[B! Security] khikerã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

khiker id:khiker

Securityã«é–¢ã™ã‚‹khikerã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (42)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠ OpenVAS ã‚’ä½¿ã£ã¦ã¿ã‚‹ - CUBE SUGAR CONTAINER
ä»Šå›žã¯ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠã§ã‚ã‚‹ OpenVAS ã‚’ä½¿ã£ã¦ã¿ã‚‹ã“ã¨ã«ã™ã‚‹ã€‚ è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠã¨ã„ã†ã®ã¯ã€ãƒ›ã‚¹ãƒˆã«æ—¢çŸ¥ã®è„†å¼±æ€§ãŒå«ã¾ã‚Œãªã„ã‹ã©ã†ã‹ã‚’è‡ªå‹•ã§ã‚¹ã‚ãƒ£ãƒ³ã—ã¦ãã‚Œã‚‹ãƒ„ãƒ¼ãƒ«ã€‚ æ³¨æ„: è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒ³ã¯ãƒãƒ¼ãƒˆã‚¹ã‚ãƒ£ãƒ³ã‚„ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å«ã‚€ãŸã‚å¤–éƒ¨ã®ã‚µãƒ¼ãƒã«ã¯å®Ÿè¡Œã—ãªã„ã“ã¨ ä½¿ã£ãŸç’°å¢ƒã¯æ¬¡ã®é€šã‚Šã€‚OS ã¯ Ubuntu 16.04 LTS ã«ã—ãŸã€‚ $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.3 LTS Release: 16.04 Codename: xenial $ uname -r 4.4.0-89-generic ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç”¨é€”ã ã¨ Kali Linux ã‚’ä½¿ã†ã“ã¨ã‚‚å¤šã„ã¿ãŸã„ã€‚ ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« Ubuntu ã§ OpenVA
khiker 2017/08/09
Linux

Security
ãƒªãƒ³ã‚¯
BearSSL - Main
Overview BearSSL is an implementation of the SSL/TLS protocol (RFC 5246) written in C. It aims at offering the following features: Be correct and secure. In particular, insecure protocol versions and choices of algorithms are not supported, by design; cryptographic algorithm implementations are constant-time by default. Be small, both in RAM and code footprint. For instance, a minimal server imple
khiker 2016/11/24
TLS

Security
ãƒªãƒ³ã‚¯
ç±³å›½ã«ãŠã‘ã‚‹æš—å·æŠ€è¡“ã‚’ã‚ãã‚‹å‹•å‘
khiker 2016/11/08
Security

PDF
ãƒªãƒ³ã‚¯
GitHub - future-architect/vuls: Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in a production environment, it is common for a system administrator to choose not to use the automatic update option provided by the package manager and to perform update manually. This leads to the following probl ems. The system administrator will
khiker 2016/10/03
Security

Go
ãƒªãƒ³ã‚¯
GitHub - isdrupter/busybotnet: Security For Embedeed Systems - One Bin to Rule Them All.
As you can see, we have added many new features to busybox. Particulary interesting are the cryptography applets. This is an incomplete list of the applets enabled during my last build: evil@devbox:~/busybotnet$ ./busybotnet hydra Hydra v8.2-dev (c) 2016 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Syntax: hydra [[[-l LOGIN|-L FILE] [-
khiker 2016/06/28
C

