[B! è„†å¼±æ€§] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

è„†å¼±æ€§ã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (27)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : XSSã®è„†å¼±æ€§ã«ã¤ã„ã¦ã®ã‚³ãƒ¡ãƒ³ãƒˆ
XSSã®è„†å¼±æ€§ã«ã¤ã„ã¦ã®ã‚³ãƒ¡ãƒ³ãƒˆ 2010å¹´06æœˆ23æ—¥17:05 ãƒ„ã‚¤ãƒ¼ãƒˆ masanori_katayama ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ã‚³ãƒ¡ãƒ³ãƒˆÂ byï¼šç‰‡å±± æ˜Œæ†² ã‚µã‚¤ãƒˆé‹å–¶è€…ã®è¦–ç‚¹ã§XSSã®è„†å¼±æ€§ã«ã¤ã„ã¦ã‚³ãƒ¡ãƒ³ãƒˆã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ã“ã®livedoorãƒ–ãƒã‚°ã ã‘ã§ãªãã€ã‚¨ã‚ã‚µã‚¤ãƒˆã§ã‚‚XSSã®è„†å¼±æ€§ã¯éŽåŽ»ã«ã‚ã‚Šã¾ã—ãŸã€‚ã§ã¯ã€ã©ã®ã‚ˆã†ã«ã—ã¦XSSã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã¦ã„ã‚‹ã‹ï¼Ÿã¨è¨€ã„ã¾ã™ã¨ã€è„†å¼±æ€§ã®ãƒ†ã‚¹ãƒˆã‚’å¤–éƒ¨æ©Ÿé–¢ã«ãŠé¡˜ã„ã—ã¦ç™ºè¦‹ã—ã¦ã„ã¾ã™ã€‚ã‚‚ã¡ã‚ã‚“ã€ç¤¾å†…ã§ã‚‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«å¯¾ã™ã‚‹çŸ¥è¦‹ãŒã‚ã‚‹äººæãŒãŠã‚Šã€è„†å¼±æ€§ã«ã¤ã„ã¦ã¯ãƒ†ã‚¹ãƒˆã—ã¦ã„ã¾ã™ãŒã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒ—ãƒã§ãªã‘ã‚Œã°ç™ºè¦‹ã§ããªã„è„†å¼±æ€§ãŒã‚ã‚‹ã¨ã„ã†äº‹ã§ã™ã€‚ã“ã®è„†å¼±æ€§ã®ç™ºè¦‹å¾Œã®å¯¾å¿œã¯ã€ã‚‚ã¡ã‚ã‚“é–‹ç™ºã—ãŸã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒå¯¾å¿œã—ã¦ãŠã‚Šã€åŒã˜ã‚ˆã†ãªå•é¡ŒãŒ2åº¦ã¨ç™ºç”Ÿã—ãªã„ã‚ˆã†ã«ã—ã¦ã„ã¾ã™ã€‚ã“ã“ã§ã€é‡è¦ãªè¦ç´ ã¯ä»¥ä¸‹ã®ã¨ãŠã‚Šã§ã™ã€‚ ãƒ»WEBã‚µã‚¤ãƒˆã®é–‹ç™ºè€…ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ockeghem 2010/06/24
ã€Žç§ã¨ã—ã¦ã¯ã€é–‹ç™ºè€…ã®ãƒ†ã‚¹ãƒˆä¸è¶³ã‚‚ã‚ã‚‹ã‚ˆã†ã«æ€ãˆã¾ã™ã€<å¾¡æ„ã€‚ãã“ã§ã‚¦ã‚§ãƒ–å¥åº·è¨ºæ–ä»•æ§˜ã§ã™ã‚ˆâ€¦ã¨è¨€ã„ãŸã„ã¨ã“ã‚ã ã‘ã©ã€ãƒ–ãƒã‚°ã‚·ã‚¹ãƒ†ãƒ ã®XSSãƒ†ã‚¹ãƒˆã¯é›£ã—ã„ã‹ã‚‚

è„†å¼±æ€§

security

test
ãƒªãƒ³ã‚¯
ç„¡æ–™ãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ CGIã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰
ãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ CGIã¯Webãƒšãƒ¼ã‚¸ã®ãƒ•ã‚©ãƒ¼ãƒ ã«å…¥åŠ›ã•ã‚ŒãŸå†…å®¹ã‚’ãƒ¡ãƒ¼ãƒ«ã§é€šçŸ¥ã™ã‚‹Perlã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ã™ã€‚ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ï¼ˆGPLv2ï¼‰ã§ã™ã®ã§ç„¡æ–™ã§è‡ªç”±ã«ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã—ã¦åˆ©ç”¨ã§ãã¾ã™ã€‚ãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ CGIã¯ã€Webãƒšãƒ¼ã‚¸ã®ãƒ•ã‚©ãƒ¼ãƒ ã«å…¥åŠ›ã•ã‚ŒãŸå†…å®¹ã‚’ãƒ¡ãƒ¼ãƒ«ã§é€šçŸ¥ã™ã‚‹Perlã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ã™ã€‚ ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ï¼ˆGPLv2ï¼‰ã§ã™ã®ã§ç„¡æ–™ã§è‡ªç”±ã«ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã—ã¦åˆ©ç”¨ã§ãã¾ã™ã€‚ è¨ç½®æ‰‹é † ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã¸ã®ãƒ¡ãƒ¼ãƒ«ãƒ•ã‚©ãƒ¼ãƒ ã®è¿½åŠ ã¯ã€CGIãŒåˆ©ç”¨ã§ãã‚‹ã‚µãƒ¼ãƒãƒ¼ã§ã‚ã‚Œã°ã€æ¬¡ã®ã‚ˆã†ãªæ‰‹é †ã§ç°¡å˜ã«ã§ãã¾ã™ã€‚ 1. mailform.cgi ã®å…ˆé ã®ä»¥ä¸‹ã®éƒ¨åˆ†ã‚’ã‚µãƒ¼ãƒãƒ¼ãªã©ã®åˆ©ç”¨ç’°å¢ƒã«ã‚ã‚ã›ã¦å¤‰æ›´ã—ã¾ã™ã€‚ my $webmaster_em ail = 'webmaster@59log.com'; # Webmaster's E-mail address my $sendmail_path = '
ockeghem 2010/05/27
cgi

