[B! security] tacshissã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tacshiss id:tacshiss

securityã«é–¢ã™ã‚‹tacshissã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (70)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

pastebinã«è²¼ã‚‰ã‚ŒãŸã€Œtwitterãƒ¦ãƒ¼ã‚¶ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã€ã‚’è»½ãåˆ†æžã—ãŸ - ockeghemã®tumblr
ã‚¢ãƒŽãƒ‹ãƒžã‚¹åŒ¿åã®ãƒãƒƒã‚«ãƒ¼ãŒpastebinã«twitterã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ãƒ¦ãƒ¼ã‚¶åã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰55,000ä»¥ä¸Šã‚’æ¼æ´©ã•ã›ãŸã¨ã„ã†æ›¸ãè¾¼ã¿ãŒã‚ã‚Šã¾ã—ãŸã€‚ï¼ˆæ³¨:å½“åˆanonymous hackersã‚’ã‚¢ãƒŽãƒ‹ãƒžã‚¹ãƒãƒƒã‚«ãƒ¼ã¨è¨³ã—ã¦ã„ã¾ã—ãŸãŒã€ã“ã“ã¯ã€ŒåŒ¿åã®ã€ã¨ã„ã†æ„å‘³ã§ã™ãã€‚è¨‚æ£ã—ã¾ã™ï¼‰ çœŸå½ã®ã»ã©ã¯ã‚ˆãã‚ã‹ã‚Šã¾ã›ã‚“ãŒã€ã“ã“ã«è²¼ã‚‰ã‚Œã¦ã„ãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å°‘ã—åˆ†æžã—ã¦ã¿ã¾ã—ãŸã€‚å½“ç„¶ãªãŒã‚‰ã€ã“ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦ãƒã‚°ã‚¤ãƒ³ã—ã¦ã¿ã‚‹ã€ã¨ã„ã†ã®ã¯é•æ³•è¡Œç‚ºã§ã™ã®ã§ã€çµ¶å¯¾ã«ã‚„ã£ã¦ã¯ã„ã‘ã¾ã›ã‚“ã€‚ä»¥ä¸‹ã¯ã‚ãã¾ã§ã‚‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰æ–‡å—åˆ—ã®çµ±è¨ˆçš„ãªåˆ†æžã§ã™ã€‚ ã¾ãšã€è²¼ã‚‰ã‚Œã¦ã„ãŸã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®æ•°ã§ã™ãŒã€å˜ç´”ã«æ•°ãˆã‚‹ã¨ã€58,978å€‹ã‚ã‚Šã€ç´„59,000ã¨ã„ã†ã¨ã“ã‚ã§ã™ã€‚ã¨ã“ã‚ãŒé‡è¤‡ãŒã‹ãªã‚Šã‚ã‚Šã€ãƒ¦ãƒ‹ãƒ¼ã‚¯ãªID:ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çµ„ã¿åˆã‚ã›ã ã¨ã€34,069ã«æ¸›å°‘ã—ã¾ã™ã€‚ã•ã‚‰ã«ã€ã€ŒåŒä¸€ãƒ¦ãƒ¼ã‚¶åã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒç•°ãªã‚‹ã€çµ„ã¿åˆã‚ã›ãŒ6å€‹ã‚ã‚Šã¾ã—ãŸã€‚
tacshiss 2012/05/09
security
ãƒªãƒ³ã‚¯
GoogleãŒSafariã®è¨å®šã‚’è¿‚å›žã—ã¦ãƒˆãƒ©ãƒƒã‚ãƒ³ã‚°ã—ã¦ã„ãŸã¨ã•ã‚Œã‚‹ä»¶ã«ã¤ã„ã¦ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼š
