ã¨ãã¾ã‚‹ã²ã‚ã—ã®Session Fixation攻撃入門 - ockeghem's blog
ã‚„ãã€ã¿ã‚“ãªï¼Œå…ƒæ°—？ã¨ãã¾ã‚‹ã²ã‚ã—ã§ã™ã€‚今日ã¯Session Fixation攻撃ã®æ–¹æ³•ã‚’ã“ã£ãã‚Šæ•™ãˆã¡ã‚ƒã†ã‚ˆã€‚ ã„ã¤ã‚‚ã¯é˜²å¾¡å´ã§æ¼¢å—ã®åå‰ã§ã‚„ã£ã¦ã‚‹ã‚“ã ã‘ã©ï¼Œãょã†ã¯æ”»æ’ƒå´ã¨ã„ã†ã“ã¨ã§ï¼Œåä¹—ã‚Šã‚‚ã²ã‚‰ãŒãªã«å¤‰ãˆãŸã‚“ã 。ã ã£ã¦ã•ï¼Œä»Šåº¦ãƒ‡ãƒ–サミã§ã”一緒ã™ã‚‹ã¯ã›ãŒã‚よã†ã™ã‘ã•ã‚“ã¨ã‹ï¼Œã¯ã¾ã¡ã¡ã‚ƒã‚“ã¨ã‹ï¼Œã²ã‚‰ãŒãªã®äººãŸã¡ã®æ–¹ãŒæ ¼å¥½è‰¯ã•ãã†ã˜ã‚ƒãªã„ã‹ã€‚ ã§ã¯å§‹ã‚よã†ã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã¯ã€http://blog.tokumaru.org/2009/01/introduction-to-session-fixation-attack.html ã«ç§»è»¢ã—ã¾ã—ãŸã€‚æれ入りã¾ã™ãŒã€ç¶šãã¯ã€ãã¡ã‚‰ã‚’ã”覧ãã ã•ã„。
tralfamadore.com: Xsstc: Cross-site scripting through CSS
I've been doing a lot of reading on cross-domain scripting approaches. Generally speaking, the browser is sandboxed by the same-origin policy, and mashups that want to incorporate data from external sites, even if those sites are cooperating, need to provide server-side proxies. There are a couple of popular workarounds: (1) using the hash (#) portion of the URL, which can be read between frames,
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
第8回　クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング対ç–ã®è½ã¨ã—ç©´ | gihyo.jp
今回ã¯ç†Ÿç·´ã—ãŸWebアプリ開発者ãªã‚‰å¸¸è˜ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング対ç–ã®è½ã¨ã—穴を紹介ã—ã¾ã™ã€‚ JavaScriptを排除ã—ã¦ã„ã‚‹ã¤ã‚‚ã‚Šã§æŽ’除ã«å¤±æ•—ï¼Ÿï¼ æœ€è¿‘ã¯Sanitize（サニタイズ）ã¨ã„ã†è¨€è‘‰ã®ä»£ã‚ã‚Šã«Validation（検証）ã¨ã„ã†è¨€è‘‰ã‚’よãèžãよã†ã«ãªã£ãŸã¨æ€ã„ã¾ã™ã€‚Sanitizeã®æ„味を辞書ã§èª¿ã¹ã‚‹ã¨ã€Œæ±šã‚Œã¦ã„る物をãã‚Œã„ã«ã™ã‚‹ã“ã¨ã€ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®æ„味ã®é€šã‚Šæ±šã‚ŒãŸå¤‰æ•°ã‚’ãã‚Œã„ã«ã—ã¦ä½¿ãˆã°å®‰å…¨ã«åˆ©ç”¨ã§ãã‚‹ã¨ã™ã‚‹è€ƒãˆæ–¹ã«åŸºã¥ãã®ãŒã‚µãƒ‹ã‚¿ã‚¤ã‚ºæ‰‹æ³•ã§ã™ã€‚典型的ãªä¾‹ã¯ã€ã€Œâ テã‚ストを出力ã™ã‚‹å‰ã«"<"ã¨">"ã‚’å–り除ãã€æ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚ 例1　"<"ã¨">"ã‚’ereg_replaceã§å–り除ã $safe_text = ereg_replace($_GET['text'], '[<>]', ''); ã“ã®$safe_textã‚’ <a href="/script.php?t
Webアプリケーションを作るå‰ã«çŸ¥ã‚‹ã¹ã10ã®è„†å¼±æ€§ ― ï¼ IT
WebアプリケーションãŒæ”»æ’ƒè€…ã«ä»˜ã‘è¾¼ã¾ã‚Œã‚‹è„†å¼±æ€§ã®å¤šãã¯ã€è¨è¨ˆè€…や開発者ã®ãƒ¬ãƒ™ãƒ«ã§æŽ’除ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚実装ã«å¿™ã—ã„方もã€æœ€è¿‘よãç‹™ã‚れる脆弱性ã®ãƒˆãƒƒãƒ—10を知るã“ã¨ã§æ‰‹ã£å–ã‚Šæ—©ã概è¦ã‚’知りã€é–‹ç™ºã®éš›ã«ãã®å˜åœ¨ã‚’æ„è˜ã—ã¦ã‚»ã‚ュアãªWebアプリケーションã«ã—ã¦ã„ãŸã ã‘ã‚Œã°å¹¸ã„ã§ã™ã€‚ Webã®ä¸–界を脅ã‹ã™è„†å¼±æ€§ã‚’é †ä½ä»˜ã‘ OWASP（Open Web Application Security