[B! è„†å¼±æ€§] nonsectã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nonsect id:nonsect

è„†å¼±æ€§ã«é–¢ã™ã‚‹nonsectã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

BurpSuiteã®ä½¿ã„æ–¹ â‘¡é€šä¿¡ã®æ›¸ãæ›ãˆç·¨ | æ ªå¼ä¼šç¤¾ãƒ¬ã‚ªãƒ³ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼
ã“ã‚“ã«ã¡ã¯ã€ãƒ’ãƒã‚»ã§ã™ã€‚ ã“ã®è¨˜äº‹ã§ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ã«ä½¿ç”¨ã•ã‚Œã‚‹ãƒãƒ¼ã‚«ãƒ«ãƒ—ãƒã‚ã‚·ãƒ„ãƒ¼ãƒ«ã€ŒBurp Suiteã€ã®åŸºæœ¬çš„ãªä½¿ã„æ–¹ã«ã¤ã„ã¦è¨˜è¼‰ã—ã¾ã™ã€‚ ä»Šå›žã¯ã€HTTPé€šä¿¡ã®æ›¸ãæ›ãˆã«ã¤ã„ã¦è¨˜è¼‰ã—ã¾ã™ã€‚å‰å›ž(BurpSuiteã®ä½¿ã„æ–¹ã€€â‘ åˆæœŸè¨å®šç·¨)ã®è¨˜äº‹ã¯ã“ã¡ã‚‰ã€‚ ä»¥ä¸‹ã®æ–¹ã«å‘ã‘ã¦è¨˜è¼‰ã—ã¦ã„ã¾ã™ã€‚ è„†å¼±æ€§è¨ºæ–ã«èˆˆå‘³ãŒã‚ã‚‹äºº è‡ªåˆ†ã§è‡ªèº«ã®ã‚µã‚¤ãƒˆã‚’ç°¡æ˜“è¨ºæ–ã—ãŸã„äºº Burp Suiteã®åŸºæœ¬çš„ãªä½¿ã„æ–¹ã‚’å¦ã³ãŸã„äºº â€»ãªãŠã€æœ¬è¨˜äº‹ã®å†…å®¹ã‚’è‡ªèº«ã®ç®¡ç†ã™ã‚‹ã‚µã‚¤ãƒˆä»¥å¤–ã§çµ¶å¯¾ã«è¡Œã‚ãªã„ã§ãã ã•ã„ã€‚ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã¨ã¿ãªã•ã‚Œã‚‹å ´åˆãŒã‚ã‚Šã¾ã™ã€‚ ç›®æ¬¡ ã‚„ã‚‰ã‚Œã‚µã‚¤ãƒˆã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã™ã‚‹ ã‚„ã‚‰ã‚Œã‚µã‚¤ãƒˆã‚’ãƒãƒ¼ã‚«ãƒ«ã§å‹•ä½œã•ã›ã‚‹ ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã‚„ã‚‰ã‚Œã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ HTTPé€šä¿¡ã®æ›¸ãæ›ãˆ ã¾ã¨ã‚ ã‚„ã‚‰ã‚Œã‚µã‚¤ãƒˆã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã™ã‚‹ è„†å¼±æ€§è¨ºæ–ã¯ã€è¨ºæ–ã‚’è¨±å¯ã•ã‚ŒãŸã‚µã‚¤ãƒˆã‚‚ã—ãã¯è‡ªèº«ã§ç®¡ç†ã™ã‚‹ã‚µã‚¤ãƒˆä»¥
nonsect 2023/06/08
è„†å¼±æ€§ãƒ†ã‚¹ãƒˆã«ä½¿ãˆãŸã€‚

