[B! was] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

wasã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (47)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Tech Venture Plus
ockeghem 2009/09/15
service

security

was
ãƒªãƒ³ã‚¯
è„†å¼±Webã‚¢ãƒ—ãƒªã®ãƒ†ã‚¹ãƒˆç’°å¢ƒ â€” (n)
life is penetration. geeks cheer. geeks be ambitious.ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã¿ã‚‹ã¨ã‚ˆãã¾ã¨ã¾ã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã‚’è¦‹ã‹ã‘ãŸã®ã§æ‹å€Ÿã—ã¦ã€è‡ªåˆ†ç”¨ã«ãƒ¡ãƒ¢ã€‚ ã“ã†ã—ã¦è¦‹ã‚‹ã¨çµæ§‹ã‚ã‚‹ã‚‚ã®ã§ã™ãã€‚ã¾ã ã¾ã ã€ä¸–ã®ä¸ã§ã¯ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®æ³¨æ„å–šèµ·ã€ã¨ã„ã†è¨€è‘‰ã‚’ã¡ã‚‡ãã¡ã‚‡ãç›®ã«ã—ã¾ã™ã€‚Webç³»ã®æ”»æ’ƒã¯ã€æ¯”è¼ƒçš„æ‰‹æ³•ãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹å°è±¡ã‚’å—ã‘ã¾ã™ã®ã§ã€å®ˆã‚‹ç«‹å ´ã®æ–¹ã‚‚ãŠå¥½ã¿ã®ã‚‚ã®ã‚’ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã—ã¦ã€èª¿ã¹ãªãŒã‚‰æ‰‹å…ƒã§è©¦ã—ã¦ã¿ã¦ã¯ã„ã‹ãŒã§ã—ã‚‡ã†ã‹ã€‚ å®ˆã‚‹ã ã‘ã§ã¯ãªãæ”»ã‚ã‚‹ã“ã¨ã§ã¾ãŸã€é•ã£ãŸè¦–ç‚¹ã‚’æŒã¦ã‚‹ã“ã¨ãŒã§ãã€å®ˆã‚‹åŠ›ã«ç£¨ããŒã‹ã‹ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãã€‚ ãƒ»Moth ã‚µã‚¤ãƒˆ: http://www.bonsai-sec.com/en/research/moth.php ç’°å¢ƒ: Linux VMWare image ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«: VMä¸Šã§å†ç”Ÿ ãƒ»Mutilli
ockeghem 2009/09/14
security

was
ãƒªãƒ³ã‚¯
Qualysï¼ŒWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãœã„å¼±æ€§ã‚’æ¤œå‡ºã™ã‚‹SaaSè£½å“ãªã©ã‚’ç™ºè¡¨
ç±³Qualysã¯ç±³å›½æ™‚é–“2009å¹´4æœˆ20æ—¥ï¼Œç±³ã‚«ãƒªãƒ•ã‚©ãƒ«ãƒ‹ã‚¢å·žã‚µãƒ³ãƒ•ãƒ©ãƒ³ã‚·ã‚¹ã‚³ã§é–‹å‚¬ä¸ã®ã€ŒRSA Conferenceã€ã«ãŠã„ã¦ï¼ŒWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãœã„å¼±æ€§ã‚’æ¤œå‡ºã™ã‚‹ã€ŒQualysGuard Web Application Scanningï¼ˆWASï¼‰1.0ã€ãªã©ã®æ–°è£½å“ã‚’ç™ºè¡¨ã—ãŸã€‚ QualysGuard WASã¯ï¼ŒåŒç¤¾ãŒSaaSï¼ˆã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ãƒ»ã‚¢ã‚ºãƒ»ã‚¢ãƒ»ã‚µãƒ¼ãƒ“ã‚¹ï¼‰å½¢å¼ã§æä¾›ã™ã‚‹ã€ŒQualysGuard Security and Compliance Suiteã€ã®ä¸€éƒ¨ã¨ã—ã¦åˆ©ç”¨å¯èƒ½ã¨ãªã‚‹ã€‚ã‚«ã‚¹ã‚¿ãƒ ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’è‡ªå‹•çš„ã«ã‚¹ã‚ãƒ£ãƒ³ã—ã¦ãƒ†ã‚¹ãƒˆã‚’è¡Œã„ï¼ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã„ã£ãŸãœã„å¼±æ€§ã‚’æ¤œå‡ºã™ã‚‹ã€‚ç¤¾å†…å¤–ã§ç¨¼åƒä¸ã¾ãŸã¯é–‹ç™ºç’°å¢ƒã«ã‚ã‚‹è¤‡æ•°ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¯¾å¿œã§ãï¼ŒQualysGuardã®UIã‚’ä½¿ã£ã¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ç®¡ç†ã‚„ã‚¹ã‚ãƒ£
ockeghem 2009/04/21
security

