚µãƒ¼ãƒãƒ¼ãƒ¬ã‚¹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®CSRFå¯¾ç–ã§Double Submit Cookieã‚’æ¤œè¨Žã•ã‚Œã¦ã„ã‚‹äººï¼ˆç§ã‚‚ãã†ï¼‰ã«ã¯æ®‹å¿µã§ã™ãŒã€ä»–ã®æ–¹æ³•ã‚’è€ƒãˆãŸæ–¹ãŒè‰¯ã•ãã†ã§ã™ã€‚ OWASPã®Double Submit Cookieã®é …ã‚’ç¿»è¨³ã—ãŸã‚‚ã®ã‚’è¼‰ã›ã¦ãŠãã¾ã™ã€‚ ç¿»è¨³ If storing the
hisasann 2019/01/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Introducing Content Security Policy - MDC Doc Center
HTTP ã‚¬ã‚¤ãƒ‰ HTTP ã®æ¦‚è¦ å…¸åž‹çš„ãª HTTP ã‚»ãƒƒã‚·ãƒ§ãƒ³ HTTP ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ MIME ã‚¿ã‚¤ãƒ—ï¼ˆIANA ãƒ¡ãƒ‡ã‚£ã‚¢ç¨®åˆ¥ï¼‰ HTTP ã®åœ§ç¸® HTTP ã‚ãƒ£ãƒƒã‚·ãƒ¥ HTTP èªè¨¼ HTTP Cookie ã®ä½¿ç”¨ HTTP ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆ HTTP æ¡ä»¶ä»˜ããƒªã‚¯ã‚¨ã‚¹ãƒˆ HTTP ç¯„å›²ãƒªã‚¯ã‚¨ã‚¹ãƒˆ ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ HTTP/1.x ã®ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ç®¡ç† HTTP ã®é€²åŒ– ãƒ—ãƒãƒˆã‚³ãƒ«ã®ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰ã®ä»•çµ„ã¿ ãƒ—ãƒã‚ã‚·ã‚µãƒ¼ãƒãƒ¼ã¨ãƒˆãƒ³ãƒãƒªãƒ³ã‚° HTTP ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ’ãƒ³ãƒˆ HTTP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚µã‚¤ãƒˆã®å®‰å…¨åŒ– HTTP Observatory Permissions Policy ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ (CSP) ã‚ªãƒªã‚¸ãƒ³é–“ãƒªã‚½ãƒ¼ã‚¹å…±æœ‰ (CORS) Cross-Origin Resource Policy (CORP) Strict-Transport-Securit
hisasann 2019/01/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
2018/07/12 ã«ç™ºç”Ÿã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆ ([email protected]) ã«ã¤ã„ã¦ - Qiita
2018 å¹´ 7 æœˆ 12 æ—¥ã«ã€ESLint é–‹ç™ºãƒãƒ¼ãƒ ãŒç®¡ç†ã™ã‚‹ npm ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ãŒæŒ¿å…¥ã•ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆãŒã‚ã‚Šã¾ã—ãŸã€‚ ESLint ã‹ã‚‰ã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes npm ã‹ã‚‰ã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹: https://status.npmjs.org/incidents/dn7c1fgrr7ng ä»¥ä¸‹ã®å ´åˆã« npm install ã‚’å®Ÿè¡Œã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã® npm ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¸ã®ãƒã‚°ã‚¤ãƒ³æƒ…å ± (ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³) ãŒç›—ã¾ã‚ŒãŸæã‚ŒãŒã‚ã‚Šã¾ã™ (ç›—ã¾ã‚ŒãŸã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã¯ã™ã§ã«ç„¡åŠ¹åŒ–ã•ã‚Œã¦ã„ã¾ã™)ã€‚ æ—¥æœ¬æ™‚é–“ã® 18:49 ã‹ã‚‰ 19:25 ã®ç´„ 1 æ™‚é–“ã®ã‚ã„ã ã« npm install ã‚’å®Ÿè¡Œã—ã€eslint-config-e
hisasann 2018/07/13
ESLint

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
XSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼ã®ä½¿ã„æ–¹/ Shibuya.XSS techtalk #9
2017/3/30 ã«è¡Œã‚ã‚ŒãŸ Shibuya.XSS techtalk #9 ã®ç™ºè¡¨è³‡æ–™ã§ã™ã€‚
hisasann 2017/04/17
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Cross-Site Request Forgery is dead!