mail

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
EmPro.pdf - æƒ…å ±æ¼æ´©ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›ãŠã‚ˆã²ã‚™ä»Šå¾Œã®å¯¾ç–ã«ã¤ã„ã¦
å¤‰åŒ–ã®ä¸ã§ã®å–¶æ¥åŠ›ã®æœ¬è³ªçš„ãªå¼·åŒ–ã«å‘ã‘ã¦ AIã®æ´»ç”¨ã‚„å–¶æ¥æ©Ÿèƒ½ã®å½¹å‰²åˆ†åŒ–ã«ã‚ˆã£ã¦ã€å–¶æ¥çµ„ç¹”ã‚’å–ã‚Šå·»ãç’°å¢ƒãŒå¤‰åŒ–ã—ç¶šã‘ã‚‹ä»Šã€æˆæžœã«ã¤ãªã’ã‚‹ãŸã‚ã®å–¶æ¥åŠ›ã¯ã€å¾“æ¥ã®ã‚¹ã‚ãƒ«ç ”ä¿®ã ã‘ã§èº«ã«ã¤ãã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€å¤‰åŒ–ã™ã‚‹ç’°å¢ƒã«é©å¿œã—ãŸå–¶æ¥èƒ½åŠ›ã¨ã¯ï¼Ÿã€€ãã®æ™‚ãƒžãƒã‚¸ãƒ£ãƒ¼ã«æ±‚ã‚ã‚‰ã‚Œã‚‹å½¹å‰²ã¨ã¯ï¼Ÿ ã‚¦ã‚£ãƒ«ã‚½ãƒ³ãƒ»ãƒ©ãƒ¼ãƒ‹ãƒ³ã‚°ã¯ã€å¤‰åŒ–ã«é©å¿œã§ãã‚‹å–¶æ¥ãƒ»å–¶æ¥çµ„ç¹”ã®èƒ½åŠ›é–‹ç™ºã«ç„¦ç‚¹ã‚’å½“ã¦ã€é–¢é€£ã™ã‚‹ã•ã¾ã–ã¾ãªè¦ç´ ã‚’ã€Œè¦‹ãˆã‚‹åŒ–ã€ã—ã€å–¶æ¥çµ„ç¹”ã®ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹å‘ä¸Šã‚’ãŠæ‰‹ä¼ã„ã—ã¾ã™ã€‚ å–¶æ¥åŠ›å¼·åŒ– ãƒ¡ãƒ³ãƒãƒ¼ã®å¯èƒ½æ€§ã¨è‡ªç™ºæ€§ã‚’é«˜ã‚ã‚‹ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚’ ä»Šã€ç®¡ç†è·ã«ã¯ã€ãƒ“ã‚¸ãƒã‚¹ã‚’æ£ã—ãåŠ¹çŽ‡çš„ã«ç®¡ç†ã™ã‚‹ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã¨åŒæ™‚ã«ã€ä¾¡å€¤å‰µé€ ã¨å¤‰é©ã‚’ãƒªãƒ¼ãƒ‰ã™ã‚‹æ–°ã—ã„ã‚¹ã‚¿ã‚¤ãƒ«ã®ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆãŒæ±‚ã‚ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ãã®æœ€å…ˆç«¯ã¨ã‚‚è¨€ã†ã¹ãã€Œæ–°è¦äº‹æ¥å‰µé€ ã€ã®åˆ†é‡Žã«ãŠã‘ã‚‹å®Ÿè·µç ”ç©¶ã‹ã‚‰ã€ä¾¡å€¤å‰µé€ ã®æŒ‘æˆ¦ã‚’æ”¯æ´ã™ã‚‹ã€Œã‚¤ãƒãƒ¼ãƒ–ãƒ«ãƒ¡ãƒ³ãƒˆã€ã¨ã„ã†è€ƒãˆæ–¹ãŒç”Ÿã¾ã‚Œã¾ã—ãŸã€‚ã‚ã‚‰ã‚†ã‚‹ãƒªãƒ¼ãƒ€
ockeghem 2010/05/26
ã‚±ãƒ¼ã‚¿ã‚¤ã‚µã‚¤ãƒˆã®ã‚»ãƒƒã‚·ãƒ§ãƒ³IDä»˜ã®URLã‚’å…¬é–‹ã—ã¦ã—ã¾ã†ã¨ã„ã†ã®ã‚‚ã‚ã‚Šã¾ã™ã‚ˆãã€‚ãƒ‰ã‚³ãƒ¢ã•ã‚“ãŒCookieã‚’æ—©æœŸã«ã‚µãƒãƒ¼ãƒˆã—ã¦ãã‚Œã¦ã„ãŸã‚‰â€¦