â€»ã“ã®è¨˜äº‹ã®å®Œæˆåº¦ã¯85%ãã‚‰ã„ãªã®ã§å¾Œã§è¿½è¨˜ã—ã¾ã™ã€‚ http://webpolicy.org/2012/02/17/safari-trackers/ http://online.wsj.com/article/SB10001424052970204880404577225380456599176.html http://blogs.wsj.com/digits/2012/02/16/how-google-tracked-safari-users/ åˆã‚ã›ã¦èªã¿ãŸã„ã€‚ http://trac.webkit.org/changeset/92142 https://bugs.webkit.org/show_bug.cgi?id=35824 ä¸€ç•ªä¸Šã®Jonathan Mayeræ°ã®è¨˜äº‹ã«ã¤ã„ã¦ã¯ç´”ç²‹ã«æŠ€è¡“çš„ãªãƒ¬ãƒãƒ¼ãƒˆãªã®ã§ã€ç‰¹ã«ãŠã‹ã—ãªã“ã¨ã¯æ›¸ã‹ã‚Œã¦ã„ãªã„ã€‚å…ƒã¯ã¨ã„ãˆã°Safariã®Cooki
tacshiss 2012/02/21
security
ãƒªãƒ³ã‚¯
5åˆ†ã§ã§ãã‚‹PHPã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ Webãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã—ã¦ã¾ã™ã‹ï¼ ã‚ˆãã€ŒPHPã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒãƒ€ãƒ¡ã€ã¨ã‹è¨€ã‚ã‚Œã¦ã‚‹ã‚ˆãã€‚ ã§ã‚‚ãã‚Œã£ã¦ã€ã¹ã¤ã«PHPãŒæ‚ªã„ã‚“ã˜ã‚ƒãªãã¦ã€ ãŸã¶ã‚“ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã‹ãŒã€ã¾ã ã‚ˆãã‚ã‹ã‚‰ãªã„äººãŒå¤šã„ã ã‘ãªã‚“ã˜ã‚ƒãªã„ã‹ãªã€‚ ãŒã‚“ã°ã£ã¦å‹‰å¼·ã—ã‚ˆã†ã¨æ€ã£ã¦ã‚‚ã€ãªã‚“ã ã‹é›£ã—ã„ç†å±ˆãŒä¸¦ã‚“ã§ã„ãŸã‚Šã™ã‚‹ã—ãâ€¦ã€‚ ãªã®ã§ä»Šæ—¥ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ã€ ã€Œã“ã‚Œã ã‘ã‚„ã£ã¨ã‘ã°ã€ã‚ã‚Šã¨å®‰å…¨ã«ãªã‚‹ã‚ˆã€ã£ã¦ã“ã¨ã‚’ã€åˆå¿ƒè€…ã‚€ã‘ã«ã€å¤§é›‘æŠŠã«æ›¸ã„ã¦ã¿ã¾ã™ï¼ ç†å±ˆãŒã‚ã‹ã‚‰ãªãã¦ã‚‚ã€æœ€åˆã¯ã‚³ãƒ”ãƒšã§ã‚‚ã€ ãªã«ã‚‚ã‚„ã‚‰ãªã„ã‚ˆã‚Šã€ã‚„ã£ãŸã»ã†ãŒãã£ã¨ãƒžã‚·ã«ãªã‚‹ï¼ 1. XSSå¯¾ç– å‹•çš„ãªã‚‚ã®ã‚’è¡¨ç¤ºã™ã‚‹ã¨ãã€å…¨éƒ¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚Œã°okã§ã™ï¼ (NG) ã‚ãªãŸã®åå‰ã¯ <?= $name ?> ã§ã™ãï¼ â†“ (OK) ã‚ãªãŸã®åå‰ã¯ <?= htmlspecialchars($name, ENT_QUOTES) ?>
tacshiss 2012/02/16
php

