[B! xss] kgbuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kgbu id:kgbu

xssã«é–¢ã™ã‚‹kgbuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (26)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Kazuho@Cybozu Labs: String::Filter ã£ã¦ã„ã†ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«æ›¸ã„ãŸ - ç¶š: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦
å…ˆã®ã‚¨ãƒ³ãƒˆãƒªã€Œ(Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦ã€ã®ç¶šãã€‚ å¼¾ã•ã‚“ãŒã€Œ404 Blog Not Found:DHTML - æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã¯æ§‹é€ åŒ–ã™ã‚‹ã®ãŒã‚„ã£ã±æ£ã—ã„ã€ã§ç¤ºã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ãª DOM ãƒ™ãƒ¼ã‚¹ã®æ“ä½œã‚’è¡Œãˆã°ã€åŽŸç†çš„ã« XSS è„†å¼±æ€§ã‚’é˜²ãã“ã¨ãŒã§ãã¾ã™ã€‚ãŸã ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ JavaScript ã«ã‚ˆã‚‹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã¯ã‚¦ã‚§ãƒ–ã®æ§‹é€ ã‚’ç ´å£Šã™ã‚‹ã¨ã„ã†ç‚¹ã§ç‹ãŒæ‚ªã„ï¼ˆãƒ†ãƒ¼ãƒ–ãƒ«ã¨ FONT ã‚¿ã‚°ã‚’åˆ©ç”¨ã—ãŸãƒšãƒ¼ã‚¸ãƒ¬ã‚¤ã‚¢ã‚¦ãƒˆãŒæ‰¹åˆ¤ã•ã‚Œã¦ã„ãŸé ƒã‚’è¦šãˆã¦ã„ã‚‰ã£ã—ã‚ƒã„ã¾ã™ã§ã—ã‚‡ã†ã‹ã€‚JavaScript ã«ã‚ˆã‚‹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã¯ã‚¦ã‚§ãƒ–ã®ãƒªãƒ³ã‚¯æ§‹é€ ã‚‚ç ´å£Šã™ã‚‹ã®ã§ä¸€å±¤ãŸã¡ãŒæ‚ªã„ã¨ã„ã†ã®ãŒè‡ªåˆ†ã®è€ƒãˆï¼‰ã§ã™ã—ã€ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã§ã® DOM æ“ä½œã¯é‡ãŸã„ã®ã§ã€ã§ãã‚Œã°é¿ã‘ãŸã„ã¨ã“ã‚ã§ã™ã€‚ æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã® HTML ã¸ã®å¤‰æ›ã¯ã€ã‚ˆã»ã©è¤‡é›‘ãªè¨˜æ³•ã§ãªã„é™ã‚Š
kgbu 2010/09/26
å¤‰æ›ã¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®ç‹é–“ã€‚ã‚ã¨ã§è€ƒãˆã¦ã¿ã‚‹ã€‚

ã‚ã¨ã§èªã‚€

programming

xss

perl

template

ãƒã‚¿
ãƒªãƒ³ã‚¯
Cross Site Scripting Prevention - OWASP Cheat Sheet Series
Introduction Index Alphabetical Index ASVS Index MASVS Index Proactive Controls Index Top 10 Cheatsheets Cross Site Scripting Prevention Cheat SheetÂ¶ IntroductionÂ¶ This cheat sheet helps developers prevent XSS vulnerabilities. Cross-Site Scripting (XSS) is a misnomer. Originally this term was derived from early versions of the attack that were primarily focused on stealing data cross-site. Since t
kgbu 2010/02/23
xss