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
æ›¸ç±ã€Œã¯ã˜ã‚ã¦ã®PHPãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°åŸºæœ¬ç·¨5.3å¯¾å¿œã€ã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ - å¾³ä¸¸æµ©ã®æ—¥è¨˜(2008-10-29)
id:hasegawayosukeæ°ã«ããã®ã‹ã•ã‚Œã‚‹ã‚ˆã†ãªæ ¼å¥½ã§ã€ã€Œã¯ã˜ã‚ã¦ã®PHPãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°åŸºæœ¬ç·¨5.3å¯¾å¿œã€ã¨ã„ã†æ›¸ç±ã‚’è³¼å…¥ã—ãŸã€‚ æœ¬æ›¸ã¯ã€ã‚¦ãƒŽã‚¦æ ªå¼ä¼šç¤¾ã®ä¸‹å²¡ç§€å¹¸æ°ã€ä¸æ‘æ‚Ÿæ°ã®å…±è‘—ãªã®ã§ã€ç¾å½¹ãƒãƒªãƒãƒªã®PHPé–‹ç™ºè€…ãŒåŸ·ç†ã—ã¦ã„ã‚‹ã¨ã„ã†ã“ã¨ã€ä¸‹è¨˜ã®ã‚ˆã†ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ã“ã¨ã‚‚å°‘ã—ã¯è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã‚‰ã—ã„ã¨ã„ã†æœŸå¾…ã‹ã‚‰è³¼å…¥ã—ãŸã‚‚ã®ã ã€‚ ç›®æ¬¡ã‹ã‚‰æŠœç²‹å¼•ç”¨ 07-07 Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ [ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] 08-04 ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ [SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³] 09-13 ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– [ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] æœ¬æ›¸ã‚’ã–ã£ã¨çœºã‚ãŸå°è±¡ã¯ã€ã€Œã‚†ã‚‹ã„ãªãã€ã¨ã„ã†ã‚‚ã®ã§ã‚ã‚‹ãŒã€ãã®ã€Œã‚†ã‚‹ã•ã€ã®ã‚†ãˆã‚“ã¯ãŠã„ãŠã„å ±å‘Šã™ã‚‹ã¨ã—ã¦ã€ãã®çµŒéŽã§è‡´å‘½çš„ãªè„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸã®ã§å ±å‘Šã™ã‚‹ã€‚ å•é¡Œã®å ±å‘Š ãã‚Œã¯ã€æœ¬æ›¸P280ã«ç™»å ´ã™ã‚‹ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ç”¨ã®é–¢æ•°(dbescape)ã€
ockeghem 2008/10/29
åŒæ›¸ã®é–¢æ•°dbescapeã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§

security

php

è„†å¼±æ€§

book

ã‚»ãƒ«ã‚¯ãƒž
ãƒªãƒ³ã‚¯
http://www.nttv6.net/files/DKA-20080723.pdf
DNS DNS Cache Poisoningã®æ¦‚è¦ã¨å¯¾å‡¦ (Dan Kaminskyã«ã‚ˆã‚‹DNSè„†å¼±æ€§æŒ‡æ‘˜ã«é–¢ã—ã¦) 23rd Jul 2008 Updated 19th Aug 2008 NTTæƒ…å ±æµé€šãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ç ”ç©¶æ‰€ è±Šé‡Ž å‰› toyono@ntt v6.net Information Sharing Platform Labs. NTT 1 ã¯ã˜ã‚ã« ã¯ã˜ã‚ã« â€¢ ã“ã®æ–‡æ›¸ã®ç›®çš„ â€“ 2008å¹´7æœˆ22æ—¥ã«æ¼æ´©ï¼Œ8æœˆ7æ—¥ã«å…¬é–‹ã•ã‚ŒãŸDNSè„† å¼±æ€§æ”»æ’ƒæ‰‹æ³•ã«é–¢ã—ã¦æ¦‚ç•¥çš„ã«è¿°ã¹ãŸã‚‚ã®ã§ã™ â€¢ å•é¡Œç‚¹ã¨å½±éŸ¿åº¦ â€¢ å¯¾å‡¦æ–¹æ³• â€“ æ”»æ’ƒæ‰‹æ³•ã«é–¢ã—ã¦ã¯èª¬æ˜Žã—ã¦ã„ã¾ã›ã‚“ â€“ BlackHat2008ã®è³‡æ–™ãŒå…¬é–‹ã•ã‚ŒãŸãŸã‚é™„è¨˜ (8/7) â€¢ å¤šãã®Webã‚µã‚¤ãƒˆä¸Šã§æŠ€è¡“çš„ãªè§£èª¬ãŒã•ã‚Œã¦ã„ã¾ã™ â€¢ å„ç¨®ã®æ”»æ’ƒãƒ„ãƒ¼ãƒ«ãŒå‡ºå›žã£ã¦ã„ã¾ã™ Information Sharing Platfor
ockeghem 2008/07/24
security

dns

cache poisoning

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ç¬¬3å›žã€€ã‚µãƒ¼ãƒãƒ¼ãƒ»ã‚½ãƒ•ãƒˆã®ãœã„å¼±æ€§ã‚’ãªãã™
å‰å›žã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰æ”»æ’ƒã¸ã®å¯¾ç–ã«ã¤ã„ã¦èª¬æ˜Žã—ãŸãŒï¼Œä»Šå›žã¯ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ãœã„å¼±æ€§å¯¾ç–ã«ã¤ã„ã¦èª¬æ˜Žã™ã‚‹ã€‚ ITproã®è¨˜äº‹ã€Œå¤§è¦æ¨¡ãªWebæ”¹ã–ã‚“ãŒå†ã³ï¼Œã€Ž50ä¸‡ã‚µã‚¤ãƒˆãŒè¢«å®³ï¼Œå½å‹•ç”»ã‚µã‚¤ãƒˆã¸èª˜å°Žã€ã€ã«ã‚ˆã‚‹ã¨ï¼ŒphpBBã¨ã„ã†æŽ²ç¤ºæ¿ãƒ—ãƒã‚°ãƒ©ãƒ ã®æ—¢çŸ¥ã®ãœã„å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚Œã¦éžå¸¸ã«å¤šãã®ã‚µã‚¤ãƒˆãŒæ”¹ã–ã‚“ã®è¢«å®³ã‚’å—ã‘ãŸã€‚phpBBã®ã‚ˆã†ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚‚å«ã‚ï¼ŒOSï¼ˆWindowsã‚„UNIXï¼‰ï¼ŒWebã‚µãƒ¼ãƒãƒ¼ãƒ»ã‚½ãƒ•ãƒˆï¼ˆIISï¼ŒApacheãªã©ï¼‰ï¼Œè¨€èªžå‡¦ç†ç³»ã‚„ãƒŸãƒ‰ãƒ«ã‚¦ã‚¨ã‚¢ï¼ˆPHPï¼ŒTomcatãªã©ï¼‰ï¼Œä¸ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒåˆ©ç”¨ã™ã‚‹å•†ç”¨è£½å“ã‚„ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã«ãœã„å¼±æ€§ãŒã‚ã‚Šï¼Œãã‚Œã‚’æ‚ªç”¨ã•ã‚Œã‚‹ã¨ã„ã†æ”»æ’ƒäº‹ä¾‹ã¯å¤šã„ã€‚ phpBBã®å ´åˆã¯æŽ²ç¤ºæ¿ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãœã„å¼±æ€§ã‚’ç‹™ã‚ã‚ŒãŸã‚ã‘ã ãŒï¼ŒphpBBã®è¨˜è¿°ã«ã‚‚åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹è¨€èªžPHPã®ãœã„å¼±æ€§ãŒç‹™ã‚ã‚ŒãŸäº‹ä¾‹ã‚‚å¤šã„ã€‚æ´å²çš„ã«ã¯ï¼Œå€‹åˆ¥ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãœã„å¼±æ€§ã‚ˆã‚Š
ockeghem 2008/07/02
security