was

tool

Scanner
ãƒªãƒ³ã‚¯
ç¤¾å†…å‹‰å¼·ä¼š - PHPã«ã‚ˆã‚‹webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€ - Kwappaé–‹ç™ºå®¤
CUI ãª Git ãƒ–ãƒ©ã‚¦ã‚¶ tig ã‚’å…¥ã‚Œã¦ã¿ãŸ (Born Too Late) [git][scm][tig] tig ã‚’ä½¿ã£ã¦ã¿ãŸ (do_akiã®å¾’ç„¶æƒ³è¨˜) Twitter Trackbacks () ã¨ã¹ã¨ã¹å¤ç¥ã‚Š2010é›»è¨éƒ¨ã«å‚åŠ ã—ãŸ #tobesetu (key-cc) EC-CUBE LC_Page::sendRedirect()ã«å¼•æ•°ã‚’æ¸¡ã›ãªã„ (å¼±å°PHPerã®æ†‚é¬±) [densetu][å‹‰å¼·ä¼š][å¦æ ¡]é›»è¨éƒ¨ITå‹‰å¼·ä¼š#3ã‚„ã‚Šã¾ã™ãŸï¼ˆéšæ™‚è¿½è¨˜ (å¦å†…ITå‹‰å¼·ä¼šã®ã‚¹ã‚¹ãƒ¡ - atcorp) é›»è¨éƒ¨ITå‹‰å¼·ä¼š#3ã«å‚åŠ ã—ãŸã£ï¼ (Curious) GLT #24 ï¼ˆæ‡‡è¦ªä¼šï¼‰ã«ä¹±å…¥ã—ã¦ããŸï¼ (Curious) GLT (Genesis Lightning Talks) Vol.24ã«å‚åŠ ã—ã¾ã—ãŸ (key-cc) GLT (Genesis Lightning Talks
ockeghem 2009/02/19
ã‚¹ãƒ©ã‚¤ãƒ‰æ‹è¦‹ã€‚MySQLã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã¯mysql_real_escape_stringã‚’ä½¿ã†ã¹ãã€ãªã©ã€ã¡ã‚‡ã£ã¨å¾®å¦™ãªéƒ¨åˆ†ãŒã‚ã‚Šãã†ã§ã™ã

security

was

php
ãƒªãƒ³ã‚¯
Cookie Monsterã£ã½ã„... - Wassr [ãŠæ°—è»½ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãƒ³ã‚°ãƒãƒ–ãƒ»ãƒ¯ãƒƒã‚µãƒ¼]
USER CHANNEL PHOTO TRAVEL Cookie Monsterã£ã½ã„ by ockeghem at 2009-01-29(Thu) 16:45:11 via web ãƒ¬ã‚¹ ãƒ¬ã‚¹æŠ•ç¨¿ ãƒ¬ã‚¹æŠ•ç¨¿ã‚’è¡Œã†ã«ã¯ã¾ãšãƒã‚°ã‚¤ãƒ³ã—ã¦ãã ã•ã„ã€‚ æ–°è¦ç™»éŒ²ã¯ã“ã¡ã‚‰ã‹ã‚‰ï¼
ockeghem 2009/01/29
Yes. Safari3.2.1(525.27.1)

security

was

cookie
ãƒªãƒ³ã‚¯
Web Application Scanners Comparison
ockeghem 2009/01/28
ã€ŽAfter the evaluation, I've radically changed my opinion: AppScan scored worst in almost all the cases.ã€

