[B! security] sajeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

saje id:saje

securityã«é–¢ã™ã‚‹sajeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆé–²è¦§ã¯æœ¬å½“ã«ãƒžãƒ«ã‚¦ã‚§ã‚¢ã«æ„ŸæŸ“ã™ã‚‹å±é™ºæ€§ãŒé«˜ã„ã®ã‹ï¼Ÿ
By Gerard Van der Leun ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆã¯ãƒžãƒ«ã‚¦ã‚§ã‚¢ã®æ¸©åºŠã¨ãªã£ã¦ã„ã‚‹ã¨æ€ã‚ã‚Œã¦ã„ã¾ã™ãŒã€æžœãŸã—ã¦æœ¬å½“ã«ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ãƒžãƒ«ã‚¦ã‚§ã‚¢ã«æ„ŸæŸ“ã™ã‚‹å±é™ºåº¦ã¯é«˜ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã‚¤ã‚®ãƒªã‚¹äººã®ã‚³ãƒ³ãƒ©ãƒ‰ãƒ»ãƒãƒ³ã‚°ãƒ¢ã‚¢ã•ã‚“ãŒäººæ°—ã®é«˜ã„ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆ10åª’ä½“ã‚’ç‹¬è‡ªã«èª¿æŸ»ã—ãŸã¨ã“ã‚ã€ä¸€èˆ¬çš„ã«èªçŸ¥ã•ã‚Œã¦ã„ã‚‹æƒ…å ±ã¨ã¯ã‹ãªã‚Šé•ã†çµæžœãŒå‡ºãŸã‚ˆã†ã§ã™ã€‚ Dynamoo's Blog: Top porn sites lead to malware http://blog.dynamoo.com/2013/04/top-porn-sites-lead-to-malware.html ãƒãƒ³ã‚°ãƒ¢ã‚¢ã•ã‚“ãŒèª¿æŸ»çµæžœã«ã‚ˆã‚‹ã¨ã€äººæ°—ã®é«˜ã„ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆ10å€‹ã®ã†ã¡5ã¤ã¯ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢ã®æ„ŸæŸ“çŽ‡ã‚’è¡¨ã™ã€ŒInfection rateã€ãŒ0ï¼…ã§ã‚ã‚‹ã“ã¨ãŒåˆ¤æ˜Žã€‚ã¾ãŸã€å…ˆã®5ã¤ã‚’å«ã‚“ã 6ã¤ã®ã‚µã‚¤ãƒˆã¯ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢ã¨ã®æŽ¥è§¦è¦‹è¾¼ã¿ã‚’
saje 2013/04/22
Security
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚½ãƒ•ãƒˆç„¡ã—ã§ãƒãƒ¼ãƒˆå…¨é–‹ã§ã‚µãƒ¼ãƒé‹å–¶ã—ãŸçµæžœ : ã‚´ãƒ¼ãƒ«ãƒ‡ãƒ³ã‚¿ã‚¤ãƒ ã‚º