Security
ãƒªãƒ³ã‚¯
GoogleãŒTLSã§ã®æŽ¡ç”¨ã‚’æå”±ã—ã¦ã„ã‚‹å…±é€šéµæš—å·æ–¹å¼ã€ŒChaChaã€ã«ã¤ã„ã¦ã¾ã¨ã‚ãŸ - sonickun.log
ChaChaï¼ˆãƒãƒ£ãƒãƒ£ï¼‰ã¨ã„ã†ä¸€è¦‹ãµã–ã‘ãŸåå‰ã®æš—å·ãŒæœ€è¿‘ï¼ˆè‡ªåˆ†ã®ä¸ã§ï¼‰è©±é¡Œã¨ã„ã†ã“ã¨ã§ï¼Œå‹‰å¼·ãŒã¦ã‚‰ã«è¨˜äº‹ã«ã—ã¦ã¿ã¾ã—ãŸï¼Ž èƒŒæ™¯ ChaChaã®æ§‹é€ Salsa20 Chacha åˆæœŸçŠ¶æ…‹ ãƒ©ã‚¦ãƒ³ãƒ‰æ“ä½œ ChaChaã®å®‰å…¨æ€§ å®Ÿè£…ã—ã¦ã¿ãŸ å‚è€ƒ èƒŒæ™¯ 2016å¹´4æœˆç¾åœ¨ï¼ŒTLSã®æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¨ã—ã¦TLS 1.3ãŒææ¡ˆã•ã‚Œã¦ãŠã‚Šï¼Œãƒ‰ãƒ©ãƒ•ãƒˆãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹ï¼Ž draft-ietf-tls-tls13-11 - The Transport Layer Security (TLS) Protocol Version 1.3 TLS 1.2ã‹ã‚‰ã®å¤§ããªå¤‰æ›´ç‚¹ã¨ã—ã¦ï¼Œä»¥ä¸‹ã®2ã¤ãŒã‚ã‚‹ï¼Ž ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã®çœç•¥ã«ã‚ˆã‚‹RTTï¼ˆRound Trip Timeï¼‰ã®å‰Šæ¸› å±æ®†åŒ–ã—ãŸæš—å·ã®å»ƒæ¢ ã€Œå±æ®†åŒ–ã—ãŸæš—å·ã€ã¨ã¯ï¼ŒForward Secrecyã§ãªã„Cipher Suiteï¼ˆRSAã®ã¿ã‚’ç”¨ã„ãŸã‚‚ã®ï¼‰ã‚„ï¼Œèªè¨¼
khiker 2016/04/05
TLS

Security
ãƒªãƒ³ã‚¯
GitHub - bifurcation/mint: A Minimal TLS 1.3 Implementation in Go
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
khiker 2016/03/07
Security

TLS

Go
ãƒªãƒ³ã‚¯
sshdã§å¼±ã„æš—å·æ–¹å¼ã‚’ä½¿ç”¨ã—ãªã„ã‚ˆã†ã«ã™ã‚‹ã€‚ - labunix's blog
â– sshdã§å¼±ã„æš—å·æ–¹å¼ã‚’ä½¿ç”¨ã—ãªã„ã‚ˆã†ã«ã™ã‚‹ã€‚ ä»¥ä¸‹ãŒã¨ã¦ã‚‚ã‚ã‹ã‚Šã‚„ã™ã„ã€‚ SSHã‚µãƒ¼ãƒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨å®šã‚¬ã‚¤ãƒ‰ http://www.nca.gr.jp/imgs/nca_ssh_server_config_v01.pdf ãŸã ã€ã€Œå¼±ã„æš—å·æ–¹å¼ã‚„ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸èªè¨¼ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãªã„ã€ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã€‘ã€ãŒã€ è‹¥å¹²åˆ†ã‹ã‚Šã«ãã‹ã£ãŸã®ã¨ã€CBCã ã‘ã§ãªãã€ RC4ã‚„MD5ã€SHA-1ã®ç„¡åŠ¹ã‚’è¿½åŠ ã—ãŸã‹ã£ãŸã®ã§ã€ã‚„ã£ã¦ã¿ãŸã€‚ â– ä»Šå›žãƒ†ã‚¹ãƒˆã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ä»¥ä¸‹ã®ã¨ãŠã‚Šã€‚ $ lsb_release -d Description: Debian GNU/Linux 8.3 (jessie) $ ssh -V OpenSSH_6.7p1 Debian-5+deb8u1, OpenSSL 1.0.1k 8 Jan 2015 $ sudo sshd -v 2>&1 | awk '/Open/' OpenSSH_6
khiker 2016/02/29
sshd