security

knowhow

ã¾ã¨ã‚

ã‚ã¨ã§èªã‚€

webã‚µãƒ¼ãƒ“ã‚¹

Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³

sanitizing
ãƒªãƒ³ã‚¯
Exploiting Unicode-enabled software
IUC 33 October 2009 Chris Weber chris@casabasecurity.com Casaba Security Unicode Transf ormations And Security Vulnerabilities IUC 33- October 2009 Â© 2009 Chris Weber â€¢ Visual spoofing â€¢ Text transf ormation attacks www.casabasecurity.com Whatâ€™s this about? IUC 33- October 2009 Â© 2009 Chris Weber â€¢ Why you should care about Visual Integrityâ€¦ â€“ Branding â€“ Identity â€“ Cloud Computing www.casabasecurit
kgbu 2009/10/30
ãƒ‰ãƒ¡ã‚¤ãƒ³åã‚’è¡¨ç¤ºã™ã‚‹éš›ã®Unicodeæ£è¦åŒ–å•é¡Œã®è³‡æ–™ã€‚ãƒ‰ãƒ¡ã‚¤ãƒ³åã ã‘ã§ãªãX.509è¨¼æ˜Žæ›¸ã«ã‚‚ã‚ã¦ã¯ã¾ã‚‹ãã†ã ã€‚

ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°

security

presentation

unicode

ã‚ã¨ã§èªã‚€

ã¾ã¨ã‚

webã‚µãƒ¼ãƒ“ã‚¹

xss

test

tool
ãƒªãƒ³ã‚¯
Dealing with broken utf-8 with Ruby
kgbu 2009/09/19
Ruby

xss

bad knowhow

security hole

programming

knowhow

utf

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
I8jesus.com is for sale | HugeDomains
Working with hugedomains.com was a quick and easy process. We got to speak to multiple real people located in Colorado without having to wait on hold! Our only complaint was we felt we had to overpay more than this particular domain was worth, and we weren't able to negotiate it down to a level that we felt was fair. However, payment and delivery were seamless, and within a few hours we had all of
kgbu 2009/09/02
IE8ãªã©ã§portç•ªå·ãŒé•ã£ã¦ã‚‚same originã¨ã™ã‚‹ã‚ˆã†ãªå¤‰æ›´ãŒã‚ã‚‹ã¨ã€ã€ã€é€šå¸¸ã¨ã¯ç•°ãªã‚‹ãƒãƒ¼ãƒˆã§FTPã®ã‚µãƒ¼ãƒ“ã‚¹ã¨ã‹ãŒå‹•ã„ã¦ã„ã‚‹ã‚µãƒ¼ãƒã§ã¯ã€formã®POSTãƒ‡ãƒ¼ã‚¿ã«XSSã‚’ä»•è¾¼ã‚ã°cookieç‰ãŒç›—ã¾ã‚Œå¾—ã‚‹ã€‚ã¨ã„ã†è©±ã ã‚ã†ã‹ï¼Ÿ