è„†å¼±æ€§

ã‚»ãƒ«ã‚¯ãƒž
ãƒªãƒ³ã‚¯
ã“ã‚Œã¯ CSRF ã§ã™ã‹? | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ã¯ï¼Œã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’æ ¼ç´ã—ãŸã‚¯ãƒƒã‚ãƒ¼ã‚’ç™ºè¡Œã™ã‚‹ã‚‚ã®ãŒã‚ã‚‹ã€‚ä¾‹ãˆã°SNSã®ã‚ˆã†ãªä¼šå“¡åˆ¶ã‚µãƒ¼ãƒ“ã‚¹ï¼ŒWebãƒ¡ãƒ¼ãƒ«ï¼Œã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒ»ã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ãªã©ã§ã‚ˆãä½¿ã‚ã‚Œã‚‹ã€‚ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã¯èªè¨¼æ¸ˆã¿ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å¯¾ã—ã¦ç™ºè¡Œã•ã‚Œã‚‹ãŸã‚ï¼Œã“ã‚Œã‚’å¥ªã„å–ã‚‰ã‚Œã‚‹ã¨ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹ãªã‚Šã™ã¾ã—ã‚’è¨±ã—ã¦ã—ã¾ã†ã€‚ã“ã‚Œã‚’ç‹™ã£ã¦ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ°—ä»˜ã‹ãªã„ã†ã¡ã«ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ã€Œä¹—ã£å–ã‚‹ã€ã®ãŒï¼ŒCSRFã®ãœã„å¼±æ€§ã‚’çªãæ”»æ’ƒã§ã‚ã‚‹ã€‚ ãˆãƒ¼ã£ã€‚ã¡ãŒã†ã‚ˆã€å…¨ç„¶ã¡ãŒã†ã‚ˆ! ã“ã®èª¬æ˜Žã¯å˜ãªã‚‹ Cookie å¥ªå–ã«ã‚ˆã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã§ã€CSRF ã§ã¯ãªã„ã¨æ€ã„ã¾ã™ã€‚ã‚€ã—ã‚ã€ŒCookie ã®å¥ªå–ãŒå¿…è¦ãªã„ã€ã¨ã„ã†ã®ãŒ CSRF ã®ãƒã‚¤ãƒ³ãƒˆã ã¨æ€ã„ã¾ã™ã—ã€‚ å›³ã‚‚ã‚„ã‚„å¾®å¦™ã§ã™ãâ€¦â€¦ã€‚å›³ã® 4ç•ªã§ CSRF æ”»æ’ƒã«ã‚ˆã‚‹ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å¤‰æ›´ãŒè¡Œã‚ã‚ŒãŸå¾Œã€5ç•ªã§ã¯ãã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦æ”»æ’ƒè€…ãŒã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯ã“ã‚Œã§é–“é•ã£ã¦ã¯ã„ãªã„ã®ã§
ockeghem 2007/12/18
ç©¶æ¥µã®XSS/CSRFæ··åŒãƒ–ãƒ¼ãƒ ã€çµ¶è³›ç¶™ç¶šä¸ã‹/XSSã¨æ–è¨€ã™ã‚‹ã®ã‚‚èª¤ã‚Šã ãŒ/todo:CSRFã®æ£æ”»æ³•ã®èª¬æ˜Žã‚’æ›¸ã

security

xss

csrf

ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒ

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ä¸€å¤ªéƒŽZero-dayæ”»æ’ƒç™ºè¦šçµŒç·¯ã®è¬Ž â€•â€• éžå›½æ°‘ã¯èª°ï¼Ÿ
â– ä¸€å¤ªéƒŽZero-dayæ”»æ’ƒç™ºè¦šçµŒç·¯ã®è¬Ž â€•â€• éžå›½æ°‘ã¯èª°ï¼Ÿ ç›®æ¬¡ ä¸€å¤ªéƒŽzero-dayæ”»æ’ƒç™ºè¦šçµŒç·¯ã®è¬Ž Symantecã¯è„†å¼±æ€§åˆ†æžã®ãƒ—ãƒã§ã¯ãªã„ æ—¥æœ¬äººSymantecç¤¾å“¡ã¯éžæ—¥æœ¬å›½æ°‘ã‹ éžå›½æ°‘ã¯èª°ï¼Ÿ ã‚¸ãƒ£ã‚¹ãƒˆã‚·ã‚¹ãƒ†ãƒ ç¤¾ã‚‚çµŒæ¸ˆç”£æ¥çœå‘Šç¤ºã‚’ç„¡è¦–ï¼Ÿ ç¾è¡Œã®å±Šå‡ºåˆ¶åº¦ã¯zero-dayæ”»æ’ƒã«å¯¾å¿œã—ã¦ã„ãªã„ ä¸€å¤ªéƒŽzero-dayæ”»æ’ƒç™ºè¦šçµŒç·¯ã®è¬Ž å…ˆé€±ã“ã‚“ãªå ±é“ãŒã‚ã£ãŸã€‚ ä¸€å¤ªéƒŽã®è„†å¼±æ€§ã‚’ç‹™ã†æ–°ãŸãªæ”»æ’ƒã€é›†ä¸çš„ã«ç‹™ã‚ã‚Œã¦ã„ã‚‹ã¨SymantecãŒè¦å‘Š, INTERNET Watch, 2007å¹´12æœˆ14æ—¥ ã¾ãŸã‹ã€‚ ã€Œã¾ãŸä¸€å¤ªéƒŽã‹ã€ã¨ã„ã†æ„å‘³ã§ã¯ãªãã€ã€Œã¾ãŸ Symantec ã‹ã€ã¨ã„ã†æ„å‘³ã§ã ã€‚ ä¸€å¤ªéƒŽé–¢é€£è£½å“ã®ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ç³»ã®è„†å¼±æ€§ã¯ã“ã‚Œã¾ã§ã«8å›žè¦‹ã¤ã‹ã£ã¦ãŠã‚Šã€ã†ã¡3å›žã¯ã€æ”»æ’ƒã«æ‚ªç”¨ã•ã‚Œã‚‹å‰ã«IPAã¨JPCERT/CCã‚’é€šã˜ã¦äº‹å‰ã«ä¿®æ£ã•ã‚ŒãŸã‚‚ã®ï¼ˆJVN#90815371,
ockeghem 2007/12/17
ã€Žã¾ãŸã‹ã€‚ã€Œã¾ãŸä¸€å¤ªéƒŽã‹ã€ã¨ã„ã†æ„å‘³ã§ã¯ãªãã€ã€Œã¾ãŸ Symantec ã‹ã€ã¨ã„ã†æ„å‘³ã§ã ã€