1 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š2013/04/07(æ—¥) 05:57:19.64 ID:NsfDt90t0 ã™ã”ã„ã“ã¨ã«ãªã£ã¦ãŸï¼ˆå°ä¸¦æ„Ÿï¼‰ 2 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š2013/04/07(æ—¥) 05:57:55.36 ID:GsrYCYmC0 ã†ã‚ãâ€¦ 3 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š2013/04/07(æ—¥) 05:58:44.07 ID:qP1O0rYf0 ã²ã§ãˆãª 4 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š2013/04/07(æ—¥) 05:58:44.66 ID:wNiBhnQe0 ã¸ãƒ¼ 5 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š2013/04/07(æ—¥) 05:58:49.71 ID:2o8LEMilP ã‚“ã€å‰²ã‚Œï¼Ÿ 7 ï¼šä»¥ä¸‹ã€åç„¡ã—ã«ã‹ã‚ã‚Šã¾ã—ã¦VIPãŒãŠé€ã‚Šã—ã¾ã™ ï¼š20
saje 2013/04/07
security
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° - Wikipedia
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆè‹±: cross-site scriptingï¼‰ã¨ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§[1]ã‚‚ã—ãã¯ãã‚Œã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã€‚è„†å¼±æ€§ã‚’ãƒ„ãƒªãƒ¼åž‹ã«åˆ†é¡žã™ã‚‹CWEã§ã¯ã“ã®æ”»æ’ƒã‚’ä¸é©åˆ‡ãªå…¥åŠ›ç¢ºèª (CWE-20) ã«ã‚ˆã‚‹ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ (CWE-74) ã®ã²ã¨ã¤ã¨ã—ã¦åˆ†é¡žã—ã¦ã„ã‚‹ (CWE-79)[2]ã€‚ç•¥ç§°ã¯XSSã€‚ã‹ã¤ã¦ã¯CSSã¨ã„ã†ç•¥ç§°ã‚‚ä½¿ã‚ã‚Œã¦ã„ãŸãŒã€Cascading Style Sheetsã¨ç´›ã‚‰ã‚ã—ã„ã®ã§ã“ã®ç•¥ç§°ã¯ã‚ã¾ã‚Šä½¿ã‚ã‚Œãªããªã£ãŸ[1]ã€‚ ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆï¼ˆã‚µã‚¤ãƒˆæ¨ªæ–ï¼‰ã€ã¨ã„ã†åç§°ã¯æ´å²çš„ãªã‚‚ã®ã§ã€åˆæœŸã«ç™ºè¦‹ã•ã‚ŒãŸXSSã§ã¯è„†å¼±æ€§ã®ã‚ã‚‹ã‚µã‚¤ãƒˆã¨æ”»æ’ƒè€…ã®ã‚µã‚¤ãƒˆã‚’ã€Œã‚µã‚¤ãƒˆæ¨ªæ–çš„ã€ã«åˆ©ç”¨ã—ã¦æ”»æ’ƒã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ã‹ã‚‰åã¥ã‘ã‚‰ã‚ŒãŸã‚‚ã®ã ãŒ[3][4]ã€XSSã®å®šç¾©ã¯æ–°ã—ã„ã‚¿ã‚¤ãƒ—ã®æ”»æ’ƒãŒè¦‹ã¤ã‹ã‚‹ãŸã³ã«æ‹¡å¼µã•ã‚Œã€ã‚µã‚¤ãƒˆæ¨ªæ–çš„ãªã‚‚ã®ã§ãªãã¨ã‚‚XSSã¨å‘¼ã¶ã‚ˆã†ã«ãªã£ãŸ[3]
saje 2012/04/26
security