é–‹ç™º

Windows

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ãƒ‡ãƒãƒƒã‚¬ã‚’åˆ©ç”¨ã—ã¦Webã‚¢ãƒ—ãƒªã®è„†å¼±æ€§ã‚’åˆ†æžã—ã¦ã¿ãŸ - ã¨ã‚ã‚‹è¨ºæ–å“¡ã®å‚™å¿˜éŒ²
11/15ã«é–‹å‚¬ã•ã‚ŒãŸã“ã¡ã‚‰ã®å‹‰å¼·ä¼šã«å‚åŠ ã„ãŸã—ã¾ã—ãŸï¼ ãƒ‡ãƒãƒƒã‚¬ã§WordPress æœ¬ä½“ã‚„ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã®è„†å¼±æ€§ã‚’è¿½ã„ã‹ã‘ã¦ã¿ã‚ˆã† - connpass ã“ã¡ã‚‰ã®å‹‰å¼·ä¼šã¯ã€ã€ŒWordPress æœ¬ä½“ã¨ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã®è„†å¼±æ€§ã‚’ãƒ‡ãƒãƒƒã‚¬ã§è¿½è·¡ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€è„†å¼±æ€§ã®ä¸èº«ã«ã¤ã„ã¦è©³ã—ãè¿½è·¡ã—ã€ç†è§£ã‚’æ·±ã‚ã‚‹ã€ã¨ã„ã†å†…å®¹ã®ã‚‚ã®ã§ã‚ã‚Šã€ãªã‚“ã¨ã‚ã®å¾³ä¸¸æµ©ã•ã‚“ãŒè¬›å¸«ã‚’ã•ã‚Œã¦ã„ã¾ã™ï¼ ç§å€‹äººã¨ã—ã¦ã¯ã€ä»•äº‹ã¨ã„ã†ã‹åŠåˆ†è¶£å‘³ã§ã‚†ã‚‹ã‚†ã‚‹è„†å¼±æ€§ã®æ¤œè¨¼ã‚’ã—ã¦ãŠã‚Šã€ä»Šå›žã®å‹‰å¼·ä¼šã¯ã¾ã•ã«è‡ªåˆ†ã®èˆˆå‘³åˆ†é‡Žã«ãƒ‰ãƒ³ãƒ”ã‚·ãƒ£ãªå†…å®¹ã ã£ãŸã®ã§ã€éžå¸¸ã«æ¥½ã—ã‚“ã§å‚åŠ ã•ã›ã¦ã„ãŸã ãã¾ã—ãŸï½— ç§ã¯ã“ã¡ã‚‰ã®å‹‰å¼·ä¼šã«ãƒ–ãƒã‚°æž ã¨ã—ã¦å‚åŠ ã„ãŸã—ã¾ã—ãŸã®ã§ã€å‹‰å¼·ä¼šã®å†…å®¹ã«ã¤ã„ã¦æœ¬ãƒ–ãƒã‚°ã«ã¦ãƒ¬ãƒãƒ¼ãƒˆã„ãŸã—ã¾ã™ã€‚ åˆ†æžå¯¾è±¡ã®è„†å¼±æ€§ã«ã¤ã„ã¦ ä»Šå›žåˆ†æžã™ã‚‹é¡Œæã¨ãªã£ãŸè„†å¼±æ€§ã¯ä»¥ä¸‹ã®äºŒã¤ã§ã™ã€‚ ãªãŠã€äºŒã¤ã®è„†å¼±æ€§ã¨ã‚‚å¾³ä¸¸ã•ã‚“ãŒè©³ç´°ãªè§£èª¬è¨˜äº‹ã‚’ãƒ–ãƒã‚°ã«ã¦å…¬é–‹ã•ã‚Œã¦ãŠã‚Šã¾ã™
nonsect 2021/09/08
wordpress

php

netbeans

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å®‰å…¨ãªPHPã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹2014
2. å¾³ä¸¸æµ©ã®è‡ªå·±ç´¹ä»‹ â€¢ çµŒæ´ â€“ 1985å¹´äº¬ã‚»ãƒ©æ ªå¼ä¼šç¤¾å…¥ç¤¾ â€“ 1995å¹´äº¬ã‚»ãƒ©ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚·ã‚¹ãƒ†ãƒ æ ªå¼ä¼šç¤¾(KCCS)ã«å‡ºå‘ãƒ»è»¢ç± â€“ 2008å¹´KCCSé€€è·ã€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾è¨ç«‹ â€¢ çµŒé¨“ã—ãŸã“ã¨ â€“ äº¬ã‚»ãƒ©å…¥ç¤¾å½“æ™‚ã¯CADã€è¨ˆç®—å¹¾ä½•å¦ã€æ•°å€¤ã‚·ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãªã©ã‚’æ‹…å½“ â€“ ãã®å¾Œã€ä¼æ¥å‘ã‘ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚½ãƒ•ãƒˆã®ä¼ç”»ãƒ»é–‹ç™ºãƒ»äº‹æ¥åŒ–ã‚’æ‹…å½“ â€“ 1999å¹´ã‹ã‚‰ã€æºå¸¯é›»è©±å‘ã‘ã‚¤ãƒ³ãƒ•ãƒ©ã€ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã®ä¼ç”»ãƒ»é–‹ç™ºã‚’æ‹…å½“ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ç›´é¢ã€ç ”ç©¶ã€ç¤¾å†…å±•é–‹ã€å¯„ç¨¿ãªã©ã‚’é–‹å§‹ â€“ 2004å¹´ã«KCCSç¤¾å†…ãƒ™ãƒ³ãƒãƒ£ãƒ¼ã¨ã—ã¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ¥ã‚’ç«‹ã¡ä¸Šã’ â€¢ ç¾åœ¨ â€“ HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ä»£è¡¨http://www.hash-c.co.jp/ â€“ ç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹éžå¸¸å‹¤ç ”ç©¶å“¡http://www.ipa.go.
nonsect 2015/02/10
php