security

security hole

http

javascript

cracking

ãƒã‚¿

xss

cookie

IE

ã‚ã¨ã§èª¿ã¹ãŸã„
ãƒªãƒ³ã‚¯
ã‚¢ãƒ³ãƒ€ãƒ¼ã‚°ãƒ©ã‚¦ãƒ³ãƒ‰ã®è‡ã„ãŒã™ã‚‹ã€ŒNine-ballã€ï¼Œã‚¢ã‚¸ã‚¢ã«å¿ã³å¯„ã‚‹å±æ©Ÿ
JSRedir-Rï¼ˆé€šç§°ï¼ŒGENOã‚¦ã‚¤ãƒ«ã‚¹ã‚„Gumblarï¼‰ã®æ¨¡å€£çŠ¯ãŒå¢—åŠ ã—ã¦ã„ã‚‹ã€‚FTPã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ç›—ç”¨ã«ã‚ˆã‚‹Webã‚³ãƒ³ãƒ†ãƒ³ãƒ„æ”¹ã–ã‚“ã«ã‚ˆã‚Šï¼Œãã®Webã‚µã‚¤ãƒˆã‚’é–²è¦§ã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‘ã‚½ã‚³ãƒ³ã«ã‚¦ã‚¤ãƒ«ã‚¹ã‚’åŸ‹ã‚è¾¼ã‚€æ‰‹å£ã§ã‚ã‚‹ã€‚ä»£è¡¨çš„ãªã‚‚ã®ã®ä¸€ã¤ã«ï¼Œ4ä¸‡ã‚µã‚¤ãƒˆä»¥ä¸Šã‚’æ”¹ã–ã‚“ã—ãŸã¨ã•ã‚Œã‚‹ã€ŒNine-ballã€ãŒã‚ã‚‹ã€‚Nine-ballã®ç‰¹å¾´ã¯ï¼ŒJSRedir-Rã®æ„ŸæŸ“ãƒ¡ã‚«ãƒ‹ã‚ºãƒ ã«éŽåŽ»ã«æµè¡Œã—ãŸã‚µã‚¤ãƒãƒ¼æ”»æ’ƒæ‰‹æ³•ã®ä»•çµ„ã¿ã‚’å–ã‚Šè¾¼ã‚“ã ã“ã¨ã ã€‚ã©ã†ã‚„ã‚‰ï¼Œæ”»æ’ƒæ‰‹æ³•ãŒãƒ‘ã‚¿ãƒ¼ãƒ³åŒ–ã•ã‚Œï¼Œã‚¢ãƒ³ãƒ€ãƒ¼ã‚°ãƒ©ã‚¦ãƒ³ãƒ‰ãƒ»ãƒ“ã‚¸ãƒã‚¹ã«æ‚ªç”¨ã•ã‚Œã¤ã¤ã‚ã‚‹ã‚ˆã†ã ã€‚ ä»Šå›žæ³¨ç›®ã—ãŸã„ã®ã¯ï¼Œæ”¹ã–ã‚“ã•ã‚ŒãŸWebã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‹ã‚‰ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã•ã‚Œã‚‹å…ˆã®ã‚µãƒ¼ãƒãƒ¼ã§ã‚ã‚‹ã€‚5æœˆã«è©±é¡Œã«ãªã£ãŸJSRedir-RãŒåˆ©ç”¨ã—ã¦ã„ãŸã‚µãƒ¼ãƒãƒ¼ã¯ï¼ŒAdobe Readerã¨Flash Playerã«çš„ã‚’çµžã£ãŸã‚‚ã®ã ã‘ã ã£ãŸã€‚ã“ã‚Œã‚‰ã®æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã¯é »ç¹ã«å¾®å¦™ãªå¤‰æ›´ã‚’ç¹°ã‚Šè¿”ã—ã¦ãŠã‚Š
kgbu 2009/07/28
å®Ÿåˆ©ãŒç›®çš„ã®å ´åˆã€æ”»æ’ƒå¯¾è±¡ãŒå¤šã„ãƒã‚¤ãƒ³ãƒˆã‚’ç‹™ã†ã ã‚ã†ã‹ã‚‰ã€ãƒ‹ãƒƒãƒã§ã‚ã‚‹ã“ã¨ã¯å„ªä½ã‹ã‚‚ã—ã‚Œã‚“ãªã€‚

security

trend

webã‚µãƒ¼ãƒ“ã‚¹

xss

ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆå¯¾å¿œ

åˆ†æž

ã‚ã¨ã§èª¿ã¹ãŸã„
ãƒªãƒ³ã‚¯
Donâ€™t use strip_tags, strip_links and sanitize - Ruby on Rails Security Project
Update: This is about earlier releases, Rails 2.0 provides a new sanitize method which uses a white list. Also, strip_tags and strip_links have been updated, the attack vectors below do not work anymore. Rails includes several insecure text helpers, especially strip_tags, strip_links and sanitize. Do not rely on the these as they do not fulfill what the name promises. Here are two examples: Note:
kgbu 2009/05/14
ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆã«é ¼ã‚‹ãªã€ã¨ã„ã†è©±ã€‚ã‚‰ã—ã„

security

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„

white list

WAF

ruby on rails

xss
ãƒªãƒ³ã‚¯
http://svn.techno-weenie.net/projects/plugins/white_list/
kgbu 2009/05/14
XSSã‚’é˜²ããŸã‚ã®whilte listã‚’ç”¨ã„ãŸã‚µãƒ‹ã‚¿ã‚¤ã‚ºç”¨ãƒ—ãƒ©ã‚°ã‚¤ãƒ³