security

was

scanner
ãƒªãƒ³ã‚¯
ã‚¨ãƒ©ãƒ¼ã€€Proactive Defense
ockeghem 2008/10/01
ã€Žãƒ¬ãƒ™ãƒ«3/â– æ ¹æœ¬çš„ãªæ”»æ’ƒã®å¯¾ç–/ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¸ã®æ”»æ’ƒã«å¯¾ã™ã‚‹æ ¹æœ¬çš„ãªå¯¾ç–ãŒæ–½ã•ã‚Œã¦ã„ã‚‹ã€<ã©ã†ã„ã†åˆ©ç”¨ã‚’æƒ³å®šã—ãŸãƒã‚§ãƒƒã‚¯ã‚·ãƒ¼ãƒˆãªã®ãªãã€‚ä½•ã‚’ã‚‚ã£ã¦æ ¹æœ¬å¯¾ç–ã¨ã™ã‚‹ã‹ãŒå•é¡Œã§ã¯?

security

was

guideline
ãƒªãƒ³ã‚¯
WAS Forum Conference 2008ã«å‚åŠ ã™ã‚‹ - Kwappaé–‹ç™ºå®¤
CUI ãª Git ãƒ–ãƒ©ã‚¦ã‚¶ tig ã‚’å…¥ã‚Œã¦ã¿ãŸ (Born Too Late) [git][scm][tig] tig ã‚’ä½¿ã£ã¦ã¿ãŸ (do_akiã®å¾’ç„¶æƒ³è¨˜) Twitter Trackbacks () ã¨ã¹ã¨ã¹å¤ç¥ã‚Š2010é›»è¨éƒ¨ã«å‚åŠ ã—ãŸ #tobesetu (key-cc) EC-CUBE LC_Page::sendRedirect()ã«å¼•æ•°ã‚’æ¸¡ã›ãªã„ (å¼±å°PHPerã®æ†‚é¬±) [densetu][å‹‰å¼·ä¼š][å¦æ ¡]é›»è¨éƒ¨ITå‹‰å¼·ä¼š#3ã‚„ã‚Šã¾ã™ãŸï¼ˆéšæ™‚è¿½è¨˜ (å¦å†…ITå‹‰å¼·ä¼šã®ã‚¹ã‚¹ãƒ¡ - atcorp) é›»è¨éƒ¨ITå‹‰å¼·ä¼š#3ã«å‚åŠ ã—ãŸã£ï¼ (Curious) GLT #24 ï¼ˆæ‡‡è¦ªä¼šï¼‰ã«ä¹±å…¥ã—ã¦ããŸï¼ (Curious) GLT (Genesis Lightning Talks) Vol.24ã«å‚åŠ ã—ã¾ã—ãŸ (key-cc) GLT (Genesis Lightning Talks
ockeghem 2008/07/07
æ‰‹éš›ã‚ˆãã¾ã¨ã‚ã¦ã„ãŸã ãã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ï¼žï¼œ

wasf2008

was

security
ãƒªãƒ³ã‚¯
IPA ã‚»ã‚ãƒ¥ã‚¢ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§
IPAã€€ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ã‚¢ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼šWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ç·¨ & C / C++è¨€èªžç·¨
ockeghem 2008/06/25
security