è„†å¼±æ€§

ã¾ã¨ã‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
yohgaki's blog - ã“ã‚Œã‹ã‚‰ã®ãƒ—ãƒã‚°ãƒ©ãƒ ã®ä½œã‚Šæ–¹ - æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°æ¤œè¨¼ã¯å¿…é ˆ
(Last Updated On: 2016å¹´3æœˆ3æ—¥)æœ€è¿‘PostgreSQLã€MySQLä¸¡æ–¹ã«SJISã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹éš›ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ–¹æ³•ã®å•é¡Œã‚’ä¿®æ£ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ä»¶ã¯å˜ç´”ã«ã€Œãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚·ã‚¹ãƒ†ãƒ ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®è„†å¼±æ€§ãŒã‚ã£ãŸã€ã¨è¨€ã†å•é¡Œã§ã¯ãªãã€Œã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ã‚’å¤‰ãˆã‚‹å¿…è¦æ€§ã€ã‚’æèµ·ã—ãŸå•é¡Œã§ã™ã€‚ å‚è€ƒï¼šã‚»ã‚ãƒ¥ã‚¢ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ â€“ sandboxåŒ– PostgreSQLã€MySQLã®è„†å¼±æ€§ã¯ç‰¹ã«SJISç‰ã€ãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã«\ãŒå«ã¾ã‚Œã‚‹æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒå¤§ããªå½±éŸ¿ã‚’å—ã‘ã¾ã™ãŒã€åŒé¡žã®ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ–¹æ³•ãŒä»–ã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã§ã‚‚å¯èƒ½ã§ã™ã€‚ä¾‹ãˆã°ã€UTF-8ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã¯1æ–‡å—ã‚’æ§‹æˆã™ã‚‹ãƒã‚¤ãƒˆåˆ—ã®æœ€åˆã®ãƒã‚¤ãƒˆã®ä½•ãƒ“ãƒƒãƒˆç›®ã¾ã§ãŒ1ã§ã‚ã‚‹ã‹ã€ã‚’å–å¾—ã—ã¦UTF-8æ–‡å—ã¨ã—ã¦1ãƒã‚¤ãƒˆï½ž6ãƒã‚¤ãƒˆå¿…è¦ãªã®ã‹
nonsect 2014/11/07
php

è„†å¼±æ€§

æ–‡å—ã‚³ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
2008-11-02
ã¡ã‚‡ã£ã¨ä½œæˆã—ãŸWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«è„†å¼±æ€§ãŒã‚ã‚‹ã‹ã‚’ãã¡ã‚“ã¨ãƒã‚§ãƒƒã‚¯ã—ãªã„ã¨ã„ã‘ãªã„ç¾½ç›®ã«ãªã£ãŸã®ã§èª¿ã¹ã¦ã¿ãŸï¼Ž å‡ºæ¥ã‚Œã°ãƒ•ãƒªãƒ¼ã§ï¼Œç„¡ã‘ã‚Œã°æœ‰å„Ÿã§ã‚‚ã„ã„ã®ã§ï¼Žã„ã‚„ï¼Œã‚„ã£ã±ã‚Šãƒ•ãƒªãƒ¼ã§ï¼Žï¼Žï¼Ž èª¿ã¹ã¦å®Ÿéš›ã«ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã‚„ä½¿ã£ã¦ã¿ãŸé †ã«è¼‰ã›ã¦ã¿ã¾ã™ï¼Ž Nessus http://www.nessus.org/nessus/ ãƒ•ãƒªãƒ¼ã§ã¯ä¸€ç•ªä½¿ã„ã‚„ã™ã„ã‚µãƒ¼ãƒè„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ã‹ãªï¼Žæœ‰åã ã—ï¼Ž ã§ã‚‚ã‚µãƒ¼ãƒã®è„†å¼±æ€§è¨ºæ–ã¨ã„ã†ä½ç½®ã¥ã‘ãŒå¼·ã„ MultiInjector released - automatic parallel website Injector / Defacer http://chaptersinwebsecurity.blogspot.com/2008/10/multiinjector-released-automatic.html Pythonã®2.4ä»¥ä¸Šã§å‹•ä½œ Windowsã§ã‚‚ä½¿
nonsect 2014/05/29
è„†å¼±æ€§