justsystem

security

é«˜æœ¨æµ©å…‰

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
CSRFå¯¾ç–ã‚’è¡Œã„ã¾ã—ãŸ - ã¯ã¦ãªãƒã‚¤ã‚¯æ—¥è¨˜
å…ˆã»ã©ã€ã¯ã¦ãªãƒã‚¤ã‚¯ã§ã®æŠ•ç¨¿æ™‚ã«ã€CSRFå¯¾ç–ã‚’è¿½åŠ ã—ã¾ã—ãŸã€‚ ã“ã®å¯¾ç–ãŒè¡Œã‚ã‚Œã¦ã„ãªã‹ã£ãŸã“ã¨ã§ã€ç‰¹å®šã®URLã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ã‚ã‚‰ã‹ã˜ã‚ç¬¬ä¸‰è€…ãŒç”¨æ„ã—ãŸå†…å®¹ãŒè‡ªå‹•çš„ã«æŠ•ç¨¿ã•ã‚Œã¦ã—ã¾ã†å•é¡ŒãŒã‚ã‚Šã¾ã—ãŸã€‚ ã”æŒ‡æ‘˜ã‚’é ‚ã„ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼æ§˜ã€æœ‰é›£ã†ã”ã–ã„ã¾ã—ãŸã€‚
ockeghem 2007/12/14
ãµã¤ãƒ¼ã«ä½œã‚‹ã¨æ··å…¥ã—ã¡ã‚ƒã†ã‚“ã§ã™ã‚ˆãã€CSRFã€‚ä¿³å¥ã«ã™ã‚‹ã¨ã€ã‚·ãƒ¼ã‚µãƒ¼ãƒ•ã€ãµã¤ãƒ¼ã«ã¤ãã‚Œã°ã€ã“ã‚“ã«ã‚…ã†ã™ã€€ã ã‚ã ãããã

hatena

ç½

csrf

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
JVN#06045169: mod_imap ã«ãŠã‘ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§
Apache HTTP Server ã®ã€Œmod_imapã€ã€Œmod_imagemapã€ã¯ã€ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒžãƒƒãƒ—å‡¦ç†ã‚’è¡Œã†ãŸã‚ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã§ã™ã€‚ mod_imap ã¨ mod_imagemap ã«ã¯ã€HTTP_REFERER ã®å–ã‚Šæ‰±ã„ãŒé©åˆ‡ã§ãªã„ãŸã‚ã«ã€ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒžãƒƒãƒ—ä¸ã®æŒ‡å®šã§ referer ã‚’å€¤ã¨ã—ã¦ä½¿ç”¨ã—ã¦ã„ã‚‹å ´åˆã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚
ockeghem 2007/12/13
ã€Žmod_imap ã¨ mod_imagemap ã«ã¯ã€HTTP_REFERER ã®å–ã‚Šæ‰±ã„ãŒé©åˆ‡ã§ãªã„ãŸã‚ã«ã€ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒžãƒƒãƒ—ä¸ã®æŒ‡å®šã§ referer ã‚’å€¤ã¨ã—ã¦ä½¿ç”¨ã—ã¦ã„ã‚‹å ´åˆã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€

apache

security

jvn

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ãƒ‹ãƒ¥ãƒ¼ã‚¹ã€‘ã€Œï¼ SOLAã‚·ãƒ§ãƒƒãƒ—ã€ã®å€‹äººæƒ…å ±æµå‡ºå•é¡Œã§ä¸¸ç´…ã‚¤ãƒ³ãƒ•ã‚©ãŒèª¿æŸ»å ±å‘Š - ã‚·ã‚¹ãƒ†ãƒ ã‚„é¡§å®¢æƒ…å ±ã¯å»ƒæ£„ã¸ï¼ˆ1ãƒšãƒ¼ã‚¸ç›® / å…¨1ãƒšãƒ¼ã‚¸ï¼‰ï¼šSecurity NEXT
ockeghem 2007/12/12
ã‚„ã¯ã‚ŠSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã ã£ãŸãã†ã§ã™ã€‚ã‚·ã‚¹ãƒ†ãƒ ã‚’å®Œå…¨ã«å»ƒæ£„ã¨ã„ã†ã®ã¯çã—ã„ã§ã™ã>ã€Žã•ã‚‰ã«åŒç¤¾ã¯ã€ä»Šå›žã®èª¿æŸ»çµæžœã®å…¬è¡¨ã¨ã¨ã‚‚ã«åŒã‚·ãƒ§ãƒƒãƒ—ã§åˆ©ç”¨ã—ã¦ã„ãŸã‚·ã‚¹ãƒ†ãƒ ã‚’å®Œå…¨ã«å»ƒæ£„ã™ã‚‹ã“ã¨ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€