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution. No technical burden on the site owner, no difficult implementation, it's trivially simple to deploy, it's Same-Site Cookies. As old as the Web its
hisasann 2017/02/27
CSRF

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
SHAttered
Physical Address 304 North Cardinal St. Dorchester Center, MA 02124
hisasann 2017/02/24
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
node ã® security checkã‚’ã™ã‚‹ãªã‚‰ nsp ãŒä¾¿åˆ© - from scratch
nspã¨ã¯ å…ˆæ—¥ãŸã¾ãŸã¾ä¼šç¤¾ã§ Vulnerability ã®è©±ã«ãªã£ã¦è‰²ã€…ã¨ Node.js ã ã¨ã“ã†ã„ã†ã®ã‚ã‚‹ã‚“ã§ã™ã‚ˆã£ã¦è¨€ã£ãŸã‚‰çŸ¥ã‚‰ãªã‹ã£ãŸæ–¹ã‚‚å¤šã‹ã£ãŸã®ã§ç´¹ä»‹ã€‚ nsp ã¯ node security platform ã®é æ–‡å—ã‚’å–ã£ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã‚ã‚‹ã€‚ Node Security Platform ã¯ã‚µã‚¤ãƒˆä¸Šã§è„†å¼±æ€§ã‚’å…¬é–‹ã—ã¦ã„ã‚‹ã€‚ Node.js ã®ã‚³ã‚¢ã®è„†å¼±æ€§ã¨ã„ã†ã‚ˆã‚Šã‚‚ npm ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãªã©ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®è„†å¼±æ€§ã ã€‚ nsp ã«æŒ™ã’ã‚‰ã‚Œã¦ã‚‹è„†å¼±æ€§ã®ä¸€ä¾‹ ä¾‹ãˆã°ã“ã®è„†å¼±æ€§ãªã‚“ã‹ã¯2017å¹´2æœˆ11æ—¥ã«å…¬é–‹ã•ã‚ŒãŸè„†å¼±æ€§ã§ã‚ã‚‹ã€‚ https://nodesecurity.io/advisories/313 github.com ã©ã†ã„ã†è„†å¼±æ€§ã‹ã¨ã„ã†ã¨ã€ã“ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¯JavaScript Objectã‚’ã‚·ãƒªã‚¢ãƒ©ã‚¤ã‚ºã™ã‚‹ãŸã‚ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã ãŒã€ãã®serializeã™ã‚‹æ™‚ã«é–¢æ•°ã¾
hisasann 2017/02/16
node.js

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
https://nodesecurity.io/advisories/120
hisasann 2017/02/16
node.js

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å®Ÿä¾‹ã«å¦ã¶XSSè„†å¼±æ€§ã®ç™ºè¦‹ã¨ä¿®æ£æ–¹æ³•/line_dm 16 20160916 how to find and fix xss
LINE Developer Meetup in Fukuoka #16 http://connpass.com/event/38413/
hisasann 2016/10/07