ruby on rails

Ruby

programming

ã‚µãƒ¼ãƒæ§‹ç¯‰

knowhow

security

xss

plugin
ãƒªãƒ³ã‚¯
Afrous ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã‚µãƒ¼ãƒ“ã‚¹ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€ç•ªå¤–ç·¨ - snippets from shinichitomitaâ€™s journal
æ˜”æ‡ã‹ã—ã®Afrousã§ã™ãŒã€ã¾ã å®Ÿã¯ã‚„ã£ã¦ã¾ã™ã€‚ã¨ã„ã†ã‹ã†ã¡ã®ä¼šç¤¾ã®ãƒ¡ã‚¤ãƒ³ãƒ—ãƒãƒ€ã‚¯ãƒˆã§ã™ã€‚ã ã„ã¶ãƒ–ãƒ©ãƒ³ãƒ‰åã¨ã—ã¦ä½¿ã„ã¾ã‚ã—ã¦ã‚‹æ„Ÿã¯ã‚ã‚Šã¾ã™ãŒã€‚ ã¨ã„ã†ã“ã¨ã§ã€æœ¬æ—¥ãƒªãƒ‹ãƒ¥ãƒ¼ã‚¢ãƒ«ã‚ªãƒ¼ãƒ—ãƒ³ã—ã¾ã—ãŸã€‚ HugeDomains.com - Shop for over 300,000 Premium Domains åŸºæœ¬çš„ã«ä¼šç¤¾é–¢é€£ã®è©±ã¯ä¼šç¤¾ã®æ–¹ã§ã‚„ã‚‹ã¹ãã ã¨æ€ã†ã®ã§ï¼ˆå¸‚å ´æ€§ã¨ã‹ã†ã‚“ã¬ã‚“ï¼‰ã€ã“ã“ã§ã¯ãã‚Œã¯ãŠã„ã¦ãŠã„ã¦ã€ä¸èº«ã«ã©ã†ã„ã†è¦ç´ ã‚’ä½¿ã£ã¦ã‚‹ã‹ã¨ã„ã†ã¨ã“ã‚ã‚’æ›¸ãã¾ã™ã€‚ ã¾ãšã¯åŸºæœ¬çš„ãªã¨ã“ã‚ã€‚ Ext JS ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã«ã¯Ext JSã¤ã‹ã£ã¦ã¾ã™ã€‚ã“ã‚Œã¯è¦‹ãŸç›®ã§ã™ãã‚ã‹ã‚Šãã†ãªã¨ã“ã‚ã§ã€å‰ã‹ã‚‰ãã†ã ã£ãŸã‚“ã§è¨€ã†å¿…è¦ã‚‚ãªã„ã¨ã“ã‚ã§ã™ã‘ã©ã€1.1.1ãƒ™ãƒ¼ã‚¹ã ã£ãŸã®ã‚’2.1ã«å¤‰ãˆã¾ã—ãŸï¼ˆã»ã¼æ›¸ãç›´ã—ï¼‰ã€‚ã“ã†ã„ã£ãŸãŠä»•ç€ã›ã®UIã«ã¤ã„ã¦ã„ã‚„ãŒã‚‹äººã‚‚ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€ã¾ã‚å®Ÿè£…å´ã¨ã—ã¦ã¯ã“ã‚ŒãŒã‚ã£ã¦æ£ç›´ã‹
kgbu 2009/02/08
ã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆæƒ…å ±ã®ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—ã‚’è¡Œã‚ã›ã‚‹ãŸã‚ã«ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³é€šä¿¡ã‚’ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã§ã‚„ã‚‰ãªã„ã‚ˆã†ã«ã—ãŸã€ã¨ã„ã†ã®ã¯èˆˆå‘³æ·±ã„åˆ¤æ–ã€‚å¤–éƒ¨ã¨ã‚µãƒ¼ãƒãƒ¬ã‚¹ã§ã¤ãªãŒã£ã¡ã‚ƒã£ãŸã‚Šã—ãªã„ä»•çµ„ã¯ã©ã†ãªã®ã‹ãªã€‚