SSH

Security
ãƒªãƒ³ã‚¯
HTTP/2, QUICã‹ã‚‰TLS1.3ã¸
HTTP/2, QUICã‹ã‚‰TLS1.3ã¸ å¤§æ´¥ ç¹æ¨¹ æ ªå¼ä¼šç¤¾ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¤ãƒ‹ã‚·ã‚¢ãƒ†ã‚£ãƒ–(IIJ) Internet Week 2015 2015/11/18 2015å¹´11æœˆ19æ—¥æ›´æ–°ç‰ˆ è‡ªå·±ç´¹ä»‹ â€¢ å¤§æ´¥ ç¹æ¨¹ â€¢ æ ªå¼ä¼šç¤¾ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¤ãƒ‹ã‚·ã‚¢ãƒ†ã‚£ãƒ–(IIJ) â€¢ ãƒ—ãƒãƒ€ã‚¯ãƒˆæœ¬éƒ¨ ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºéƒ¨ã‚µãƒ¼ãƒ“ã‚¹é–‹ç™º2èª² â€¢ Node.JS Technical Steering Committee ãƒ¡ãƒ³ãƒãƒ¼ â€¢ (ä¸»ã«TLS/CRYPTO/OpenSSLãƒã‚¤ãƒ³ãƒ‡ã‚£ãƒ³ã‚°ã‚’æ‹…å½“ï¼‰ â€¢ IETF httpbis WG ã§ HTTP/2ç›¸äº’æŽ¥ç¶šè©¦é¨“ç‰ä»•æ§˜ç–å®šã«å‚ç”»ã€‚ã—ã‹ã— TLS1.3ã®æ¨™æº–ç–å®šä½œæ¥ã«ã¯ã“ã‚Œã¾ã§ç›´æŽ¥ã‹ã‹ã‚ã£ã¦ã„ã¾ã›ã‚“ã€‚ â€¢ ãƒ–ãƒã‚°ï¼š http://d.hatena.ne.jp/jovi0608/ ã§TLSå‘¨ã‚Šã®ãƒã‚¿ã‚’ã„ã‚ã„ã‚ æ›¸ã„ã¦ã„ã¾ã™ã€‚ å†…å®¹ ç¾åœ¨ä»•æ§˜ç–å®šä½œæ¥ä¸ã®TL
khiker 2016/02/23
Security

TLS
ãƒªãƒ³ã‚¯
NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC (PDF)
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Locked padlock icon ) or https:// means youâ€™ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
khiker 2016/01/26
Security
ãƒªãƒ³ã‚¯
GitHub - siddharthgoel88/web-attacks: A repository to showcase some of the popular web attacks.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
khiker 2016/01/21
Web

Security
ãƒªãƒ³ã‚¯
Back to 28: Grub2 Authentication Bypass 0-Day
December 10th, 2015 - Disclosed at IX Jornadas STIC CCN-CERT. December 14th, 2015 - Published in the web. Description A vulnerability in Grub2 has been found. Versions from 1.98 (December, 2009) to 2.02 (December, 2015) are affected. The vulnerability can be exploited under certain circumstances, allowing local attackers to bypass any kind of authentication (plain or hashed passwords). And so, the
khiker 2015/12/16
Security

Grub
ãƒªãƒ³ã‚¯
HES2011 - Jon Larimer - Autorun Vulnerabilities on Linux
This document discusses potential vulnerabilities related to autorun functionality and removable storage devices like USB drives on Linux systems. It notes that while Linux desktop environments don't automatically run scripts from removable devices, vulnerabilities could still exist in drivers and applications that handle connecting and accessing such devices. Specific vulnerabilities are identifi
khiker 2011/04/25
Linux