security
ãƒªãƒ³ã‚¯
HTML5 Security Cheatsheet
HTML5 Security CheatsheetWhat your browser does when you look away...
tacshiss 2012/02/15
html5

security
ãƒªãƒ³ã‚¯
Googleã®è³žé‡‘ä»˜ãè„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã¯ã€Œå¤§æˆåŠŸã€ã€Chromium OSã«ã‚‚å¯¾è±¡æ‹¡å¤§
ã€Œè³žé‡‘åˆ¶åº¦ã«ã‚ˆã£ã¦è„†å¼±æ€§ç ”ç©¶ã¸ã®å‚åŠ ãŒåºƒãŒã‚Šã€ãã‚Œã ã‘å¤šãã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã¨ã£ã¦ã®å®‰å…¨æ€§ãŒé«˜ã¾ã£ãŸã€ã¨Googleã€‚ ç±³Googleã¯ã€Webãƒ–ãƒ©ã‚¦ã‚¶ã€ŒChromeã€ãªã©ã®è„†å¼±æ€§æƒ…å ±ã«è³žé‡‘ã‚’æ”¯æ‰•ã†åˆ¶åº¦ã«ã¤ã„ã¦ã€å°Žå…¥ã‹ã‚‰2å¹´ã‚’çµŒã¦ã€Œã‚ã‚‰ã‚†ã‚‹ç‚¹ã§å¤§ããªæˆåŠŸã‚’åŽã‚ãŸã€ã¨æŒ¯ã‚Šè¿”ã‚‹ã¨ã¨ã‚‚ã«ã€ä»Šå¾Œã¯Chromium OSã‚‚åŒåˆ¶åº¦ã®å¯¾è±¡ã«ã™ã‚‹ã¨ç™ºè¡¨ã—ãŸã€‚ Googleã¯2010å¹´1æœˆã‹ã‚‰Chromeã®è„†å¼±æ€§ã‚’ç™ºè¦‹ãƒ»å ±å‘Šã—ãŸç ”ç©¶è€…ãªã©ã«è³žé‡‘ã‚’é€²å‘ˆã™ã‚‹åˆ¶åº¦ã‚’é–‹å§‹ã—ã€ã“ã‚Œã¾ã§ã«æ”¯æ‰•ã£ãŸè³žé‡‘ã®ç·é¡ã¯30ä¸‡ãƒ‰ãƒ«ã‚’è¶…ãˆãŸã€‚ åŒå¹´11æœˆã«ã¯ã€Œgoogle.comã€ã‚„ã€Œyoutube.comã€ãªã©ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¯¾è±¡ã‚’æ‹¡å¤§ã—ã€ã“ã‚Œã¾ã§ã«200äººä»¥ä¸ŠãŒ1100ä»¶ã‚’è¶…ã™å•é¡Œã‚’å ±å‘Šã€‚ã†ã¡730ä»¶ã«ã¤ã„ã¦ç·é¡41ä¸‡ãƒ‰ãƒ«ä»¥ä¸Šã®è³žé‡‘ã‚’é€²å‘ˆã—ã€å ±å‘Šè€…ã®åŽšæ„ã«ã‚ˆã£ã¦1ä¸‡9000ãƒ‰ãƒ«ã¯æ…ˆå–„äº‹æ¥ã«å¯„ä»˜ã—ãŸã¨ã„ã†ã€‚
tacshiss 2012/02/13
security
ãƒªãƒ³ã‚¯
å˜ãªã‚‹ OAuth 2.0 ã‚’èªè¨¼ã«ä½¿ã†ã¨ã€è»ŠãŒé€šã‚Œã‚‹ã»ã©ã®ã©ã§ã‹ã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ãƒ»ãƒ›ãƒ¼ãƒ«ãŒã§ãã‚‹
In some of the feedback I have gotten on the openID Connect spec, the statement is made that Connect is too complicated. That OAuth 2.0 is all you need to do authentication. Many point to Identity Proâ€¦ è‹±èªžèªã¿ãŸããªã„ã¨ã„ã†äººã®ãŸã‚ã«ç°¡å˜ã«è§£èª¬ã™ã‚‹ã¨â€¦ OAuth 2.0 ã® implicit flow ã‚’ä½¿ã£ã¦ã€Œèªè¨¼ã€ã‚’ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€ã¨ã£ã¦ã‚‚å¤§ããªç©´ãŒé–‹ãã¾ã™ã€‚ ã‚«ãƒƒãƒˆï¼†ãƒšãƒ¼ã‚¹ãƒˆã‚¢ã‚¿ãƒƒã‚¯ãŒå¯èƒ½ã ã‹ã‚‰ã§ã™ã€‚ OAuth èªè¨¼ï¼Ÿã¯ã€å›³ï¼‘ã®ã‚ˆã†ãªæµã‚Œã«ãªã‚Šã¾ã™ã€‚ å›³ï¼‘ OAuth èªè¨¼ï¼Ÿã®æµã‚Œ ä¸€è¦‹ã€å•é¡Œãªã•ãã†ã«è¦‹ãˆã¾ã™ã€‚ã—ã‹ã—ã€ãã‚Œã¯ã™ã¹ã¦ã®ã‚µã‚¤ãƒˆãŒã€Œè‰¯ã„ã‚µã‚¤ãƒˆã€ãªã‚‰ã°ã§ã™ã€‚ Site_A
tacshiss 2012/02/03
OAuth

security
ãƒªãƒ³ã‚¯
Content Security Policy
This document defines a policy language used to declare a set of content restrictions for a web resource, and a mechanism for transmitting the policy from a server to a client where the policy is enforced. This is a public copy of the editorsâ€™ draft. It is provided for discussion only and may change at any moment. Its publication here does not imply endorsement of its contents by W3C. Donâ€™t cite t
tacshiss 2012/01/13
Content Security Policy