XSS
ãƒªãƒ³ã‚¯
http://japan.internet.com/busnews/20120425/7.html
saje 2012/04/26
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã«é–¢ã™ã‚‹è„†å¼±æ€§ã‚‚ä¿®æ£ã•ã‚ŒãŸ

WordPress

security
ãƒªãƒ³ã‚¯
ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ãŒåŠ¹ã„ã¦ã„ã‚‹ã‹ç¢ºèªã™ã‚‹ã«ã¯
cles::blog å¹³å¸¸å¿ƒæ˜¯é“ blogs: cles::blog NP_cles() Â« Google Code Searchã«ã‚¯ãƒãƒ¼ãƒ«ã—ã¦ã‚‚ã‚‰ã†ã«ã¯ :: ãƒ¯ã‚¤ãƒ¤ãƒ¬ã‚¹ãƒžã‚¦ã‚¹ãŒæ°—ã«ãªã‚‹ Â» 2006/11/19 ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ãŒåŠ¹ã„ã¦ã„ã‚‹ã‹ç¢ºèªã™ã‚‹ã«ã¯Â antivirusÂ PoCÂ checker 348 6ã¸ã‡ ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ãŸã‚‰ã€Œãã‚ŒãŒæœ¬å½“ã«å‹•ä½œã—ã¦ã„ã‚‹ã®ã‹ã©ã†ã‹ç¢ºèªã—ãŸã„ã€ã¨ã„ã†å ´åˆãŒã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ã¾ãæœ¬å½“ã®ã‚¦ã‚£ãƒ«ã‚¹ã‚’ä½¿ã£ã¦ãƒã‚§ãƒƒã‚¯ã‚’ã—ã‚ˆã†ã¨ã™ã‚‹æ‰‹ã‚‚ãªã„ã‚ã‘ã§ã¯ãªã„ã®ã§ã™ãŒã€ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãŒä¸å®Œå…¨ã ã£ãŸå ´åˆã“ã¨ã‚’è€ƒãˆã‚‹ã¨æ€–ã„ã§ã™ã‚ˆãã€‚ ãªã‚“ã¨ã‹ãƒªã‚¹ã‚¯ã‚¼ãƒã§ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ãŒåŠ¹ã„ã¦ã„ã‚‹ã‹ã©ã†ã‹ç¢ºèªã—ãŸã„ã¨ã„ã†ã“ã¨ã«ãªã‚‹ã‚ã‘ã§ã™ãŒã€ãã‚“ãªã¨ãæ´»èºã™ã‚‹ã®ãŒEICAR*1ãŒå…¬é–‹ã—ã¦ã„ã‚‹EICAR-TEST-FILEã§ã™ã€‚ å„è£½å“å…±é€šãƒ†ã‚¹ãƒˆã‚¦ã‚¤ãƒ«ã‚¹ ã“ã®ãƒ•ã‚¡ã‚¤ãƒ«ã¯ãƒ¯
saje 2012/04/26
security
ãƒªãƒ³ã‚¯
ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ (ãƒ¡ã‚¤ãƒ³ãƒ–ãƒã‚°ã§ã™ï¼) â†’ ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ (Hatena) ã¯ã¾ã¡ã‚„ï¼’ã®ãƒ„ã‚¤ãƒƒã‚¿ãƒ¼ã§ã™ï¼ æ°—è»½ã«ãƒ•ã‚©ãƒãƒ¼ã—ã¦ã¿ã¦ãã ã•ã„ãï¼ â†’ Twitter / ã¯ã¾ã¡ã‚„ï¼’ ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ â†’ Hamachiya2ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ ã‚¿ãƒ³ãƒ–ãƒ©ãƒ¼ã§ã™ï¼ ã‹ã‚ã„ã„çµµã‚’ã‚ã¤ã‚ãŸã‚Šã—ã¦ã„ã¾ã™ï¼ â†’ [tumblr] hmcy ã‚²ãƒ¼ãƒ ã®å‹•ç”»ã‚’ã‚ã’ã¦ã€ã¼ãã‚‚ãƒ¢ãƒ†ãƒ¢ãƒ†ãƒ¦ãƒ¼ãƒãƒ¥ãƒ¼ãƒãƒ¼ã«ãªã‚‹ã¤ã‚‚ã‚Šã§ã™ï¼ â†’ ã¯ã¾ã¡ã‚„ï¼’(Hamachiya2)ã®YouTube (ä»¥ä¸‹ã¯éŽåŽ»ã®è¨˜äº‹ãªã©) ãã¿ã®ãƒ©ã‚¤ãƒ•ã‚’å¯è¦–åŒ–ã™ã‚‹ã‚ˆï¼ â†’ [JavaScript] ãƒ©ã‚¤ãƒ•ã‚«ã‚¦ãƒ³ã‚¿ãƒ¼ ç©ºã‹ã‚‰å¥³ã®åãŒâ€¦ï¼ â†’ ç©ºã‹ã‚‰å¥³ã®åãŒé™ã£ã¦ãã‚‹ AIRã‚¢ãƒ—ãƒªã®ç°¡å˜ãªä½œã‚Šæ–¹ â†’ [AIR][JavaScript] JavaScriptã§ã‹ã‚“ãŸã‚“AIRã‚¢ãƒ—ãƒªã«æŒ‘æˆ¦ ã¤ãã£ã¦ã¿ã¾ã—ãŸï¼ â†’ ãƒ‰ãƒªãƒ¼ãƒ ãƒ¡ãƒ¼ã‚«ãƒ¼ : ãƒ–ãƒ©ã‚¦ã‚¶ã§ç°¡å˜ã«ãƒŽãƒ™ãƒ«ã‚²
saje 2011/07/19
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼

security
ãƒªãƒ³ã‚¯
1