ãƒ„ãƒ¼ãƒ«

ã‚µãƒ¼ãƒ

windows

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
ã“ã“ãŒå¤‰ã ã‚ˆã€ã‚°ãƒãƒ¼ãƒãƒ«ã‚¹ã‚¿ãƒ³ãƒ€ãƒ¼ãƒ‰ã®è„†å¼±æ€§å¯¾ç–ï½žå…¥åŠ›å€¤ã®è€ƒãˆæ–¹ï½ž
5. OWASP Top 10 2004 A1: Unvalidated Input A2: Broken Access Control A3: Broken Authentication and Session Management A4: Cross Site Scripting A5: Buffer Overflow A6: Injection Flaws A7: Improper Error Handling A8: Insecure Storage A9: Application Denial of Service A10: Insecure Configuration Management https://www.owasp.org/index.php/Top_10_2004 å‚ç…§ 5 6. PCI DSSã§ã‚‚ 6.5 ã™ã¹ã¦ã® Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã€ŒOpen Web Ap
nonsect 2013/09/13
è„†å¼±æ€§

web

é–‹ç™º

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
OWASP ZAPã§WEBã‚µã‚¤ãƒˆã®è„†å¼±æ€§ã‚’ç°¡æ˜“ãƒã‚§ãƒƒã‚¯ã™ã‚‹æ–¹æ³•ã¾ã¨ã‚ | Lancork
â€»å½“ãƒ–ãƒã‚°ã§ã¯ã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆåºƒå‘Šã‚’åˆ©ç”¨ã—ã¦ã„ã¾ã™ã€‚ ã²ã‚‡ã‚“ãªã“ã¨ã‹ã‚‰WEBã‚µã‚¤ãƒˆã®è„†å¼±æ€§ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹æ©Ÿä¼šãŒã‚ã‚Šã¾ã—ãŸã€‚ ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®è„†å¼±æ€§ãƒã‚§ãƒƒã‚¯ãƒ„ãƒ¼ãƒ«ã€ŒOWASP ZAPã€ã§WEBã‚µã‚¤ãƒˆã®è„†å¼±æ€§ã‚’ç°¡å˜ã«ãƒã‚§ãƒƒã‚¯ã—ã¦ã¿ãŸãŸã‚ã€ãã®æ–¹æ³•ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã™ã€‚ 1.OWASP ZAPã¨ã¯ï¼Ÿ OWASP(Open Web Application Security Project)ãŒæä¾›ã—ã¦ã„ã‚‹ã€WEBã‚µã‚¤ãƒˆã®è„†å¼±æ€§ã‚’è¨ºæ–ã™ã‚‹ãŸã‚ã®ãºãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ãƒˆãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã§ã€ç„¡æ–™ã§ä½¿ç”¨ã§ãã¾ã™ã€‚ è¨ºæ–å¯èƒ½ãªè„†å¼±æ€§ã®ä»£è¡¨çš„ãªä¾‹ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(åå°„åž‹) SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ CRLF ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚¿ãƒ³ãƒ‘ãƒªãƒ³ã‚° ãƒ‘ã‚¹ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ« 2.OWASP ZAPã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«(Windows) 2-1.ä¸‹è¨˜ãƒšãƒ¼ã‚¸ä¸å¤®ã®ã€ŒDownload ZAPã€ã‚ˆã‚Šã€ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãƒšãƒ¼ã‚¸
nonsect 2013/09/11
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

ãƒ„ãƒ¼ãƒ«
ãƒªãƒ³ã‚¯
1