JavaScript

security
ãƒªãƒ³ã‚¯
AndroidãŒãƒžãƒ«ã‚¦ã‚§ã‚¢ã®æœ€å¤§ã®æ¨™çš„ã«â€•â€•McAfeeã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹•å‘å ±å‘Šæ›¸
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ã®ç±³McAfeeã¯11æœˆ21æ—¥ã«ç™ºè¡¨ã—ãŸ2011å¹´7ï½ž9æœˆæœŸã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹•å‘å ±å‘Šæ›¸ã§ã€Googleã®AndroidãŒãƒ¢ãƒã‚¤ãƒ«ãƒžãƒ«ã‚¦ã‚§ã‚¢ã®æœ€å¤§ã®æ¨™çš„ã¨ãªã‚‹å‚¾å‘ãŒé®®æ˜Žã«ãªã£ãŸã¨å ±å‘Šã—ãŸã€‚ ãã‚Œã«ã‚ˆã‚‹ã¨ã€Androidæè¼‰ç«¯æœ«ã®æ™®åŠã«ä¼´ã„ã€Androidã‚’ç‹™ã£ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã¯å‰æœŸã«æ¯”ã¹ç´„37ï¼…å¢—åŠ ã—ãŸã€‚ã“ã®æ™‚æœŸã«æ–°ãŸã«å‡ºç¾ã—ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã¯ã€å…¨ã¦AndroidãŒæ¨™çš„ã ã£ãŸã¨ã„ã†ã€‚ä¸ã§ã‚‚SMSã‚’é€ä¿¡ã—ãŸã‚Šå€‹äººæƒ…å ±ãªã©ã‚’ç›—ã‚“ã ã‚Šã™ã‚‹ãƒˆãƒã‚¤ã®æœ¨é¦¬åž‹ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚„ã€é€šè©±ã®å†…å®¹ã‚’éŒ²éŸ³ã—ã¦æ”»æ’ƒè€…ã«é€ä¿¡ã™ã‚‹ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒå¤šæ•°ã‚’å ã‚ã¦ã„ãŸã€‚ PCã‚’ç‹™ã£ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã§ã¯ã€å½ã‚¦ã‚¤ãƒ«ã‚¹å¯¾ç–ã‚½ãƒ•ãƒˆã‚„AutoRunã‚’åˆ©ç”¨ã—ã¦æ„ŸæŸ“ã™ã‚‹ãƒžãƒ«ã‚¦ã‚§ã‚¢ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ç›—ã¿å‡ºã™ãƒˆãƒã‚¤ã®æœ¨é¦¬ãŒä¾ç„¶ã¨ã—ã¦æ¨ªè¡Œã€‚ã¾ãŸã€Macã‚’ç‹™ã£ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚‚å¼•ãç¶šãå¢—åŠ å‚¾å‘ã«ã‚ã‚‹ã¨ã—ãŸã€‚ ä¸€æ–¹ã€ã‚¹ãƒ‘ãƒ ãƒ¡ãƒ¼ãƒ«ã¯æµé€šé‡ã‚’è¦‹ã‚‹ã¨2007å¹´ä»¥æ¥æœ€ä½Žã®ãƒ¬
tacshiss 2011/11/22
security
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒ•ã«ã‚„ã•ã—ã„SSLè¨¼æ˜Žæ›¸ by ã‚¨ã‚¹ãƒã‚¸ã‚«ãƒ«
RapidSSL 3,630å†† ä¼æ¥èªè¨¼OV 24,970å††ï½ž ä½Žä¾¡æ ¼SSLè¨¼æ˜Žæ›¸ã€ãªã‚“ã§ã‚‚ã‚µãƒãƒ¼ãƒˆã€‚ SSLè¨¼æ˜Žæ›¸ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ç¢ºèªãƒ„ãƒ¼ãƒ« | CSRä½œæˆ | Whoisæ¤œç´¢
tacshiss 2011/11/18
security

ssl
ãƒªãƒ³ã‚¯
ä¸æ£QRã‚³ãƒ¼ãƒ‰ã§æ‹¡æ•£ã™ã‚‹Androidãƒžãƒ«ã‚¦ã‚¨ã‚¢
æµ·å¤–ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ™ãƒ³ãƒ€ãƒ¼ãŒå…¬é–‹ã™ã‚‹ãƒ–ãƒã‚°ã®ä¸ã‹ã‚‰ã€æœ€è¿‘ã®è„…å¨ã‚„å‹•å‘ã‚’ã¤ã‹ã‚ã‚‹ã‚‚ã®ã‚’ç´¹ä»‹ã—ã‚ˆã†ã€‚ã¾ãšæœ€åˆã¯QRã‚³ãƒ¼ãƒ‰ã¨ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã«é–¢ã™ã‚‹è©±é¡Œã ã€‚ QRã‚³ãƒ¼ãƒ‰ã¯ã€ç¾åœ¨ã§ã¯ç‰¹å®šã®æƒ…å ±ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ãŸã‚ã«ãƒãƒŠãƒ¼åºƒå‘Šã‚„é›‘èªŒãªã©ã§ã‚ˆãä½¿ã‚ã‚Œã¦ã„ã‚‹ã€‚è‹±ã‚½ãƒ•ã‚©ã‚¹ã¯ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã§èªã¿è¾¼ã‚€ã¨æ‚ªæ„ã®ã‚ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ã—ãŸURLã«èª˜å°Žã™ã‚‹ä¸æ£QRã‚³ãƒ¼ãƒ‰ã«ã¤ã„ã¦ãƒ–ãƒã‚°ã§èª¬æ˜Žã—ãŸã€‚ã“ã†ã—ãŸQRã‚³ãƒ¼ãƒ‰ã¯æ—¢ã«å˜åœ¨ã—ã€åºƒã¾ã‚Šã¤ã¤ã‚ã‚‹ã€‚ ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³å‘ã‘ã®æ–°ã—ã„ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã‚’ãƒ‘ã‚½ã‚³ãƒ³ã§æŽ¢ã™ã“ã¨ãŒã‚ˆãã‚ã‚‹ã€‚ä½•ã‹é¢ç™½ã„ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã‚’è¦‹ã¤ã‘ã¦ã‚‚ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‹ã‚‰ã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã™ã‚‹ã®ã«ç«¯æœ«ã®ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ã§URLã‚’å…¥åŠ›ã™ã‚‹ã®ã¯æ‰‹é–“ãŒã‹ã‹ã‚‹ã€‚ãã®ãŸã‚ã€URLã‚’ç°¡å˜ã«èªã¿è¾¼ã‚ã‚‹QRã‚³ãƒ¼ãƒ‰ãŒã‚µã‚¤ãƒˆã«ç”¨æ„ã•ã‚Œã¦ã„ã‚‹ã€‚ ç¾åœ¨ã€SMSåž‹ãƒˆãƒã‚¤ã®æœ¨é¦¬ã‚’ä¸å¿ƒã¨ã—ãŸå¤šãã®ãƒ¢ãƒã‚¤ãƒ«ãƒžãƒ«ã‚¦ã‚¨ã‚¢
tacshiss 2011/11/14
ã‚‚ã†ä½•ã‚‚ä¿¡ã˜ã‚‰ã‚Œãªã„