sqlã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³

è„†å¼±æ€§

ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹

security
ãƒªãƒ³ã‚¯
twitterã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)è„†å¼±æ€§ãŒã‚ã‚Œã°ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å¤‰æ›´ã§ãã‚‹ - ockeghem's blog
ç§‹ã®DKåŽç©«ç¥ãªã©ã§é¨’ãŒã‚Œã¦ã„ã‚‹ã€ã„ã‚ã‚†ã‚‹DKç¥ã‚Šã€‚ ã•ã™ãŒã®ç§ã‚‚ã€ä»Šå¤œåŠã®ç¥ã‚Šã«ã¯maitterã€‚ ç§ã®twitterãŒè’ã‚‰ã•ã‚Œã¦ã„ãŸã®ã ã€‚ http://blog.livedoor.jp/dankogai/archives/50959103.html ç¾è±¡ã‹ã‚‰è¦‹ã¦ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã•ã‚ŒãŸã¨æ€ã‚ã‚Œã‚‹ãŒã€åŽŸå› ã¨ãªã‚‹è„†å¼±æ€§ãŒå°é£¼å¼¾æ°ã®ä¸»å¼µã©ãŠã‚ŠCSRF(Cross Site Request Forgeries)ã ã£ãŸã®ã‹ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯çªƒå–ã•ã‚ŒãŸã®ã‹ã€å…ƒã€…ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒé¡žæŽ¨ã—ã‚„ã™ã„ã‚‚ã®ã ã£ãŸã®ã‹ãªã©ã€è°è«–ã‚’å‘¼ã‚“ã§ã„ã‚‹ã€‚ ç§ã¯ã€ç¾è±¡ã‹ã‚‰ã¿ã¦ã€åŽŸå› ã¨ãªã‚‹è„†å¼±æ€§ã¯CSRFã§ã¯ãªãã€XSSã ã£ãŸã¨æ€ã†*1ã€‚twitterã«XSSè„†å¼±æ€§ãŒã‚ã‚Œã°ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã«ã‚ˆã‚Šã€ç¬¬ä¸‰è€…ãŒå°é£¼å¼¾æ°ã«ãªã‚Šã™ã¾ã—ã¦ç™ºè¨€ã™ã‚‹ã¨ã“ã‚ã¾ã§ã¯å¯èƒ½ã ã€‚ã—ã‹ã—ã€ä¸€èˆ¬çš„ã«ã¯XSSã§ã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¾ã§ã¯çªƒå–ã§ããªã„ã€‚id:ha
ockeghem 2007/12/01
twitterã«ã”æ³¨æ„ã‚’

ã‚»ãƒ«ã‚¯ãƒž

DKç¥ã‚Š

xss

ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Firefoxã«å±é™ºåº¦ã€Œé«˜ã€ã®è„†å¼±æ€§ã€æœ€æ–°ç‰ˆã«ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’
ä»ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿé–¢FrSIRTã¯11æœˆ26æ—¥ã€Mozilla Foundationã®ã€ŒFirefoxã€ãƒ–ãƒ©ã‚¦ã‚¶ãŠã‚ˆã³ã€ŒSeamonkeyã€ã‚¹ã‚¤ãƒ¼ãƒˆã§3ä»¶ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã¨å ±å‘Šã—ãŸã€‚å±é™ºåº¦ã¯4æ®µéšŽä¸æœ€ã‚‚é«˜ã„ã€ŒCriticalã€ã¨ã—ã¦ã„ã‚‹ã€‚ 1ã¤ç›®ã®è„†å¼±æ€§ã¯ã€ä¸æ£ãªå½¢å¼ã®ãƒ‡ãƒ¼ã‚¿ã‚’å‡¦ç†ã™ã‚‹éš›ã«ãƒ¡ãƒ¢ãƒªç ´æã‚¨ãƒ©ãƒ¼ãŒç”Ÿã˜ã‚‹ã¨ã„ã†ã‚‚ã®ã€‚æ”»æ’ƒè€…ãŒã“ã‚Œã‚’æ‚ªç”¨ã™ã‚‹ã¨ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’ã ã¾ã—ã¦ä¸æ£ãªWebãƒšãƒ¼ã‚¸ã«èª˜å°Žã™ã‚‹ã“ã¨ã§ã€ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã•ã›ãŸã‚Šã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ãŒå¯èƒ½ã«ãªã‚‹ã€‚ 2ã¤ç›®ã®è„†å¼±æ€§ã¯ã€ã€Œwindow.locationã€ãƒ—ãƒãƒ‘ãƒ†ã‚£ã‚’è¨å®šã™ã‚‹éš›ã«ç«¶åˆçŠ¶æ…‹ãŒèµ·ãã‚‹ã“ã¨ãŒåŽŸå› ã€‚ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã™ã‚‹ã¨ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰æ”»æ’ƒã‚’å®Ÿè¡Œã§ãã‚‹ã¨ã„ã†ã€‚ 3ã¤ç›®ã®å•é¡Œã¯ã€ã€Œjar:ã€ã‚’å‡¦ç†ã™ã‚‹éš›ã®ã‚¨ãƒ©ãƒ¼ãŒåŽŸå› ã§èµ·ãã‚‹ã€‚ã“ã®å•é¡Œã‚’çªã‹ã‚Œã‚‹ã¨ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSS
ockeghem 2007/11/27
firefox