ipa

was
ãƒªãƒ³ã‚¯
Webã‚¢ã‚¿ãƒƒã‚¯ãƒ†ã‚¹ãƒˆ
ã‚¤ã‚¨ãƒãƒ¼ ãƒžã‚¼ãƒ³ã‚¿ ã‚·ã‚¢ãƒ³ ãƒ–ãƒ©ãƒƒã‚¯ FIP 2008/08 C M Y CM MY CY CMY K C M Y CM MY CY CMY K Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ã‚µãƒ¼ãƒ“ã‚¹ Webã‚¢ã‚¿ãƒƒã‚¯ãƒ†ã‚¹ãƒˆ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«æ½œã‚€è„…å¨ã‚’å®šæœŸçš„ã«ãƒã‚§ãƒƒã‚¯ ï¼ è¿‘å¹´ã®Webã‚µã‚¤ ãƒˆæ”¹ã–ã‚“ã‚„æƒ…å ±æ¼ãˆã„ç‰ã®äº‹ä»¶ã¯ã€ ç‹¬è‡ªé–‹ç™ºã—ãŸWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’ç‹™ã£ãŸæ”»æ’ƒ ã«ã‚ˆã‚‹ã‚‚ã®ãŒå¢—ãˆã¦ã„ã¾ã™ã€‚ ã“ã‚Œã«ã¯ã€ ã¾ãšWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«æ½œã‚€è„†å¼±æ€§ã®æœ‰ç„¡ã‚’ç¢ºèªã—ã€ å¿…è¦ãªå¯¾ç–ã‚’ è¬›ã˜ã‚‹ã“ã¨ãŒå¤§åˆ‡ã§ã™ã€‚ ã€ŒWebã‚¢ã‚¿ ãƒƒã‚¯ãƒ†ã‚¹ ãƒˆã€ ã¯ã€ Webã‚µãƒ¼ãƒã«ã¦å‹•ä½œã™ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚· ãƒ§ ãƒ³ã«å¯¾ã—ã€ è„†å¼±æ€§æ¤œæŸ»ãƒ„ãƒ¼ãƒ« ã€ŒWebInspectï¼Š ã€ ã‚’ ç”¨ã„ã¦æ¤œæŸ»ã—ã€ æ¤œå‡ºã•ã‚ŒãŸå•é¡Œç‚¹ã¨å¯¾ç–æ–¹æ³•ã«ã¤ã„ã¦ã®ãƒ¬ãƒãƒ¼ ãƒˆã‚’ã”æä¾›ã„ãŸã—ã¾ã™ã€‚ ï¼ŠWebInspect ï¼š ãƒ’ãƒ¥ãƒ¼ãƒ¬ãƒƒ ãƒˆ ãƒ» ãƒ‘ãƒƒã‚«ãƒ¼ãƒ‰ç¤¾æä¾›ã®
ockeghem 2008/06/24
ãƒ„ãƒ¼ãƒ«(WebInspect)ã®ã¿ã®æ¤œæŸ»ã§ãƒšãƒ¼ã‚¸å˜ä¾¡31,500å††ã€‚æ‰‹æ¤œæŸ»ã§ã“ã‚Œã«è¿‘ã„ä¾¡æ ¼ã§ã‚„ã£ã¦ã„ã‚‹ã¨ã“ã‚ã‚‚ã‚ã‚‹ã®ã§ã€ãƒ„ãƒ¼ãƒ«ã ã‹ã‚‰å®‰ã„ã¨ã‚‚ã„ãˆãªã„

security

was

è„†å¼±æ€§è¨ºæ–
ãƒªãƒ³ã‚¯
ã‚¨ãƒ©ãƒ¼ã€€Proactive Defense
ã‚µãƒ¼ãƒ“ã‚¹ã« é–¢ã™ã‚‹ ãŠå•ã„åˆã‚ã› ã”ä¸æ˜Žãªç‚¹ã‚„ãŠè¦‹ç©ã®ã”ç›¸è«‡ãªã©ã€ã¾ãšã¯æ°—è»½ã«ãŠå•ã„åˆã‚ã›ãã ã•ã„ã€‚
ockeghem 2008/06/24
ä¼æ¥ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã®ã€ŒãŠå•ã„åˆã‚ã›ã€ã¨ã€Œã‚µã‚¤ãƒˆå†…æ¤œç´¢ã€ã®2ç”»é¢ã§\735,000- é«˜ããªã„ã‹? å¼Šç¤¾ãªã‚‰3åˆ†ã®1ã§ã‚„ã‚‰ã›ã¦ã„ãŸã ãã¾ã™