security
ãƒªãƒ³ã‚¯
javascript: escape(), encodeURI(), encodeURIComponent() æ¯”è¼ƒ (groundwalker.com)
Â« DoBeDo 2.5 | ãƒ¡ã‚¤ãƒ³ | javascript ã§ Query String Â» javascript: escape(), encodeURI(), encodeURIComponent() æ¯”è¼ƒ javascript ã® escape(), encodeURI(), encodeURIComponent() é–¢æ•°ç¾¤ã«ã¤ã„ã¦ã€ã©ã®æ–‡å—ãŒã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã•ã‚Œã¦ã©ã®æ–‡å—ãŒã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã•ã‚Œãªã„ã®ã‹åˆ†ã‹ã‚Šã«ãã„ã®ã§ã¾ã¨ã‚ã¦ãŠãã€‚ ã¾ãšã¯ã€å¯¾è±¡ç¯„å›² %20ï¼ˆåŠè§’ã‚¹ãƒšãƒ¼ã‚¹ï¼‰ã€œ%7Eï¼ˆãƒãƒ«ãƒ€~ï¼‰ å…ƒãƒ‡ãƒ¼ã‚¿ !"#$%&'()*+,-./ 0123456789 :;<=>?@ ABCDEFGHIJKLMNOPQRSTUVWXYZ [\]^_` abcdefghijklmnopqrstuvwxyz {|}~ escape() %20%21%22%23%24%25%26%27%28%29*+%2C-
tacshiss 2011/09/28
javascript

security
ãƒªãƒ³ã‚¯
Cross-Origin Resource Sharing (CORS) - HTTP | MDN
Cross-Origin Resource Sharing (CORS) is a mechanism that uses additional HTTP headers to tell browsers to give a web application running at one origin, access to selected resources from a different origin. A web application executes a cross-origin HTTP request when it requests a resource that has a different origin (domain, protocol, or port) from its own. An example of a cross-origin request: the
tacshiss 2011/09/28
security