è„†å¼±æ€§

security
ãƒªãƒ³ã‚¯
http://www.soldam.co.jp/info/20071013/index.html
ockeghem 2007/10/20
å…¸åž‹çš„ãªåˆ¥äººå•é¡Œã€‚ã€Žã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã§ã¯ãªãã€ã‚·ã‚¹ãƒ†ãƒ ãƒ—ãƒã‚°ãƒ©ãƒ ã®ãƒã‚°ã«ã‚ˆã‚‹ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ä¸Šã®ãŠå®¢æ§˜æƒ…å ±ã®ã™ã‚Šæ›¿ã‚Šã¨ã„ã†è¦å› ã§ã®äº‹æ•…ã¨åˆ¤æ˜Žã„ãŸã—ã¾ã—ãŸã€<ãã‚Œã‚’è¨€ãˆã°åˆ¥äººå•é¡Œã¯çš†ãã†ãªã‚‹

security

åˆ¥äººå•é¡Œ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†

å€‹äººæƒ…å ±

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
IT news, careers, business technology, reviews
Generative AI will drive a foundational shift for companies â€”Â IDC
ockeghem 2007/10/16
security

è‡ªå·±è²¬ä»»

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ãƒ¡ãƒ¢ãƒªã‚’è§£æžã—ã¦è„†å¼±æ€§ã‚’è‡ªå‹•çš„ã«æ¤œå‡ºã€æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’ä½œæˆã™ã‚‹ãƒ„ãƒ¼ãƒ«
(Last Updated On: 2007å¹´8æœˆ10æ—¥)ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ„ãƒ¼ãƒ«ã§æœ‰å(?)ãªImmunityã®DebuggerãŒçµæ§‹è©±é¡Œã«ãªã£ã¦ã„ã‚‹ã€‚ä»–ã«ã‚‚ã„ã‚ã„ã‚ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã§ã™ãŒeWeekã®è¨˜äº‹ãŒåˆ†ã‹ã‚Šã‚„ã™ã„ã€‚ http://www.eweek.com/article2/0,1895,2166829,00.asp Debuggerã¯ãƒ’ãƒ¼ãƒ—ã‚„ã‚¹ã‚¿ãƒƒã‚¯ãƒ¡ãƒ¢ãƒªã‚’è‡ªå‹•çš„ã«è§£æžã—ã¦è„†å¼±æ€§ã‚’æ¤œå‡ºã—ã€ã»ã¼è‡ªå‹•çš„ã«æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’ä½œæˆã™ã‚‹ã“ã¨ã‚‚ã§ãã‚‹ã‚ˆã†ã§ã™ã€‚æ”»æ’ƒã‚³ãƒ¼ãƒ‰ã®ä½œæˆæ™‚é–“ã‚’50%å‰Šæ¸›ã§ãã‚‹ã¨ã—ã¦ã„ã¾ã™ã€‚ http://www.immunitysec.com/products-immdbg.shtml ä¸€æ™‚çš„ã«ã¯0dayæ”»æ’ƒãŒå¢—ãˆã‚‹äº‹ãŒäºˆæƒ³ã•ã‚Œã¾ã™ãŒè„†å¼±æ€§æ¤œæŸ»ãŒå®¹æ˜“ã«ãªã‚‹ã€ç‰¹ã«æ©Ÿæ¢°çš„æ¤œå‡ºã§ãã‚‹ã‚ˆã†ãªè„†å¼±æ€§æ¤œæŸ»ãŒå®¹æ˜“ã«ãªã‚‹ã€ã®ã¯è‰¯ã„äº‹ã ã¨æ€ã„ã¾ã™ã€‚
ockeghem 2007/10/06
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

è„†å¼±æ€§

debug

crack

tool

vulnerability
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªè„†å¼±æ€§ã‚’æ¤œå‡ºã™ã‚‹â€œã‚¨ã‚¯ã‚¹ãƒ—ãƒãƒ¼ãƒ©ãƒ¼â€ ï¼ ï¼ IT
2007/09/26 ãƒ¦ãƒ¼ãƒ“ãƒ¼ã‚»ã‚ãƒ¥ã‚¢ã¯9æœˆ26æ—¥ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ã‚µãƒ¼ãƒåž‹ã®Webã‚¢ãƒ—ãƒªè„†å¼±æ€§æ¤œæŸ»ãƒ„ãƒ¼ãƒ«ã€ŒVEXï¼ˆVulnerability EXplorerï¼‰ã€ã‚’ç™ºè¡¨ã—ãŸã€‚ ã“ã‚Œã¾ã§å¸‚è²©ã•ã‚Œã¦ã„ã‚‹æ¤œæŸ»ãƒ„ãƒ¼ãƒ«ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆPCä¸Šã§å‹•ä½œã™ã‚‹å½¢æ…‹ãŒä¸€èˆ¬çš„ã§ã‚ã£ãŸãŒã€VEXã§ã¯ç‹¬ç«‹ã—ãŸã‚µãƒ¼ãƒä¸Šã§å‹•ä½œã—ã€æ¤œæŸ»çµæžœã‚’1ã‚«æ‰€ã«è“„ç©ã™ã‚‹ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®å“è³ªæƒ…å ±ã‚’é–‹ç™ºãƒãƒ¼ãƒ å†…ã§å…±æœ‰ã§ãã‚‹ã“ã¨ãŒç‰¹å¾´ã ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã¯ã€é–‹ç™ºæ™‚ã«æ„å›³ã›ãšæ··å…¥ã•ã‚Œã‚‹ã“ã¨ãŒå¤šã„ãŸã‚ã€é–‹ç™ºæ®µéšŽã§ç¹°ã‚Šè¿”ã—è„†å¼±æ€§æ¤œæŸ»ã‚’è¡Œã†ã“ã¨ãŒæœ›ã¾ã—ã„ã€‚VEXã¯åŒç¤¾ã‚³ãƒ³ã‚µãƒ«ã‚¿ãƒ³ãƒˆãŒæŒã¤ãƒŽã‚¦ãƒã‚¦ã‚’åŸºã«æ¤œæŸ»ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’ä½œæˆã—ã€æ½œåœ¨ã™ã‚‹è„†å¼±æ€§ã‚’æ¤œæŸ»ã™ã‚‹ã€‚ä¸»ãªæ¤œæŸ»å¯èƒ½é …ç›®ã¨ã—ã¦ã¯SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€ä¸æ£ãªã‚¯ãƒƒã‚ãƒ¼ãªã©ã€æ—¢çŸ¥ã®ä¸€èˆ¬çš„ãªè„†å¼±æ€§ã‚’ã‚«ãƒãƒ¼ã—ã¦ã„ã‚‹ã€‚ ãƒ¬ãƒãƒ¼ãƒˆå‡ºåŠ›æ©Ÿèƒ½ã‚’ç”¨æ„ã—ã¦ã„ã¦ã€æ¤œå‡ºã•ã‚Œ
ockeghem 2007/09/28
è„†å¼±æ€§