security

was

è„†å¼±æ€§è¨ºæ–
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è¨ºæ–ã‚µãƒ¼ãƒ“ã‚¹ã€ã‚»ã‚³ãƒ ã€‘
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è¨ºæ–ã‚µãƒ¼ãƒ“ã‚¹ã¯ã€ãŠå®¢æ§˜ãŒç‹¬è‡ªã«æ§‹ç¯‰ã—ãŸWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ï¼ˆCGIã€ASPãªã©ï¼‰ã«å¯¾ã—ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ãŒæ—¢çŸ¥ã®è„†å¼±æ€§ã«å¯¾ã—ç¶²ç¾…çš„ã«è¨ºæ–ã‚’å®Ÿæ–½ã—ã€å®¢è¦³çš„ãªè©•ä¾¡ã¨å¯¾ç–æ¡ˆã‚’è¨ºæ–å ±å‘Šæ›¸ã¨ã—ã¦æä¾›ã—ã¾ã™ã€‚
ockeghem 2008/06/24
ã€Žç”»é¢å˜ä¾¡ï¼ˆï¼‘ç”»é¢ã‚ãŸã‚Šï¼‰126,000å††ï¼ˆç¨Žè¾¼ï¼‰ã€

security

è„†å¼±æ€§è¨ºæ–

was
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è¨ºæ– / ã‚µãƒ¼ãƒ“ã‚¹ãƒ»è£½å“ / æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®NRIã‚»ã‚ãƒ¥ã‚¢
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å®Ÿè£…æ–¹å¼ã€é–‹ç™ºè¨€èªžã€åˆ©ç”¨ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ãªã©ã‚’è€ƒæ…®ã—ã€ã•ã¾ã–ã¾ãªé …ç›®ã«ã¤ã„ã¦è¨ºæ–ã‚’è¡Œã„ã€ãŠå®¢æ§˜ã®ãƒ“ã‚¸ãƒã‚¹ã®å®‰å…¨æ€§ã‚’è„…ã‹ã™è¦å› ã¸ã®å¯¾ç–ãŒé©åˆ‡ã«è¡Œã‚ã‚Œã¦ã„ã‚‹ã‹ã‚’è¨ºæ–ã—ã¾ã™ã€‚Webãƒ–ãƒ©ã‚¦ã‚¶ã‚’åˆ©ç”¨ã™ã‚‹ä¸€èˆ¬çš„ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã ã‘ã§ãªãã€SOAPã‚’åˆ©ç”¨ã—ãŸWebã‚µãƒ¼ãƒ“ã‚¹ã¸ã®è¨ºæ–ã‚‚è¡Œã†ã“ã¨ãŒã§ãã¾ã™ã€‚ ä¸»è¦ãªéƒ¨åˆ†ã¯çµŒé¨“è±Šå¯Œãªå°‚é–€å®¶ãŒæ‰‹ä½œæ¥(ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«)ã«ã‚ˆã‚‹è¨ºæ–ã‚’è¡Œã„ã€ä¸€éƒ¨è¨ºæ–ãƒ„ãƒ¼ãƒ«ã‚’è£œåŠ©çš„ã«åˆ©ç”¨ã—ã¾ã™ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€ãŠå®¢æ§˜ãŒç‹¬è‡ªã«ä½œã‚Šè¾¼ã‚“ã ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ã‚ã£ã¦ã‚‚ã€æ½œåœ¨ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã®ã»ã¨ã‚“ã©ã‚’ç™ºè¦‹ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ã¾ãŸã€ç™ºè¦‹ã•ã‚ŒãŸå•é¡Œã«å¯¾ã—ã¦ã€å…·ä½“çš„ãªå¯¾ç–æ–¹æ³•ã‚’ã‚¢ãƒ‰ãƒã‚¤ã‚¹ã—ã€é©åˆ‡ãªå¯¾ç–ã®å®Ÿæ–½ã‚’æ”¯æ´ã—ã¾ã™ã€‚ ä¸»ãªè¨ºæ–é …ç›® ãƒ¦ãƒ¼ã‚¶èªè¨¼æ–¹å¼ã®ãƒã‚§ãƒƒã‚¯ ãƒ¦ãƒ¼ã‚¶èªè¨¼ã‚’å›žé¿ã—ã¦ãƒã‚°ã‚¤ãƒ³ã•ã‚Œã‚‹å±é™ºæ€§ãŒãªã„ã‹ã€ãƒã‚°ã‚¤ãƒ³IDã‚„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®æŽ¨æ¸¬ãƒ»ç·å½“ã‚Šæ”»æ’ƒã¸ã®å¼·åº¦ãŒååˆ†ã‹ãª
ockeghem 2008/06/24
security