javascript

xmlhttprequest

ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³
ãƒªãƒ³ã‚¯
æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŠ€è¡“å‹•å‘èª¿æŸ»ï¼ˆ2011 å¹´ä¸ŠæœŸï¼‰ï¼šIPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
ã“ã®ä½•å¹´ã‹ã§Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã€ã‚µãƒ¼ãƒä¸Šã®ã¿ã§ãƒ—ãƒã‚°ãƒ©ãƒ ãŒå‹•ä½œã™ã‚‹ã‚‚ã®ã‹ã‚‰ã€å¤šãã®JavaScriptã‚³ãƒ¼ãƒ‰ãŒWebãƒ–ãƒ©ã‚¦ã‚¶ã§å‹•ä½œã—ã€èƒŒå¾Œã§ã‚µãƒ¼ãƒã¨é€£æºã—ã¦ã€ãƒªãƒƒãƒã‹ã¤ã‚¹ãƒ ãƒ¼ã‚ºãªæ“ä½œæ„Ÿã‚’æä¾›ã™ã‚‹ã‚‚ã®ã¸ã¨é€²åŒ–ã—ã¦ããŸã€‚ã“ã®ã“ã¨ã¯ã€Webãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã«æ‚ªæ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’é€ã‚Šè¾¼ã‚€ã€Œã‚¹ã‚¯ãƒªãƒ—ãƒˆæ³¨å…¥ï¼ˆXSSï¼‰ã€æ”»æ’ƒã‚’ã€ã‚ˆã‚Šé˜²æ¢ã—ã¥ã‚‰ãã€æ‚ªç”¨ã®æ‡¸å¿µãŒã‚ˆã‚Šå¤§ããªã‚‚ã®ã«å¤‰åŒ–ã•ã›ãŸã€‚æœ¬ç¨¿ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«Ajaxç‰ã®é€²åŒ–ã‚’ã‚‚ãŸã‚‰ã—ãŸæŠ€è¡“ã«ã¤ã„ã¦æŒ¯ã‚Šè¿”ã‚‹ã¨ã¨ã‚‚ã«ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆæ³¨å…¥å¯¾ç–ã‚’è€ƒæ…®ã™ã¹ãæ–°ãŸãªæ–‡è„ˆã«ã¤ã„ã¦è«–ã˜ã‚‹ã‚‚ã®ã§ã‚ã‚‹ã€‚ Ajaxï¼ˆAsynchronous JavaScript and XMLï¼‰[1]ã¯ã€å¿…è¦ã¨ãªã‚‹ãƒ‡ãƒ¼ã‚¿ã‚’éžåŒæœŸã§Webã‚µãƒ¼ãƒã‹ã‚‰å–ã‚Šå¯„ã›ã¤ã¤ã€Webãƒ–ãƒ©ã‚¦ã‚¶ã®ç”»é¢ä¸Šã§ãªã‚ã‚‰ã‹ãªæ“ä½œæ€§ã‚’æä¾›ã™ã‚‹å½¢æ…‹ã®JavaScriptãƒ—ãƒã‚°ãƒ©ãƒ ã®ã“ã¨ã§ã‚ã‚‹ã€‚ã‹ã¤ã¦ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«ãŠã„ã¦ã¯ã“ã®
tacshiss 2011/09/28
security
ãƒªãƒ³ã‚¯
reCAPTCHA
reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked.
tacshiss 2011/06/30
google

webã‚µãƒ¼ãƒ“ã‚¹

security
ãƒªãƒ³ã‚¯
Googleã®é–‹ç™ºè€…æ”¯æ´ãƒ„ãƒ¼ãƒ«ã€ŒDOM Snitchã€ã€Webã‚µã‚¤ãƒˆã«æ½œã‚€å±é™ºã‚’æ¤œå‡º
DOM Snitchã§ã¯æ½œåœ¨çš„ã«å±é™ºãªJavaScriptã®ãƒ¡ã‚½ãƒƒãƒ‰ã‚„ãƒ—ãƒãƒ‘ãƒ†ã‚£ã‚’è¦‹ã¤ã‘å‡ºã—ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ãªãŒã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‹ã©ã†ã‹ã®è¨ºæ–ã«å½¹ç«‹ã¦ã‚‰ã‚Œã‚‹ã¨ã„ã†ã€‚ ç±³Googleã¯ã€Webã‚µã‚¤ãƒˆã®ã‚³ãƒ¼ãƒ‰ã‚’èª¿ã¹ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã®ç™ºè¦‹ã‚’æ”¯æ´ã™ã‚‹Chromeãƒ–ãƒ©ã‚¦ã‚¶ã®æ‹¡å¼µæ©Ÿèƒ½ã€ŒDOM Snitchã€ã®è©¦é¨“ç‰ˆã‚’é–‹ç™ºè€…å‘ã‘ã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚ Googleã®Testingãƒ–ãƒã‚°ã«ã‚ˆã‚‹ã¨ã€åŒç¤¾ãŒã“ã‚Œã¾ã§ã«æä¾›ã—ã¦ããŸé–‹ç™ºè€…å‘ã‘ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ãƒ„ãƒ¼ãƒ«ãŒã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã®ã‚³ãƒ¼ãƒ‰ã®ãƒã‚§ãƒƒã‚¯ã«ä¸»çœ¼ã‚’ç½®ã„ã¦ã„ãŸã®ã«å¯¾ã—ã€DOM Snitchã§ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã‚³ãƒ¼ãƒ‰ã®å•é¡Œã‚’è¦‹ã¤ã‘å‡ºã›ã‚‹ã®ãŒç‰¹å¾´ã ã¨ã„ã†ã€‚ åŒãƒ„ãƒ¼ãƒ«ã‚’å®Ÿè¡Œã™ã‚‹ã¨ã€ä¾‹ãˆã°ã€Œdocument.writeã€ã€ŒHTMLElement.innerHTMLã€ãªã©ã€æ½œåœ¨çš„ã«å±é™ºãªJavaScriptã®ãƒ¡ã‚½ãƒƒãƒ‰ã‚„ãƒ—ãƒãƒ‘ãƒ†ã‚£ã‚’è¦‹ã¤ã‘å‡ºã—ã€ãã®æ–‡æ›¸ã®URLã¨ã‚¹ã‚¿ãƒƒ
tacshiss 2011/06/27
google