security

ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—

ajax

protocol

xss

technology

programming

ã‚ã¨ã§èª¿ã¹ãŸã„

JSONP
ãƒªãƒ³ã‚¯
window.nameã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³é€šä¿¡ - snippets from shinichitomitaâ€™s journal
éšåˆ†å‰ã«ãªã‚‹ãŒã€SitePenã®äºº (dojo) ãŒæ›¸ã„ãŸãƒ–ãƒã‚°ã« window.nameã‚’ä½¿ã£ãŸã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³é€šä¿¡ã«ã¤ã„ã¦ã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ãŸã€‚ window.name Transport - Blog | SitePen æ°—ã«ãªã£ã¦ã„ãŸãŒã¡ã‚ƒã‚“ã¨èªã‚€æ™‚é–“ãŒãªã‹ã£ãŸã®ã§ã€ä»Šã”ã‚è¦‹ã¦ã¿ã‚‹ã€‚æŠœç²‹ã—ã¦è¨³ã€‚ window.name ã«ã‚ˆã‚‹é€šä¿¡ The window.name transport is a new technique for secure cross-domain browser based data transfer, and can be utilized for creating secure mashups with untrusted sources. window.name is implemented in Dojo in the new dojox.io.windowN
kgbu 2009/02/08
SitePen blogã®è¨˜äº‹ã®æŠ„è¨³ã€‚window.nameã®å€¤ã¯ãƒšãƒ¼ã‚¸é·ç§»ã—ã¦ã‚‚æ®‹ã‚‹ã“ã¨ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚‰ã—ã„ã€‚JSONPã¨ã®æ¯”è¼ƒãªã©ã‚‚ã¨ã‚Šã‚ã’ã‚‰ã‚Œã¦ã„ã‚‹ã€‚ã—ã‹ã—ã“ã‚Œã£ã¦ã„ã¤ã¾ã§ä½¿ãˆã‚‹æŠ€ãªã®ã‹ã€‚

ajax

xss

security

technology

ã‚ã¨ã§è©¦ã™

network

JSONP

protocol

browser

javascript
ãƒªãƒ³ã‚¯
Security in Depth: Local Web Pages
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
kgbu 2008/12/06
ãƒãƒ¼ã‚«ãƒ«ã«ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ãŸãƒ•ã‚¡ã‚¤ãƒ«ã‚’ä½¿ã£ãŸæ”»æ’ƒæ–¹æ³•ã¸ã®å¯¾å‡¦ã«ã¤ã„ã¦ã€‚Operaã¨ä¼¼ãŸå¯¾å‡¦ã€ã™ãªã‚ã¡ã€ãƒãƒ¼ã‚«ãƒ«ã®ãƒšãƒ¼ã‚¸ã‹ã‚‰ã¯å¤–éƒ¨ã®ã‚µã‚¤ãƒˆã®ãƒšãƒ¼ã‚¸ã®ãƒ‡ãƒ¼ã‚¿ã‚’åˆ©ç”¨ã§ããªã„ã€‚ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆã¯ãƒãƒ¼ã‚«ãƒ«ã˜ã‚ƒãªã„ã®ï¼Ÿ

security

chrome

browser

xss

attack
ãƒªãƒ³ã‚¯
å†åº¦chromeã®ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯æŽ¢è¨ª Â« ku
å‰å›žã®chromeã®ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯æŽ¢è¨ªã§ã¯ã€ãªã‚“ã§inspectorã‹ã‚‰ã ã¨ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®IFRAMEã®ä¸ãŒèªã¿å‡ºã›ã‚‹ã®ã‹ã€ã¨ã„ã†ã®ãŒã‘ã£ãã‚‡ãã‚ã‹ã‚“ãªã„ã¾ã¾ã§ã—ãŸãŒã€ç†ç”±ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ src/webkit/port/bindings/v8/v8_proxy.cppã®ä¸ã«ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒã‚§ãƒƒã‚¯ã‚’è¡Œã†V8Proxy::CanAccessPrivateã¨ã„ã†é–¢æ•°ãŒã‚ã‚Šã€ã“ã‚ŒãŒinspectorã®ã‚ˆã†ãªãƒ–ãƒ©ã‚¦ã‚¶çµ„ã¿è¾¼ã¿ã®ãƒšãƒ¼ã‚¸ã®ãŸã‚ã®protocolã‚’ç‰¹åˆ¥æ‰±ã„ã™ã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ // Check if the current execution context can access a target frame. // First it checks same domain policy using the lexical context // // This
kgbu 2008/10/30
ãƒ–ãƒ©ã‚¦ã‚¶çµ„ã¿è¾¼ã¿ã®schemeã«å¯¾ã—ã¦ã®ãƒã‚§ãƒƒã‚¯ãŒãƒã‚¤ãƒ‘ã‚¹ã•ã‚Œã¦ã„ã‚‹ã‚±ãƒ¼ã‚¹ãŒã‚ã‚‹ãã†ãªã€‚