è„†å¼±æ€§è¨ºæ–

was
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ã‚µãƒ¼ãƒ“ã‚¹ã€€Webã‚¢ã‚¿ãƒƒã‚¯ãƒ†ã‚¹ãƒˆ
ã“ã‚“ãªä¼æ¥æ§˜ã«ãŠã™ã™ã‚ç‰¹é•·ã‚µãƒ¼ãƒ“ã‚¹ã®ä½ç½®ä»˜ã‘ã‚µãƒ¼ãƒ“ã‚¹ä½“ç³»æ¦‚è¦å›³è©³ç´°æƒ…å ±é–¢é€£ãƒªãƒ³ã‚¯ãŠå•ã„åˆã‚ã›è¿‘å¹´ã®Webã‚µã‚¤ãƒˆæ”¹ã–ã‚“ã‚„æƒ…å ±æ¼ãˆã„ç‰ã®äº‹ä»¶ã¯ã€ç‹¬è‡ªé–‹ç™ºã—ãŸWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’ç‹™ã£ãŸæ”»æ’ƒã«ã‚ˆã‚‹ã‚‚ã®ãŒå¢—ãˆã¦ã„ã¾ã™ã€‚ã“ã‚Œã«ã¯ã€ã¾ãšWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«æ½œã‚€è„†å¼±æ€§ã®æœ‰ç„¡ã‚’ç¢ºèªã—ã€å¿…è¦ãªå¯¾ç–ã‚’è¬›ã˜ã‚‹ã“ã¨ãŒå¤§åˆ‡ã§ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ã‚µãƒ¼ãƒ“ã‚¹ã€ŒWebã‚¢ã‚¿ãƒƒã‚¯ãƒ†ã‚¹ãƒˆã€ã¯ã€Webã‚µãƒ¼ãƒã«ã¦å‹•ä½œã™ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’è¨ºæ–ã—ã€å•é¡Œç‚¹ã¨å¯¾ç–æ–¹æ³•ã‚’ã”å ±å‘Šã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã§ã™ã€‚æ¯”è¼ƒçš„æ‰‹è»½ãªãƒ„ãƒ¼ãƒ«è¨ºæ–ã¨ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å°‚é–€ã‚¹ã‚¿ãƒƒãƒ•ã«ã‚ˆã‚‹æ‰‹å‹•è¨ºæ–ã®2ã‚¿ã‚¤ãƒ—ã‹ã‚‰é¸æŠžã„ãŸã ã‘ã¾ã™ã€‚ ã‚µã‚¤ãƒˆä¸Šã®ãƒ•ã‚©ãƒ¼ãƒ ã«ã¦é€šä¿¡è²©å£²ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ç™»éŒ²ã€å—ç™ºæ³¨ã€æ±‚äººã€æ‡¸è³žå¿œå‹Ÿç‰ã‚’è¡Œã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆä¸Šã«ã¦ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆï¼ˆãƒãƒƒãƒˆé€šè²©ã€ãƒã‚±ãƒƒãƒˆè²©å£²ãªã©ï¼‰ã‚’è¡Œã£ã¦ã„ã‚‹PCI DSSï¼ˆæ³¨1ï¼‰æº–æ‹ ã®ãŸã‚ã«ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ†ã‚¹ãƒˆ
ockeghem 2008/06/19
WebInspectã§è¨ºæ–ã—ã¦ã„ã‚‹ã®ã§ã™ãã€‚ã‚ã‹ã‚Šã¾ã™ã€‚