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
tacshiss 2011/06/24
jquery

security
ãƒªãƒ³ã‚¯
ç±³æ”¿åºœé«˜å®˜ã‚‰æ•°ç™¾äººã®Gmailã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒä¸å›½ã‹ã‚‰ãƒãƒƒã‚¯ã•ã‚Œã‚‹ã€ãã®æ‰‹å£ã¨ã¯
ç±³æ”¿åºœé«˜å®˜ã‚‰æ•°ç™¾äººã®Gmailã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒä¸å›½ã‹ã‚‰ãƒãƒƒã‚¯ã•ã‚Œã‚‹ã€ãã®æ‰‹å£ã¨ã¯2011.06.05 21:00 ç¦ç”°ãƒŸãƒ› ï¼ˆç”»åƒã‚¯ãƒªãƒƒã‚¯ã§æ‹¡å¤§ã—ã¾ã™ï¼‰ ã“ã‚Œå®Ÿéš›è¦‹ã¦ã‚‚ã€è¦‹ç ´ã‚Œãªã„ã‹ã‚‚...ã€‚ å…ˆæ—¥ã€æ•°ç™¾äººåˆ†ã®Gmailã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒãƒãƒƒã‚¯ã•ã‚Œã¦ã„ãŸã“ã¨ãŒæ˜Žã‚‰ã‹ã«ãªã‚Šã¾ã—ãŸã€‚æ”»æ’ƒå¯¾è±¡ã«ã¯ç±³å›½ã®æ”¿åºœé«˜å®˜ã‚„è»é–¢ä¿‚è€…ã€éŸ“å›½ã‚„ä¸å›½ã®å®˜åƒšã‚„æ´»å‹•å®¶ãŒå«ã¾ã‚Œã¦ã„ãŸãã†ã§ã™ã€‚ ä»¥ä¸‹ã¯Googleã‹ã‚‰ã®å…¬å¼å£°æ˜Žã§ã™ã€‚ æˆ‘ã€…ã¯ã‚¯ãƒ©ã‚¦ãƒ‰ãƒ™ãƒ¼ã‚¹ã®å¼·å›ºãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ä¸æ£åˆ©ç”¨æ¤œçŸ¥ã‚·ã‚¹ãƒ†ãƒ ã‚’æœ‰ã—ã¦ã„ã¾ã™ãŒã€ãã®ä¸ã§ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã®æ‰‹å£ã«ã‚ˆã‚‹ã¨æ€ã‚ã‚Œã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰åŽé›†ã®å‹•ãã‚’ç™ºè¦‹ã—ã¾ã—ãŸã€‚ã“ã®å‹•ãã¯ä¸å›½æ¸ˆå—ã‹ã‚‰è¡Œã‚ã‚ŒãŸã‚‚ã®ã¨è€ƒãˆã‚‰ã‚Œã€æ•°ç™¾äººã®å€‹äººGmailã‚¢ã‚«ã‚¦ãƒ³ãƒˆã«å¯¾ã—ã¦è¡Œã‚ã‚Œã¦ã„ã¾ã—ãŸã€‚å¯¾è±¡ã«ã¯ç±³å›½æ”¿åºœé«˜å®˜ã‚„ä¸å›½ã®æ”¿æ²»æ´»å‹•å®¶ã€ã‚¢ã‚¸ã‚¢æ•°ã‹å›½ï¼ˆä¸»ã«éŸ“å›½ï¼‰ã®å®˜åƒšã€è»äººã€ã‚¸ãƒ£ãƒ¼ãƒŠãƒªã‚¹ãƒˆãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ Googleã«ã‚ˆã‚Œã°
tacshiss 2011/06/06
ã‚„ã¯ã‚Šã€webãƒ–ãƒ©ã‚¦ã‚¶ã«ã¯URLè¡¨ç¤ºãŒå¿…é ˆã ã‚ˆãã€‚ "ãƒ‰ãƒ¡ã‚¤ãƒ³åã‚’ç¢ºèªã™ã‚‹ã€Chromeãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿèƒ½ã‚’ä½¿ã†ã€ã¨ã„ã£ãŸã“ã¨ã‚’æŽ¨å¥¨ã—ã¦ã„ã¾ã™ã€‚"