chrome

browser

xss

vulnerability

javascript

ã‚ã¨ã§èª¿ã¹ãŸã„

security
ãƒªãƒ³ã‚¯
How to write SQL injection proof PL/SQL
How to write SQL injection proof PL/SQL An Oracle White Paper December 2008 4-December-2008 www.oracle.com/techno logy/tech/pl_sql/pdf/how_to_write_injection_proof_plsql.pdf NOTE The following is intended to outline our general product direction. it is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or
kgbu 2008/10/17
Schneier on Securityã§ç´¹ä»‹ã•ã‚Œã¦ã„ãŸã€‚å®Ÿè¡Œæ™‚ã«ãƒ¦ãƒ¼ã‚¶å…¥åŠ›ã«ã‚ˆã£ã¦æ±ºå®šã•ã‚Œã‚‹ã‚ˆã†ãªSQLæ–‡ã‚’å®Ÿè¡Œã™ã‚‹ãªã€ã¨ã„ã†ã€å½“ãŸã‚Šå‰ã®ã“ã¨ã§ã™ãŒã€‚

xss

security

vulnerability

best practice

db

sqlã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³

programming

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„

è«–æ–‡
ãƒªãƒ³ã‚¯
Webã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ â€“ æ£ã—ã„èªè˜ãŒå¿…è¦
(Last Updated On: 2008å¹´9æœˆ13æ—¥)å¤§è¦æ¨¡ãªWebã‚µã‚¤ãƒˆæ§‹ç¯‰ã‚’è¡Œã£ã¦ã„ã‚‹æ–¹ãªã‚‰F5ã«ãŠä¸–è©±ã«ãªã£ã¦ã„ã‚‹æ–¹ã‚‚å¤šã„ã§ã—ã‚‡ã†ã€‚F5ã®ãƒ–ãƒã‚°ã§ç§ã¨å…¨ãåŒã˜æ„è¦‹ã®ãƒ–ãƒã‚° â€“ Why itâ€™s so hard to secure JavaScriptã‚’è¦‹ã¤ã‘ãŸã®ã§ç´¹ä»‹ã—ã¾ã™ã€‚ Webã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã§ã®ãƒšãƒ¼ã‚¸ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã¯æœ‰ç”¨ãªã®ã‹?ã§ã‚·ã‚°ãƒ‹ãƒãƒ£ãƒ™ãƒ¼ã‚¹ã®ãƒšãƒ¼ã‚¸ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã¯æœ‰ç”¨ã§ã¯ç„¡ã„ã¨æ›¸ãã¾ã—ãŸãŒã€WAFï¼ˆWeb Application Firewallï¼‰ã‚’è²©å£²ã—ã¦ã„ã‚‹F5ã®æ–¹ã‚‚åŒã˜è€ƒãˆã§ã™ã€‚ As we learned from preventing SQL injection and XSS, attackers are easily able to avoid detection by these systems by simply adding white space
kgbu 2008/09/15
white listæ–¹å¼ã ã‘ã§ã¯xssãªã©ã®æ¤œå‡ºã«ã¯é™ç•ŒãŒã‚ã‚‹ã¨ã„ã†è©±ã€‚F5ã®ã‚µã‚¤ãƒˆã§ã‚‚ã“ã†ã„ã†è¨˜äº‹ãŒã‚ã£ãŸã¨ã„ã†ç´¹ä»‹ã€‚