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Web Storage: ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒˆãƒ¼ã‚¯ãƒ³ã®ãƒžã‚·ãªæ‰‹æ®µ â€• cookieã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¢ã‚’æ¯”è¼ƒã—ã¦ã¿ã‚‹ | POSTD
æœ€è¿‘ã€ç§ã¯ã€Œã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ã€cookieã®ä»£ã‚ã‚Šã« Web Storage (sessionStorage/localStorage)ã«ä¿å˜ã™ã‚‹ã®ã¯å®‰å…¨ã§ã™ã‹ï¼Ÿã€ã¨ã„ã†ã“ã¨ã‚’å°‹ãã‚‰ã‚Œã¾ã—ãŸã€‚ã“ã®ã“ã¨ã«ã¤ã„ã¦Googleã§æ¤œç´¢ã—ãŸã¨ã“ã‚ã€æ¤œç´¢çµæžœã®ä¸Šä½ã®ã»ã¨ã‚“ã©ãŒã€ŒWeb storageã¯cookieã«æ¯”ã¹ã¦ã‹ãªã‚Šã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒå¼±ãã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒˆãƒ¼ã‚¯ãƒ³ã«ã¯ä¸å‘ãã§ã‚ã‚‹ã€ã¨æ–è¨€ã—ã¦ã„ã¾ã—ãŸã€‚é€æ˜Žæ€§ã®ãŸã‚ã€ç§ã¯ã“ã®é€†ã®çµè«–ã«è‡³ã£ãŸç†è«–çš„æ ¹æ‹ ã‚’å…¬ã«æ›¸ãã“ã¨ã«ã—ã¾ã—ãŸã€‚ Web Storageã«é–¢ã™ã‚‹è°è«–ã®ä¸æ ¸ã¨ã—ã¦è¨€ã‚ã‚Œã‚‹ã®ã¯ã€ã€ŒWeb Storageã¯secureãƒ•ãƒ©ã‚°ã‚„HttpOnlyãƒ•ãƒ©ã‚°ã¨ã„ã£ãŸcookieç‰¹æœ‰ã®æ©Ÿèƒ½ã‚’ã‚µãƒãƒ¼ãƒˆã—ã¦ã„ãªã„ãŸã‚ã€æ”»æ’ƒè€…ãŒå®¹æ˜“ã«ç›—ã¿å–ã‚‹ã“ã¨ãŒå¯èƒ½ã€ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚pathå±žæ€§ã«ã¤ã„ã¦ã‚‚è¨€åŠã•ã‚Œã¾ã™ã€‚ç§ã¯ã€ã“ã‚Œã‚‰ã®æ©Ÿèƒ½ãã‚Œãžã‚Œã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ãã—ã¦ã€
hisasann 2016/06/30
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ã®ã¯ã›ãŒã‚ã•ã‚“ãŒ MS ãƒ–ãƒ©ã‚¦ã‚¶ Edge ã«ã¤ã„ã¦ã€Œlocation.href="calculator:"; ã§Edgeã‹ã‚‰é›»å“ãŸã¡ã‚ãŒã‚‹ã€ã‚’ç™ºè¦‹
ã€Œlocation.href="calculator:"; ã§Edgeã‹ã‚‰é›»å“ãŸã¡ã‚ãŒã‚‹ã€ã®ã¯ã€è‰²ã€…ä½¿ãˆãã†ãªã®ã§å‚™å¿˜éŒ²çš„ã«
hisasann 2015/08/28
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
äº”å³¶å¤•å¤ãŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒ—ãƒ å¾³ä¸¸æµ©å…ˆç”Ÿã«ä¸€æ—¥å¯†ç€ï¼ä»Šã™ãä½¿ãˆã‚‹ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚’ç›—ã‚“ã§ãã¾ã—ãŸ | NO MORE æƒ…å ±æ¼ãˆã„