æ¤œæŸ»

tool

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security scanner
ãƒªãƒ³ã‚¯
Firefoxã®ã²ã©ã„è„†å¼±æ€§ - ockeghem's blog
id:hasegawayosukeã•ã‚“çµŒç”± Firefoxã¨IEã®ç›¸äº’ä½œç”¨ã§ã¾ãŸæ–°ãŸãªè„†å¼±æ€§ã€ã‚¨ã‚¯ã‚¹ãƒ—ãƒã‚¤ãƒˆã‚‚å…¬é–‹ - ITmedia ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º Mozillaã®Firefoxãƒ–ãƒ©ã‚¦ã‚¶ã¨Microsoftã®Internet Explorerï¼ˆIEï¼‰ã®ç›¸äº’ä½œç”¨ã§ç”Ÿã˜ã‚‹æ·±åˆ»ãªè„†å¼±æ€§ãŒã€ã¾ãŸæ–°ãŸã«å ±å‘Šã•ã‚ŒãŸã€‚FirefoxãŒæ•°æ—¥å‰ã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³2.0.0.5ã§ã¯æœªå¯¾å¿œã€‚IE 7ãŒé–¢ä¸Žã™ã‚‹ã‚¨ã‚¯ã‚¹ãƒ—ãƒã‚¤ãƒˆã‚‚å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã¨ã„ã†ã€‚ ã€ä¸ç•¥ã€‘ US-CERTã«ã‚ˆã‚‹ã¨ã€ã“ã®è„†å¼±æ€§ã¯ã€FirefoxãŒç‰¹å®šã®URIã‚’ãƒ•ã‚£ãƒ«ã‚¿ã«ã‹ã‘ãªã„ã¾ã¾ã€ç™»éŒ²ã•ã‚ŒãŸã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¼•ãæ¸¡ã—ã¦ã—ã¾ã†ã“ã¨ã«èµ·å› ã™ã‚‹ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€ãƒªãƒ¢ãƒ¼ãƒˆã®æ”»æ’ƒè€…ãŒFirefoxã‚’æ”»æ’ƒçµŒè·¯ã¨ã—ã¦ä½¿ã„ã€æ‚ªè³ªãªURIã‚’åˆ©ç”¨ã—ã¦ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ãŒå¯èƒ½ã«ãªã‚‹ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„çµŒç”±ã§ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’å®Ÿ
ockeghem 2007/07/27
ã›ã‚‹ãã¾ã€‚çš†æ§˜ã‚‚æ°—ã‚’ã¤ã‘ã¦ãã ã•ã„ã€‚

firefox

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
[ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£]ç”»åƒã¸ã®PHPã‚³ãƒžãƒ³ãƒ‰æŒ¿å…¥ â€• T.Teradaã®æ—¥è¨˜
ã ã„ã¶æ™‚é–“ãŒãŸã£ã¦ã—ã¾ã„ã¾ã—ãŸãŒã€å¤§åž£ã•ã‚“ã®ä»¥ä¸‹ã®ãƒ–ãƒã‚°ã«ã‚³ãƒ¡ãƒ³ãƒˆã—ãŸã“ã¨ãªã©ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒ¼ãƒ‰ã‚’åŸ‹ã‚è¾¼ã‚€æ”»æ’ƒã¯æ—¢çŸ¥ã®å•é¡Œ â€“ yohgaki's blog ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ç”»åƒã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã«ã¤ã„ã¦ã§ã™ã€‚ æ”»æ’ƒã®æ¦‚è¦ ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«PHPã‚³ãƒžãƒ³ãƒ‰ã‚’æŒ¿å…¥ã™ã‚‹æ”»æ’ƒã¯ã€å¤§ãã2ç¨®é¡žã«åˆ†ã‘ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 1ã¤ã¯ã€ç”»åƒã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰æ©Ÿèƒ½ã‚’æŒã¤ã‚µã‚¤ãƒˆè‡ªèº«ã‚’ç‹™ã†æ”»æ’ƒã§ã™ã€‚PHPã§é–‹ç™ºã•ã‚Œã¦ãŠã‚Šã€ä»»æ„ã®æ‹¡å¼µåã®ãƒ•ã‚¡ã‚¤ãƒ«ã®ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã‚’è¨±ã™ã‚µã‚¤ãƒˆã§ã¯ã€æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚ æ‹¡å¼µåãŒphpãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã«ä»•è¾¼ã¾ã‚ŒãŸPHPã‚³ãƒžãƒ³ãƒ‰ã¯ã€ãã®ãƒ•ã‚¡ã‚¤ãƒ«ã«HTTP/HTTPSã§ã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸéš›ã«å®Ÿè¡Œã•ã‚Œã¾ã™ã€‚æ”»æ’ƒè€…ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€šã˜ã¦ã€ç”»åƒãŒç½®ã‹ã‚Œã‚‹Webã‚µãƒ¼ãƒä¸Šã§ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ã§ãã¾ã™ã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰å¯èƒ½ãªãƒ•
ockeghem 2007/07/17
è¨€ã„ãŸã„ã“ã¨ã¯ã‚³ãƒ¡ãƒ³ãƒˆæ¬„ã«æ›¸ãã¾ã—ãŸ

image

php

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

teracc
ãƒªãƒ³ã‚¯
https://www.jpcert.or.jp/at/2007/at070016.txt
ockeghem 2007/06/29
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

tool
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