Security
ãƒªãƒ³ã‚¯
Kozupon.com - ä¸æ£ä¾µå…¥ã‚’å—ã‘ã¦ã„ã‚‹ã‹åˆ¤æ–ã™ã‚‹ï¼
ä¾µå…¥ã•ã‚Œã¦ã—ã¾ã£ãŸã®ã‹ã€ãã†ã§ãªã„ã®ã‹ã‚’åˆ¤æ–ã™ã‚‹ã«ã¯ä½•ã¯ã¨ã‚‚ã‚ã‚Œã€ãã®ãƒ›ã‚¹ãƒˆã®ã‚·ã‚¹ãƒ†ãƒ ã®ç¾çŠ¶ã‚’æŠŠæ¡ã™ã‚‹ã®ãŒå…ˆæ±ºã ã¨è€ƒãˆã‚‹ã€‚æœ¬å½“ã«ä¾µå…¥ã•ã‚ŒãŸã®ã‹ã€ãã†ã ã¨ã—ãŸã‚‰ã©ã®ãã‚‰ã„ã®è¢«å®³ã‚’å—ã‘ãŸã®ã‹ç‰ã‚’æœ‰ã‚‹ç¨‹åº¦å†·é™ãªåˆ¤æ–ãŒå¿…è¦ã«ãªã£ã¦ãã‚‹ã€‚ã“ã‚“ãªå ´åˆã€æ…Œã¦ã¦ã—ã¾ã†ã®ãŒã¤ãã ãŒã€é©åˆ‡ãªå¯¾ç–ã‚’æ–½ã™ã«ã¯å†·é™ãªåˆ¤æ–ãŒå¿…è¦ã ã¨è€ƒãˆã‚‹ã€‚ ä½•ã¯ã¨ã‚‚ã‚ã‚Œä»–äººã«è¿·æƒ‘ã‚’ã‹ã‘ãªã„ãŸã‚ã«ã€å¯¾ç–ã¨ã—ã¦ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚±ãƒ¼ãƒ–ãƒ«ã‚’å¤–ã—ã¦ã—ã¾ã†ã®ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ä¸€ã¤ã®æ¥µæ„ã ãŒã€æœ¬å½“ã«ä¾µå…¥ã•ã‚Œã¦ã„ã‚‹ã‹ã®åˆ¤æ–ãŒã¤ã‹ãªã„é™ã‚Šã€ã‚µãƒ¼ãƒã‚µãƒ¼ãƒ“ã‚¹ã‚’å®‰æ˜“ã«åœæ¢ã•ã›ã‚‹ã¹ãã§ã¯ç„¡ã„ã¨æ€ã†ã€‚ ã—ãŸãŒã£ã¦ã€ã¾ãšä½•ã‚ˆã‚Šã‚‚ä¾µå…¥ã‚’ã•ã‚ŒãŸã‹å¦ã‹ã‚’çš„ç¢ºã«åˆ¤æ–ã—ã‚ˆã†ã€‚åˆå¿ƒè€…ã«å¤šã„ã®ã¯ã€ã€Œä½•ã¯ã¨ã‚‚ã‚ã‚Œå†èµ·å‹•ã™ã‚Œã°ç›´ã‚‹ã®ã§ã¯ãªã„ã‹ã€‚ã€ã¨ã„ã†åˆ¤æ–ã§ã‚ã‚‹ã€‚ç¢ºã‹ã«ã€å†èµ·å‹•ã›ã–ã‚‹è² ãˆãªã„ã¨ãã¯æœ‰ã‚‹ã€‚ã—ã‹ã—ã€ã‚¯ãƒ©ãƒƒã‚¯ãªæ–¹ã«ä¾µå…¥ã•ã‚Œã¦ãŸã¨ã—ãŸã‚‰ã€ãƒã‚¸ãƒƒã‚¯ãƒœãƒ ï¼ˆã‚·ã‚¹ãƒ†ãƒ ã‚’ç ´å£Šã™
khiker 2010/12/13
Linux

Security
ãƒªãƒ³ã‚¯
XSSã®æ”»æ’ƒæ‰‹æ³•ã„ã‚ã„ã‚ - ã†ãªã®æ—¥è¨˜
html5securityã®ã‚µã‚¤ãƒˆã«ã€XSSã®å„ç¨®æ”»æ’ƒæ‰‹æ³•ãŒã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ã‚‹ã®ã‚’ç™ºè¦‹ã›ã‚Š!ã¨ã„ã†ã“ã¨ã§ã€å€‹äººçš„ã«ã€ŒãŠ!ã€ã¨æ€ã£ãŸæ”»æ’ƒã‚’ã‚µãƒ³ãƒ—ãƒ«ã¤ãã§ã”ç´¹ä»‹ã—ã¾ã™ã€‚ 1. CSS Expression IE7ä»¥å‰ã«ã¯ã€ŒCSS Expressionsã€ã¨ã„ã†æ‹¡å¼µæ©Ÿèƒ½ãŒã‚ã‚Šã€CSSå†…ã§JavaScriptã‚’å®Ÿè¡Œã§ããŸã‚Šã—ã¾ã™ã€‚ <div style="color:expression(alert('XSS'));">a</div> ç¢ºèª @IT -ï¼»æŸ”è»Ÿã™ãŽã‚‹ï¼½IEã®CSSè§£é‡ˆã§èµ·ã“ã‚‹XSS ã§è©³ã—ãè§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€CSSã®è§£é‡ˆãŒæŸ”è»Ÿãªã“ã¨ã¨ã‚‚ã‚ã„ã¾ã£ã¦è‡ªå‰ã§ç„¡å®³åŒ–ã™ã‚‹ã®ã¯ãªã‹ãªã‹å›°é›£ã€‚ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã§ã‚‚ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ <div style="color:expr/* ã‚³ãƒ¡ãƒ³ãƒˆã®æŒ¿å…¥ */ession(alert('XSS'));">a</div> ç¢ºèª <div s
khiker 2010/06/21
Javascript