security

ãã‚‚ãã‚‚

ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«

white list

xss
ãƒªãƒ³ã‚¯
SELinux and Chrome
kgbu 2008/09/07
selinux

chrome

browser

security

javascript

xss

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
chromeã®ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯æŽ¢è¨ª Â« ku
- 12 users
- ido.nu
- å¦ã³
ãƒ–ãƒ©ã‚¦ã‚¶ã«ã¯javascriptã®ã‚³ãƒ¼ãƒ‰ãŒãã®ã‚¦ã‚¤ãƒ³ãƒ‰ã‚¦ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã‹ same origin policy ã«å¾“ã£ã¦ãƒã‚§ãƒƒã‚¯ã—ã¦ã„ã‚‹éƒ¨åˆ†ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®éƒ¨åˆ†ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™(Firefoxã§ã¯nsScriptSecurityManager, WebKitã§ã¯SecurityOriginã§å®Ÿè£…ã•ã‚Œã¦ã„ã‚‹)ã€‚ Firefoxã¯javascriptã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã²ã¨ã¤ã²ã¨ã¤ã«ã€ãã®ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’å®šç¾©ã—ãŸãƒšãƒ¼ã‚¸ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’ã‚‚ã¨ã«principalã‚’è¨å®šã—ã€å®Ÿè¡Œæ™‚ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã‚ˆã†ã¨ã—ã¦ã„ã‚‹ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®principalã¨å®Ÿè¡Œã‚³ãƒ³ãƒ†ã‚ã‚¹ãƒˆã®principalãŒä¸€è‡´ã™ã‚‹ã‹ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã“ã¨ã§ same origin policy ã‚’å®Ÿè£…ã—ã¦ã„ã¾ã™ã€‚Firefoxã¯å®Ÿè¡Œã‚³ãƒ³ãƒ†ã‚ã‚¹ãƒˆãŒãƒã‚¤ãƒ†ã‚£ãƒ–ã‚³ãƒ¼ãƒ‰ã‚„æ‹¡å¼µæ©Ÿèƒ½ç”±æ¥ã®ã‚‚ã®ã®ã¨ãã«ã¯ã€å¸¸ã«principalãŒä¸€è‡´ã™ã‚‹ã‚‚ã®
kgbu 2008/09/07
security

chrome

browser

google

javascript

xss

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Category:OWASP CAL9000 Project - OWASP
Overview CAL9000 is a collection of web application security testing tools that complement the feature set of current web proxies and automated scanners. CAL9000 gives you the flexibility and functionality you need for more effective manual testing efforts. Works best when used with Firefox or Internet Explorer. CAL9000 is written in JavaScript, so you have full access to the source code. Feel fre
kgbu 2008/08/22
tool

security

vulnerability

xss

software

test

webåˆ¶ä½œ

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„

ã‚ã¨ã§è©¦ã™
ãƒªãƒ³ã‚¯
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
kgbu 2008/08/21
ã‚¢ãƒŽæ‰‹ã“ã®æ‰‹ã§ãƒ—ãƒã‚°ãƒ©ãƒžã®ãƒ‡ã‚¶ã‚¤ãƒ³ã®ç©´ã‚’çªã„ã¦ãã‚‹ã€‚ã¨ã“ã‚ã§ã€æ”»æ’ƒå´ã®ãƒªã‚¹ãƒˆã¨ã€è‡ªåˆ†ã®ä½œã£ãŸguard patternãŒä¸€è‡´ã—ã¦ã„ãªã„ã‹ã©ã†ã‹ã‚’æ©Ÿæ¢°çš„ã«æ¤œè¨¼ã§ããªã„ã‚‚ã®ã ã‚ã†ã‹ï¼Ÿ