ã“ã‚“ã«ã¡ã¯ã€äº”å³¶å¤•å¤ã§ã™ï¼ æ™®æ®µã¯ãƒ•ãƒªãƒ¼ãƒ©ãƒ³ã‚¹ã¨ã—ã¦ã‚¤ãƒ©ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¿ãƒ¼ã‚„ãƒ¢ãƒ‡ãƒ«ã®ãŠä»•äº‹ã‚’ã—ã¦ã„ã‚‹ç§ã§ã™ãŒã€ä»Šæ—¥ã¯NO MORE æƒ…å ±æ¼ãˆã„ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®ä¸€å“¡ã¨ã—ã¦ã€ä¸€æ—¥ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ã‚¢ãƒ¼ã«æŒ‘æˆ¦ã—ã¾ã™ï¼ çªç„¶ã§ã™ãŒçš†ã•ã‚“ã¯ã€æ¯Žæ—¥ã®ç”Ÿæ´»ã®ä¸ã§ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã«ã¤ã„ã¦ã©ã‚Œãã‚‰ã„æ°—ã‚’ã¤ã‘ã¦ã„ã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã‹ï¼Ÿ ç§ã‚‚Twitterã‚„Facebookã‚’ã‚ˆãåˆ©ç”¨ã—ã¾ã™ã—ã€ãŠä»•äº‹ã‚‚ãƒ¡ãƒ¼ãƒ«ã§å—ã‘ã¦ã„ã¾ã™ã€‚PCã‚’ä½¿ã†æ©Ÿä¼šã‚‚å¤šã„ã®ã§æƒ…å ±ã®ç®¡ç†ã«ã¯æ°—ã‚’ã¤ã‘ãªãã‚ƒã¨æ€ã£ã¦ã„ã‚‹ã®ã§ã™ãŒã€ã€Œå…·ä½“çš„ã«ä½•ã‚’ã©ã†æ°—ã‚’ã¤ã‘ã‚Œã°ã„ã„ã®ã‹ã‚ã‹ã‚‰ãªã„ï¼ã€ã¨ã„ã†äººã¯ç§ã ã‘ã§ã¯ãªã„ã¯ãšã§ã™ã€‚ ã¨ã„ã†ã“ã¨ã§ä»Šå›žã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«ã¨å‘¼ã°ã‚Œã‚‹å¾³ä¸¸ æµ©ï¼ˆã¨ãã¾ã‚‹ ã²ã‚ã—ï¼‰å…ˆç”Ÿã«å¯†ç€å–æï¼ ãƒ—ãƒãŒã©ã‚“ãªã¨ã“ã‚ã«æ°—ã‚’ã¤ã‘ã¦ã„ã‚‹ã®ã‹ã€ç§ãŸã¡ã®ç”Ÿæ´»ã«ã‚‚æ´»ã‹ã›ãã†ãªãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚’ç›—ã‚“ã§ããŸã„ã¨æ€ã„ã¾ã™ï¼ å¾³ä¸¸ æµ©ï¼ˆã¨ãã¾ã‚‹ ã²ã‚ã—ï¼‰å…ˆç”Ÿ HA
hisasann 2015/07/27
ã“ã®åã‹ã‚ã„ã„ãªãƒ¼

ã‹ã‚ã„ã„

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: connection.swf + XSS ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚ªãƒªã‚¸ãƒ³ã®æƒ…å ±å¥ªå–
Flashã‚’ä½¿ã£ãŸã€ã¡ã‚‡ã£ã¨å¤‰ã‚ã£ãŸæƒ…å ±å¥ªå–æ‰‹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ã“ã®æ‰‹æ³•ã€ä»¥å‰ã‹ã‚‰æ¡ä»¶ã«ã‚ˆã£ã¦ã¯æ”»æ’ƒãŒå¯èƒ½ã«ãªã‚‹å ´åˆãŒã‚ã‚‹ã ã‚ã†ã¨æƒ³åƒã—ã¦ã„ãŸã‚“ã§ã™ãŒã€ãªã‹ãªã‹å®Ÿä¾‹ã«ã¶ã¤ã‹ã‚‰ãšã€2013å¹´ã«é–‹å‚¬ã•ã‚ŒãŸã‚µã‚¤ãƒœã‚¦ã‚ºã®è„†å¼±æ€§ç™ºè¦‹ã‚³ãƒ³ãƒ†ã‚¹ãƒˆã€Œcybozu.com Security Challengeã€ã§åˆã‚ã¦æœ¬å½“ã«å‹•ä½œã™ã‚‹ã‚‚ã®ã‚’ç™ºè¦‹ã—ã¾ã—ãŸã€‚ å®Ÿã¯æ—¢ã«ã€ŒSECCON 2013 å…¨å›½å¤§ä¼šã€ã§ã‚‚ä¸€éƒ¨è©³ç´°ã‚’ç™ºè¡¨ã—ã¦ã„ã¾ã™ã€‚ã‚¹ãƒ©ã‚¤ãƒ‰ã®15ãƒšãƒ¼ã‚¸ã®è¾ºã‚Šã‹ã‚‰æ›¸ã„ã¦ã‚ã‚‹ä»¶ã§ã™ã€‚ http://www.slideshare.net/masatokinugawa/cybozu-security-challenge/15 ç™ºè¡¨ã®æ™‚ç‚¹ã§ã¯ã‚µã‚¤ãƒœã‚¦ã‚ºå´ã§ä¿®æ£ã•ã‚Œã¦ã„ãªã‹ã£ãŸã®ã§ã€å…·ä½“çš„ãªç®‡æ‰€ã‚’ä¼ã›ã¦ã„ã¾ã™ãŒã€ä»Šã¯ä¿®æ£ã•ã‚ŒãŸã®ã§ã€å…·ä½“çš„ãªç®‡æ‰€ã‚’ã‚ã’ãªãŒã‚‰èª¬æ˜Žã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ãªãŠã€ã“ã®å•é¡Œã¯Flashè‡ªä½“ã®è„†å¼±æ€§ã§ã¯ãªã„