CSS

XSS

Security
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®åˆ¤å®šã«strcmpã‚’ä½¿ã†ã¹ãã§ãªã„ç†ç”±
strcmpã‚’ä½¿ã£ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’åˆ¤å®šã™ã‚‹ã¨ã€ã‚¿ã‚¤ãƒŸãƒ³ã‚°æ”»æ’ƒ (timing attack) ã«ã‚„ã‚‰ã‚Œã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã“ã¨ã®èª¬æ˜Ž (ç´„20åˆ†)ã€‚ ã¾ã¨ã‚: ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãªã©ã®æ–‡å—åˆ—ã‚’ strcmpé–¢æ•° (ãŠã‚ˆã³ãã‚Œã«é¡žã™ã‚‹é–¢æ•°) ã‚’ä½¿ã£ã¦åˆ¤å®šã™ã‚‹ã¨ã€ ãã®åˆ¤å®šã«ã‹ã‹ã‚‹æ™‚é–“ã‚’æ¸¬å®šã™ã‚‹ã“ã¨ã§ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæŽ¨æ¸¬ã§ãã¦ã—ã¾ã†å ´åˆãŒã‚ã‚‹ã€‚ ã“ã‚Œã‚’ã‚¿ã‚¤ãƒŸãƒ³ã‚°æ”»æ’ƒ (timing attack) ã¨ã„ã†ã€‚ ã“ã®ä¾‹ã§ã¯ã€36ç¨®é¡žã®æ–‡å—ã‚’ä½¿ã£ãŸ8æ–‡å—åˆ†ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æŽ¨æ¸¬ã™ã‚‹ã®ã«ã€ é€šå¸¸ã®ã—ã‚‰ã¿ã¤ã¶ã—ãªæ–¹æ³• (bruteforce attack) â€¦ 368 = 2821109907456å›ž ã®è©¦è¡ŒãŒå¿…è¦ãªã®ã«å¯¾ã—ã¦ã€ ã‚¿ã‚¤ãƒŸãƒ³ã‚°æ”»æ’ƒã‚’ä½¿ã£ãŸæ–¹æ³• â€¦ 10000Ã—8 = 80000å›ž ã—ã‹ã‹ã‹ã‚‰ãªã„ã€‚ã‚¿ã‚¤ãƒŸãƒ³ã‚°æ”»æ’ƒã‚’æˆåŠŸã•ã›ã¦ã—ã¾ã†ã¨ã€ é‡è¦ãªæƒ…å ±ãŒæ¼æ´©ã—ã¦ã—ã¾ã†å±é™ºæ€§ãŒã‚ã‚‹ã€‚ ã“ã‚Œã‚’é˜²ããŸã‚ã«ã¯ã€ãªã‚‹ã¹ãå®Ÿè¡Œæ™‚é–“
khiker 2010/04/10
ã‚¿ã‚¤ãƒŸãƒ³ã‚°æ”»æ’ƒ

C

Security
ãƒªãƒ³ã‚¯
CSS ã«ã‚ˆã‚‹å±¥æ´ã®æ¼ãˆã„ã‚’é˜²ãå–ã‚Šçµ„ã¿ Â« Mozilla Developer Street (modest)
ã“ã‚Œã¯ã€Mozilla Security Blog ã®è¨˜äº‹ Plugging the CSS History Leak (è‹±æ–‡) ã®æŠ„è¨³ã§ã™ã€‚Web é–‹ç™ºè€…ã®æ–¹ã¯ Mozilla Hacks ã®è¨˜äº‹æŠ„è¨³ CSS ã® :visited ã«è¡Œã‚ã‚Œã‚‹ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼å¯¾ç– ã‚‚å‚ç…§ã—ã¦ãã ã•ã„ã€‚ ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã®ä¿è·ã¯å¿…ãšã—ã‚‚ç°¡å˜ãªã“ã¨ã§ã¯ã‚ã‚Šã¾ã›ã‚“ Mozilla ã§ã¯è¿‘ãã€ä»¥å‰ã‹ã‚‰ãƒ–ãƒ©ã‚¦ã‚¶å„ç¤¾ãŒå–ã‚Šçµ„ã‚“ã§ã„ã‚‹å€‹äººæƒ…å ±æ¼ãˆã„å•é¡Œã®å¯¾ç–ã‚’ Firefox ã®é–‹ç™ºãƒ„ãƒªãƒ¼ã«è¿½åŠ ã—ã¾ã™ã€‚ç§ãŸã¡ã¯ã“ã®æ”¹å–„ã‚’éžå¸¸ã«æ¥½ã—ã¿ã«ã—ã¦ãŠã‚Šã€ä»–ã®ãƒ–ãƒ©ã‚¦ã‚¶ã‚‚å¾Œã«ç¶šã„ã¦ãã‚Œã‚‹ã“ã¨ã‚’æœŸå¾…ã—ã¦ã„ã¾ã™ã€‚ã—ã‹ã—ã€ã“ã‚Œã¯è§£æ±ºãŒé›£ã—ã„å•é¡Œã§ã‚ã‚‹ãŸã‚ã€Mozilla ãŒãªãœã“ã®ã‚ˆã†ãªã‚¢ãƒ—ãƒãƒ¼ãƒã‚’å–ã‚‹ã“ã¨ã«ã—ãŸã®ã‹èª¬æ˜Žã—ã¦ãŠããŸã„ã¨æ€ã„ã¾ã™ã€‚ å±¥æ´ã®å–å¾— Web ãƒšãƒ¼ã‚¸ä¸Šã®ãƒªãƒ³ã‚¯ã¯ã€ãƒ¦ãƒ¼ã‚¶ãŒãã®ãƒªãƒ³ã‚¯å…ˆã‚’è¨ªã‚ŒãŸã“ã¨ãŒã‚ã‚‹ã‹ã©ã†ã‹ã«ã‚ˆã£ã¦è¦‹ãŸç›®ãŒ
khiker 2010/04/02
Web