security

was

è„†å¼±æ€§è¨ºæ–
ãƒªãƒ³ã‚¯
HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°å¾³ä¸¸æµ©ã®æ—¥è¨˜ - ç™ºæ³¨è€…ã®ãŸã‚ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€(1) - å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãŸã‚ã«ç™ºæ³¨è€…ãŒãªã™ã¹ãã“ã¨
â– å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãŸã‚ã«ç™ºæ³¨è€…ãŒãªã™ã¹ãã“ã¨ ã“ã®ãƒ–ãƒã‚°ã§ã®é€£è¼‰é–‹å§‹ã«ã‚ãŸã‚Šã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ç™ºæ³¨ã™ã‚‹ç«‹å ´ã§ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«å¯¾ã™ã‚‹è²¬ä»»ã‚„ã€ãªã™ã¹ãã“ã¨ã‚’èª¬æ˜Žã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ç™ºæ³¨è€…ã«è„†å¼±æ€§ã«å¯¾ã™ã‚‹è²¬ä»»ã¯ã‚ã‚‹ã‹ ãã‚‚ãã‚‚éžå¸¸ã«åŸºæœ¬çš„ãªå‰æã¨ã—ã¦ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§(SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©)ã«å¯¾ã™ã‚‹æœ€çµ‚çš„ãªè²¬ä»»ã¯èª°(ã©ã®ä¼šç¤¾)ã«ã‚ã‚‹ã‹ã‚’è€ƒãˆã¦ã¿ã¾ã™ã€‚å…·ä½“çš„ã«ã¯ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®Webã‚µã‚¤ãƒˆã‚’é‹å–¶ã—ã¦ã„ã‚‹ã€ã‚ã‚‹ã„ã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ§ãƒ³ã‚’ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¨ã—ã¦å¸‚è²©ã—ã¦ã„ã‚‹ãŒã€é–‹ç™ºã¯å¤–éƒ¨ã®é–‹ç™ºä¼šç¤¾ã«å§”è¨—ã—ã¦ã„ã‚‹ã‚±ãƒ¼ã‚¹ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ•…ãªã©ãŒç™ºç”Ÿã—ã¦ãŠå®¢æ§˜(Webã‚µã‚¤ãƒˆã®ãƒ¦ãƒ¼ã‚¶ã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚½ãƒ•ãƒˆã®è³¼å…¥è€…)ã«è¿·æƒ‘ã‚’æŽ›ã‘ãŸå ´åˆã€ãã®è²¬ä»»ã¯èª°ã«ã‚ã‚‹ã‹ã¨ã„ã†ã“ã¨ã§ã™ã€‚ çµè«–ã‹ã‚‰è¨€ãˆã°ã€ã“ã®è²¬ä»»ã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ç™ºæ³¨è€…ã«ã‚ã‚Š
ockeghem 2008/06/15
security

was

ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³

ã‚»ãƒ«ã‚¯ãƒž

å®£ä¼

hash-c
ãƒªãƒ³ã‚¯
preg_replaceã«ã‚ˆã‚‹ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œ - T.Teradaã®æ—¥è¨˜
æœ€è¿‘å°‘ã—èª¿ã¹ã¦ã„ãŸã®ãŒã€PHPã®ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç³»ã®è„†å¼±æ€§ã§ã™ã€‚ä¸ã§ã‚‚ã€preg_replaceé–¢æ•°ï¼ˆPerläº’æ›ã®æ£è¦è¡¨ç¾ã«ã‚ˆã‚‹ç½®æ›ã‚’è¡Œãªã†ãŸã‚ã®é–¢æ•°ï¼‰ã‚’ä¸é©åˆ‡ãªæ–¹æ³•ã§ä½¿ã£ãŸå ´åˆã«ç™ºç”Ÿã™ã‚‹è„†å¼±æ€§ã«ã¤ã„ã¦èª¿ã¹ã¦ã„ã¾ã—ãŸã€‚ ã›ã£ã‹ããªã®ã§ã€æ—¥è¨˜ã«ã¾ã¨ã‚ã¦ã¿ã¾ã™ã€‚ 3ç¨®é¡žã®è„†å¼±æ€§ preg_replaceé–¢æ•°ã‚’ä½¿ã£ãŸPHPã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç³»ã®è„†å¼±æ€§ã«ã¯ã€å¤§ããåˆ†ã‘ã¦3ã¤ã®ç¨®é¡žãŒã‚ã‚Šã¾ã™ã€‚ ç¬¬ä¸€å¼•æ•°ã¸ã®æŒ¿å…¥ã‚’è¨±ã™ eä¿®é£¾åä»˜ããƒ»ç¬¬äºŒå¼•æ•°ã¸ã®æŒ¿å…¥ã‚’è¨±ã™ eä¿®é£¾åä»˜ããƒ»ç¬¬ä¸‰å¼•æ•°ã¸ã®æŒ¿å…¥ã‚’è¨±ã™ ä»¥ä¸‹ã§ãã‚Œãžã‚Œã«ã¤ã„ã¦è¦‹ã¦ã„ãã¾ã™ã€‚ ã‚¿ã‚¤ãƒ—ï¼‘ï¼šç¬¬ä¸€å¼•æ•°ã¸ã®æŒ¿å…¥ ä»¥ä¸‹ã®ã‚³ãƒ¼ãƒ‰ã«ã€ä»»æ„ã®PHPã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œå¯èƒ½ãªè„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ $m = preg_replace("/([^<]*)$kw([^>]*)/i", "\\1<font color=red>$kw</font>\\2", $m); $kwã¨$mã¯å¤–éƒ¨ã‹ã‚‰
ockeghem 2008/06/07
teracc