Project）ã¯ã€ä¸»ã«Webアプリケーションã®ã‚»ã‚ュリティå‘上を目的ã¨ã—ãŸã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã§ã€ãã“ã§ã®èª¿æŸ»ã‚„開発ã®æˆæžœç‰©ã‚’誰ã§ã‚‚利用ã§ãるよã†ã«å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ ãã®ä¸ã®ã€ŒOWASP Top Ten Projectã€ã¨ã„ã†ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã¯ã€å¹´ã«1回Webアプリケーションã®è„†å¼±æ€§ãƒˆãƒƒãƒ—10を掲載ã—ã¦ã„ã¾ã™ã€‚2004年版ã¯æ—¥æœ¬èªžã‚’å«ã‚€å„国語版ãŒæä¾›ã•ã‚Œã¦ã„ã¾ã™ãŒã€2007年版ã¯ç¾åœ¨ã®ã¨ã“ã‚英語版ã®ã¿ãŒæä¾›ã•
ï¼»CRYPTO-GRAM日本語版］JavaScriptãƒã‚¤ã‚¸ãƒ£ãƒƒã‚ング
JavaScriptãƒã‚¤ã‚¸ãƒ£ãƒƒã‚ングã¯ï¼ŒAjaxスタイルã®Webアプリケーションを狙ã†æ–°æ‰‹ã®ç›—è´æ”»æ’ƒã§ã‚る。Ajaxコードã«çš„を絞ã£ãŸåˆã‚ã¦ã®æ”»æ’ƒã¨æ–言ã—ã¦ã‚‚ã„ã„ã ã‚ã†ã€‚ã“ã®æ”»æ’ƒãŒå¯èƒ½ãªã®ã¯ï¼ŒWebブラウザãŒHTMLã»ã©ã«ã¯JavaScriptã‚’ä¿è·ã—ãªã„ã‹ã‚‰ã 。WebアプリケーションãŒJavaScriptã«ã‚ˆã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã§æ©Ÿå¯†ãƒ‡ãƒ¼ã‚¿ã‚’é€ä¿¡ã™ã‚‹ã¨ï¼Œå ´åˆã«ã‚ˆã£ã¦ã¯ã“ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãŒæ”»æ’ƒè€…ã«èªã¿å–られã¦ã—ã¾ã†ã€‚ 人気ã®é«˜ã„Ajaxプãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»ãƒ•ãƒ¬ãƒ¼ãƒ ワークã®å¤šãã¯ï¼ŒJavaScriptãƒã‚¤ã‚¸ãƒ£ãƒƒã‚ングを防ã手立ã¦ã‚’æŒãŸãªã„。実際ã®ã¨ã“ã‚，ã†ã¾ã機能ã•ã›ã‚‹ã“ã¨ã‚’優先ã—ã¦ï¼Œãœã„弱性を抱ãˆãŸWebアプリケーションを構築ã™ã‚‹ã‚ˆã†ã«ãƒ—ãƒã‚°ãƒ©ãƒžã«â€œè¦æ±‚â€ã—ã¦ã„ã‚‹ã‚‚ã®ã‚‚ã‚ã‚‹ã®ã 。 ä¼¼ãŸã‚ˆã†ãªå¤šãã®ãœã„弱性ã¨åŒã˜ã，ã“ã®æ‰‹ã®æ”»æ’ƒã¯å®¹æ˜“ã«é˜²ã’る。大抵ã¯ï¼Œã‚ãšã‹æ•°è¡Œã®ã‚³ãƒ¼ãƒ‰ã‚’åŠ ãˆã‚‹ã ã‘ã§æ¸ˆã‚€ã€‚ã¾ãŸï¼Œã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢
XSS - 表示系パラメータã«å˜åœ¨ã™ã‚‹ç›²ç‚¹ :: ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティングã®æ™‚é–“ã§ã™ï¼ XSSã¨ã„ã†ã¨â€¦ï¼ ã¾ã£ã•ãã«æ€ã„ã¤ãã®ãŒã€å…¥åŠ›ãƒ‡ãƒ¼ã‚¿é€ä¿¡ → 確èªè¡¨ç¤ºã®éƒ¨åˆ†ã§ã®ç„¡å®³åŒ–æ¼ã‚Œã§ã™ã‚ˆãï¼ ãŸã¨ãˆã°ã“ã‚“ãªæ„Ÿã˜ã®ãƒ•ã‚©ãƒ¼ãƒ ã‹ã‚‰å—ã‘å–ã£ãŸãƒ‘ラメータを〠確èªã¨ã—ã¦è¡¨ç¤ºã™ã‚‹ãƒšãƒ¼ã‚¸ã¨ã‹ï¼ (入力) <form action="register.cgi" method="post"> タイトル：<input type="text" name="title"> ↠「ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ã‚’入力 本文：<input type="text" name="body"> ↠「ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼<script>alert(1)</script>ã€ã‚’入力 </form> (確èª) <p>ã“ã®å†…容ã§ç™»éŒ²ã—ã¦ã„ã„？</p> <p> タイトル： ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼<br> 本文： ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼<script>alert
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
The 60+ Best Ecommerce Websites - Top Ecommerce Website Designs
PHPã§ã®ã‚»ã‚ュリティ対ç–ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢ - Liner Note
Google Code Archive - Long-term storage for Google Code Project Hosting.
{{#tags}}- {{label}}
{{/tags}}