hisasann 2015/05/07
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
è‰²ã‚“ãªXSS â€“ nootropic.me
2015/4/16(æœ¨)ï¼šãƒšãƒ¼ã‚¸ã®ä¸€ç•ªä¸‹ã«è¿½è¨˜ã‚’è¨˜è¿°ã—ã¾ã—ãŸã€‚ ãã®æ˜”ã€ãªã‚“ã¨ã‹ã‚ãƒ£ãƒ³ãƒ—ã¨ã„ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ã‚¤ãƒ™ãƒ³ãƒˆã«å‚åŠ ã—ãŸæ™‚ã€Œã‚¢ã‚¦ãƒˆãƒ—ãƒƒãƒˆãŒå¤§äº‹ã€ã¨è¨€ã‚ã‚ŒãŸã®ã‚’æ€ã„å‡ºã—ã¾ã—ãŸã€‚ ã§ã‚‚ã€æ™®é€šè‡ªåˆ†ã®è¦‹ã¤ã‘ãŸçŸ¥è˜ã¯å¾Œç”Ÿå¤§äº‹ã«æŠ±ãˆã¦ãŠããŸã„ã‚‚ã‚“ã ã¨æ€ã„ã¾ã™ã€‚ ãã“ã§ä»Šå›žã¯ãã†ã„ã£ãŸä½•ã‹ã—ã‚‡ãƒ¼ã‚‚ãªã„ã‚‚ã®ã‚’æ¨ã¦ã‚‹ã¹ãã€æºœã‚è¾¼ã‚“ã è‰²ã‚“ãªXSSã®PoCã‚’å°‘ã—æ›¸ãå‡ºã—ã¦ã¾ã¨ã‚ã¾ã—ãŸã€‚ ä»Šã¾ã§è‡ªåˆ†ã§è¦‹ã¤ã‘ãŸã‚‚ã®ã‚„æµ·å¤–ã®Security Researcheré”ã‹ã‚‰åŽé›†ã—ãŸã‚‚ã®ã‚‚ã‚ã‚Šã¾ã™ã€‚ ã•ã¦ã€ä»Šå›žãƒªã‚¹ãƒˆã‚¢ãƒƒãƒ—ã—ãŸPoCã®è¦‹æ–¹ã§ã™ãŒã„ãã¤ã‹ã®é …ç›®ãŒã‚ã‚Šã¾ã™ã€‚ ä¸€ç•ªä¸Šã®ã€Œæ‰‹æ³•ã€ã¯ã‚¿ã‚¤ãƒˆãƒ«ã¿ãŸã„ãªã‚‚ã®ã ã¨æ€ã£ã¦ä¸‹ã•ã„ã€‚ äºŒç•ªç›®ã®ã€ŒPoCã€ã¯ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã™ã‚‹ç‚ºã®ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚æ®†ã©ãŒã‚¢ãƒ©ãƒ¼ãƒˆãŒå‡ºã‚‹ã ã‘ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®ç‚ºå±é™ºãªã‚³ãƒ¼ãƒ‰ã¯ç„¡ã„ã¤ã‚‚ã‚Šã§ã™ãŒã”è‡ªåˆ†ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§å®Ÿè¡Œã™ã‚‹éš›ã¯è‡ªå·±è²¬ä»»ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚ãƒªãƒ³ã‚¯ã‚’ã‚¯ãƒªãƒƒ
hisasann 2015/04/14
JavaScript

VBA

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
I am mitsuruog | JWT(Json Web Token)ã‚’åˆ©ç”¨ã—ãŸWebAPIã§ã®Credentialã®å—ã‘æ¸¡ã—ã«ã¤ã„ã¦