xss

cracking

knowhow

security

programming

ã‚ã¨ã§èª¿ã¹ãŸã„

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„

webåˆ¶ä½œ
ãƒªãƒ³ã‚¯
ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆã¯ã©ã†ä½œã‚‹?
(Last Updated On: 2018å¹´8æœˆ13æ—¥)ã¾ãšãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆã®åŸºæœ¬ä¸ã®åŸºæœ¬ã¯â€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§å…¨ã¦æ‹’å¦ã™ã‚‹â€ã§ã‚ã‚‹ã“ã¨ã«æ³¨æ„ã—ã¦ãã ã•ã„ã€‚å…¨ã¦æ‹’å¦ã—ãŸä¸Šã§è¨±å¯ã™ã‚‹ãƒ¢ãƒŽã‚’æŒ‡å®šã—ãªã„ã¨ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆã«ãªã‚Šã¾ã›ã‚“ã€‚ ä¾‹ãˆã°ã€CSPã¯ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆã§ä¸æ£ãªJavaScriptã®å®Ÿè¡Œã‚’é˜²æ¢ã™ã‚‹ä»•çµ„ã¿ã§ã™ã€‚2016å¹´ã®Goolgeã®èª¿æŸ»ã«ã‚ˆã‚‹ã¨95%ã®CSPå®šç¾©ãŒã€å®Ÿéš›ã«ã¯JavaScriptã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã®é˜²æ¢ã«å½¹ç«‹ã£ã¦ã„ãªã„ã€ã¨ã®èª¿æŸ»çµæžœã‚’ç™ºè¡¨ã—ã¦ã„ã¾ã™ã€‚åŽŸå› ã¯ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆã®ä½œã‚Šæ–¹ã®åŸºæœ¬ã€å…¨ã¦æ‹’å¦ã—ãŸä¸Šã§è¨±å¯ã™ã‚‹ãƒ¢ãƒŽã‚’æŒ‡å®šã™ã‚‹ã€ã‚’ç†è§£ã—ã¦ã„ãªã„ã“ã¨ã«ã‚ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚1 ç§ã¯ã„ã¤ã‚‚åŸºæœ¬çš„ã«èƒ½å‹•çš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–2ã‚’é¸æŠžã™ã‚‹ã‚ˆã†ã«ãŠå‹§ã‚ã—ã¦ã„ã¾ã™ã€‚èƒ½å‹•çš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã¨ã¯å…¨ã¦ã®å…¥åŠ›å€¤ã®åŽ³æ ¼ãªãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³å‡¦ç†ã§ã‚ã‚Šã€å‡ºåŠ›æ™‚ã«éŽå‰°ã¨ã‚‚è¨€ãˆã‚‹ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã§ã™ã€‚å…¥åŠ›ï¼å‡ºåŠ›ã®
kgbu 2008/08/21
XSS cheat listã‚‚è¦‹ãªã„ã¨ãªã€‚

webåˆ¶ä½œ

security

xss

white list

programming

tutorial

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„
ãƒªãƒ³ã‚¯
PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢
ã“ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã®èª¬æ˜Žãƒ»æ³¨æ„ãªã© PHP ã¯ã€Apache ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚„ã€CGIã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã¨ã—ã¦ä½¿ç”¨ã§ãã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã§ã™ã€‚ã“ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€ä¸»ã« PHP ã«ãŠã‘ã‚‹ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®å•é¡Œã«ã¤ã„ã¦ã‚ˆãå–ã‚ŠæŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‚‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦èª¿ã¹ãŸã“ã¨ã‚„ã€ã“ã‚Œã‚‰ä»¥å¤–ã§ã‚‚ã€PHP ã«é–¢é€£ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦çŸ¥ã£ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦ãƒ¡ãƒ¢ã—ã¦ãŠãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ã‚¹ãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«) ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã¾ãŸã€PHP ãƒžãƒ‹ãƒ¥ã‚¢ãƒ« : ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚„ã€PHP Security Guide (PHP Security Consortium) ã«ã¯ã€PH
kgbu 2008/06/04
ã™ã”ãé‡è¦ã‚‰ã—ã„ã€‚

security

vulnerability

php

programming

knowhow

webåˆ¶ä½œ

xss

ã„ã¾ã•ã‚‰è¨Šã‘ãªã„

ã¾ã¨ã‚

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