CSS

Security
ãƒªãƒ³ã‚¯
InfoQ: HTTPSã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã®æœ€åˆã®æ•°ãƒŸãƒªç§’
ã»ã¨ã‚“ã©ã®äººãŒHTTPSã¨SSL (Secure Sockets Layer) ã‚’çµã³ã¤ã‘ã¦è€ƒãˆã¾ã™ã€‚SSLã¯1990å¹´ä»£åŠã°ã«Netscapeç¤¾ãŒé–‹ç™ºã—ãŸä»•çµ„ã¿ã§ã™ãŒã€ä»Šã§ã¯ã“ã®äº‹å®Ÿã¯ã‚ã¾ã‚Šæ£ç¢ºã§ãªã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚Netscapeç¤¾ãŒå¸‚å ´ã®ã‚·ã‚§ã‚¢ã‚’å¤±ã†ã«ã—ãŸãŒã£ã¦ã€SSLã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“ã‚¿ã‚¹ã‚¯ãƒ•ã‚©ãƒ¼ã‚¹(IETF)ã¸ç§»ç®¡ã•ã‚Œã¾ã—ãŸã€‚Netscapeç¤¾ã‹ã‚‰ç§»ç®¡ã•ã‚Œã¦ä»¥é™ã®åˆã‚ã¦ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯Transport Layer Security (TLS)1.0ã¨åä»˜ã‘ã‚‰ã‚Œã€1999å¹´1æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚TLSãŒä½¿ã‚ã‚Œã ã—ã¦10å¹´ã‚‚çµŒã£ã¦ã„ã‚‹ã®ã§ã€ç´”ç²‹ãª"SSL"ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’è¦‹ã‚‹ã“ã¨ã¯ã»ã¨ã‚“ã©ã‚ã‚Šã¾ã›ã‚“ã€‚ Client Hello TLSã¯ã™ã¹ã¦ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç•°ãªã‚‹ã‚¿ã‚¤ãƒ—ã®"ãƒ¬ã‚³ãƒ¼ãƒ‰"ã§åŒ…ã¿ã¾ã™ã€‚ãƒ–ãƒ©ã‚¦ã‚¶ãŒå‡ºã™å…ˆé ã®ãƒã‚¤ãƒˆå€¤ã¯16é€²æ•°è¡¨è¨˜ã§0x16 = 22ã€‚ ã“ã‚Œã¯
khiker 2010/03/01
HTTPS

Security
ãƒªãƒ³ã‚¯
IPA ã‚»ã‚ãƒ¥ã‚¢ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼šC / C++è¨€èªžç·¨
IPAã€€ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ã‚¢ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼šC / C++è¨€èªžç·¨
khiker 2010/01/20
IPA

C

C++

Security

Programming
ãƒªãƒ³ã‚¯
Address space layout randomization - Wikipedia
This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources:Â "Address space layout randomization"Â â€“Â newsÂ Â· newspapersÂ Â· booksÂ Â· scholarÂ Â· JSTOR (January 2018) (Learn how and when to remove this message) Address space layout randomization (ASLR) is a computer securi
khiker 2009/12/13
ASLR

Security

Memory

OS
ãƒªãƒ³ã‚¯
1 2 3 æ¬¡ã®ãƒšãƒ¼ã‚¸