AngularJS ã¸ã®æ”¹å®—ãŒå®Œäº†ã—ãŸã€Œmitsuruogã€ã§ã™ã€‚ AngularJS ã«é™ã‚‰ãš Single page application(ä»¥ä¸‹ã€SPA)ã‚’æ§‹ç¯‰ã—ãŸå ´åˆã€èªè¨¼(Authenticate)ã¨ãã®å¾Œã® WebAPI ã§ã®è¨¼æ˜Žæƒ…å ±(Credential)ã®å—ã‘æ¸¡ã—æ–¹æ³•ã«ã¤ã„ã¦æœ€è¿‘æ‚©ã‚“ã§ã„ã¾ã™ã€‚ èª¿ã¹ã¦ã„ãŸã‚‰ Json Web Token(ä»¥ä¸‹ã€JWT)ã‚’åˆ©ç”¨ã—ãŸæ–¹æ³•ãŒCookies vs Tokens. Getting auth right with Angular.JSã§ç´¹ä»‹ã•ã‚Œã¦ã„ã¦ã€è©¦ã—ã¦ã¿ã‚‹ã¨çµæ§‹ä½¿ãˆãã†ã§ã—ãŸã®ã§ç´¹ä»‹ã—ã¦ã¿ã¾ã™ã€‚ ç›®æ¬¡ 1.WebAPI ã§ã®è¨¼æ˜Žæƒ…å ±ã®å—ã‘æ¸¡ã—ã®é‡è¦æ€§ 2.Token ã‚’åˆ©ç”¨ã—ãŸè¨¼æ˜Žæƒ…å ±ã®å—ã‘æ¸¡ã— 3.å®Ÿç¾ã™ã‚‹ãŸã‚ã®ã‚³ã‚¢æŠ€è¡“ã€JWT(Json Web Token)ã¨ã¯ 4.Token ã‚’åˆ©ç”¨ã—ãŸå ´åˆã®èª²é¡Œãªã© ç§˜å¯†éµã®ç®¡ç† ãƒªãƒ•ãƒ¬ãƒƒ
hisasann 2015/01/23
JSON

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å°±è·é¢æŽ¥ã§ãƒ—ãƒã‚°ãƒ©ãƒ ã®è§£èªã‚’æ±‚ã‚ã‚‰ã‚ŒãŸï¼ | POSTD
é•·æ–‡ã§ã™ãŒã€ã‚ˆã‹ã£ãŸã‚‰èªã‚“ã§ãã ã•ã„ã€‚ å°±è·é¢æŽ¥ã§ãƒ—ãƒã‚°ãƒ©ãƒ ã®è§£èªã‚’æ±‚ã‚ã‚‰ã‚Œã¾ã—ãŸã€‚ãã—ã¦ã€å°±è·ãŒæ±ºã¾ã‚Šã¾ã—ãŸã€‚ çš†ã•ã‚“ã€ã“ã‚“ã«ã¡ã¯ã€‚æ–°ã—ã„ãƒ–ãƒã‚°ã‚’é–‹è¨ã—ãŸã®ã§ã€ç§ã¯ä»Šã¨ã¦ã‚‚å¼µã‚Šåˆ‡ã£ã¦ã„ã¾ã™ã€‚é€±ã«ä½•åº¦ã‹è¨˜äº‹ã‚’æŠ•ç¨¿ã™ã‚‹ã¤ã‚‚ã‚Šã§ã™ã€‚ ã‚¿ã‚¤ãƒˆãƒ«ã‚’è¦‹ã‚Œã°å¤§ä½“ã®è©±ã®å†…å®¹ã¯åˆ†ã‹ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‹ã‚‰æ›¸ãã®ã¯ã€ãƒˆãƒ«ã‚³ã®ã‚¢ãƒ³ã‚«ãƒ©ã§å—ã‘ãŸå°±è·é¢æŽ¥ã®è©±ã§ã™ã€‚ ç§ãŒå¿œå‹Ÿã—ãŸè·ã¯ã€Œã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã€ã§ã—ãŸã€‚é¢æŽ¥ä¸ã€é¢æŽ¥å®˜ãŸã¡ã¯éžå¸¸ã«å°‚é–€æ€§ãŒä½Žã„è³ªå•ã‚’ã—ã¦ãã¾ã—ãŸãŒã€åˆ†ã‹ã‚‹ã“ã¨ã‚‚ã‚ã‚Œã°åˆ†ã‹ã‚‰ãªã„ã“ã¨ã‚‚ã‚ã‚Šã¾ã—ãŸã€‚ ãã®å¾Œã€ãã®ä¼æ¥ã‹ã‚‰ãƒ¡ãƒ¼ãƒ«ãŒå±Šãã€ä¿è·ãŠã‚ˆã³æš—å·åŒ–ã•ã‚ŒãŸãƒã‚¤ãƒŠãƒªãƒ•ã‚¡ã‚¤ãƒ«ãŒæ·»ä»˜ã•ã‚Œã¦ã„ã¾ã—ãŸï¼ˆã€Œè§£èªã—ã¦ã¿ã‚ã€ã¨ã„ã†ã“ã¨ã§ã—ã‚‡ã†ï¼‰ã€‚ å¸°å®…å¾Œã«ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã™ã‚‹ã¨ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ããŸã‚ã«èžã‹ã‚ŒãŸã®ã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã ã‘ã§ã—ãŸã€‚é¢æŽ¥å®˜ãŒç§ã«èª²ã—ãŸèª²é¡Œã¯ã€ãã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æŽ¢ã™ã“ã¨ã§ã—ãŸã€‚
hisasann 2014/11/26
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