was

php
ãƒªãƒ³ã‚¯
Proactive Defense/Webã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ã”å ±å‘Šæ›¸(pdf)
ockeghem 2008/06/03
çªã£è¾¼ã¿ã©ã“ã‚ã¯å¤šã„ãŒã€/icons/ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®ä¸€è¦§è¡¨ç¤ºãŒå±é™ºåº¦ä¸ã§ã€ãƒã‚°ã‚¢ã‚¦ãƒˆæ©Ÿèƒ½æ¬ å¦‚ãŒå±é™ºåº¦å°ã¨ã„ã†ã®ã¯ã©ã†ã‹?/XSSã®è§£æ±ºæ–¹æ³•ã€ŽIPA ã®ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€ã‚’å‚ç…§ãã ã•ã„ã€<ãã†æ¥ãŸã‹

security

was
ãƒªãƒ³ã‚¯
http://japan.internet.com/webtech/20080529/11.html
ockeghem 2008/05/29
åŒç¤¾ã®ã€ŽAssessment Management Platformã€ã ã€‚ãã—ã¦åŒãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ä¸Šã§ã€é–‹ç™ºè€…å‘ã‘ã®ãƒ„ãƒ¼ãƒ«ã€ŽDevInspectã€ã€å“è³ªä¿è¨¼æ‹…å½“è€…å‘ã‘ã®ãƒ„ãƒ¼ãƒ«ã€ŽQAInspectã€ã€é‹ç”¨æ‹…å½“ãŠã‚ˆã³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶å‘ã‘ã®ãƒ„ãƒ¼ãƒ«ã€ŽWebInspectã€ãŒå‹•ä½œã™ã‚‹

was

security

web

hp
ãƒªãƒ³ã‚¯
http://src.jumperz.net/rsa/kanatoko.ppt
ockeghem 2008/05/09
æœ¬å½“ã«æœ€æ–°ã€‚ä»®ã«åƒ•ãŒã“ã®ãƒã‚¿æŒã£ã¦ã¦ã‚‚RSAã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã§ã¯ã—ã‚ƒã¹ã‚‰ãªã„ã¨æ€ã†ã‘ã©ã€ãã“ã‚’ã—ã‚ƒã¹ã£ã¡ã‚ƒã†ã¨ã“ã‚ãŒé‡‘åºŠã•ã‚“ã®å‰ã„ã¨ã“ã‚

security

was
ãƒªãƒ³ã‚¯
Amazon.co.jp: ã‚»ã‚ãƒ¥ã‚¢Webãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°Tipsé›†: ä½åæœ¨æ™ºè²´: æœ¬
ockeghem 2008/04/10
was

webappsec

book

ä½åæœ¨æ™ºè²´
ãƒªãƒ³ã‚¯
1 2 3 æ¬¡ã®ãƒšãƒ¼ã‚¸