security
ãƒªãƒ³ã‚¯
DOM APIã¨innerHTMLã¯ç‰ä¾¡ã§ã¯ãªã„
æœ€è¿‘ã€å¾³ä¸¸æœ¬ã‚’ã˜ã‚ã˜ã‚èªã‚“ã§ã„ã‚‹ã®ã§ã™ãŒã€DOM based XSSã®è©±ãŒæ›¸ã„ã¦ã‚ã£ãŸã®ã§ã€å°‘ã—è¨€åŠã—ã¦ãŠã“ã†ã¨æ€ã„ã¾ã™ã€‚ å¾³ä¸¸æœ¬ã‹ã‚‰å¼•ç”¨ DOM based XSSã¨å‘¼ã°ã‚Œã‚‹XSSãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ã€JavaScriptã«ã‚ˆã‚Šã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã§è¡¨ç¤ºå‡¦ç†ã™ã‚‹ç®‡æ‰€ãŒã‚ã‚Šã€ãã“ã«è„†å¼±æ€§ãŒã‚ã‚‹å ´åˆã®XSSã§ã™ã€‚ ã‚µãƒ³ãƒ—ãƒ«æ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ <script> document.write(unescape(location.href)); </script> ã“ã„ã¤ã‚’é©å½“ãªãƒ•ã‚¡ã‚¤ãƒ«åã§ä¿å˜ã—ã¦ã€domxss.html#<script>alert("hello")<script>ãªã©ã®URLã§ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨alertãŒè¡¨ç¤ºã•ã‚Œã‚‹ã¯ãšã§ã™ã€‚ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œå¯èƒ½ãªçŠ¶æ…‹ã£ã¦ã“ã¨ã§ã™ãã€‚ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œå¯èƒ½ã£ã¦ã“ã¨ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¯ãƒƒã‚ãƒ¼ç›—ã¿æ”¾é¡Œã§ã€ä»–äººã«æˆã‚Šæ¸ˆã¾ã—ã¦è²·ã„ç‰©ã§ãã¡ã‚ƒã£ãŸã‚Šã™ã‚‹ãƒ¬ãƒ™ãƒ«ã§ã™
tacshiss 2011/06/05
security

JavaScript

XSS
ãƒªãƒ³ã‚¯
IT news, careers, business technology, reviews
Miro boosts security for its visual collaboration app The Enterprise Guard suite will let business users automatically identify and classify sensitive data and gives IT admins more control over encryption.
tacshiss 2011/02/24
ã“

security
ãƒªãƒ³ã‚¯
Google's Vulnerability Reward Program - ma<s>atokinugawa's blog
Googleã¯2010å¹´11æœˆã‹ã‚‰Googleã®ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’å ±å‘Šã—ãŸäººã«å ±é…¬ã‚’æ”¯æ‰•ã†åˆ¶åº¦ã‚’ã‚¹ã‚¿ãƒ¼ãƒˆã—ã¾ã—ãŸã€‚åƒ•ã‚‚æ—©é€Ÿã„ãã¤ã‹å ±å‘Šã—ã€ä»¥å‰Twitterã§Googleã‹ã‚‰$7337é ‚ã„ãŸã‚ˆã¨ã¤ã¶ã‚„ãã¾ã—ãŸãŒã€ã‚ã‚Œã‹ã‚‰æ–°ãŸã«$6337ã®å…¥é‡‘ãŒã‚ã‚Šã€ä»Šã®ã¨ã“ã‚ã“ã®åˆ¶åº¦ã§$13174($1337 Ã— 2 + $1000 Ã— 2 + $500 Ã— 17)ã‚’é ‚ã„ã¦ã„ã¾ã™ï¼ã‚ã‚ŠãŒã¨ã†ï¼ è¿½è¨˜ 7337+6337=13674ãªã®ã§å…¥é‡‘ãŒã‚ã£ãŸã®ã¯$13674($1337 Ã— 2 + $1000 Ã— 2 + $500 Ã— 18)ã§ã—ãŸã€‚åˆè¨ˆã‚’é–“é•ãˆã¦ã¾ã—ãŸã€‚è¶³ã—ç®—é›£ã—ã„ï¼ï¼žï¼œ+$500ï¼ ä¿®æ£ã•ã‚ŒãŸã‚‚ã®ã¯æƒ…å ±ã‚’å…¬é–‹ã—ã¦ã‚‚ã„ã„ã¨ã®ã“ã¨ãªã®ã§ã€å ±å‘Šã—ãŸä¸ã‹ã‚‰å¤šå°‘å¤‰ã‚ã£ãŸã‚¿ã‚¤ãƒ—ã®è„†å¼±æ€§ã‚’3ã¤ç´¹ä»‹ã—ã‚ˆã†ã¨æ€ã„ã¾ã™ã€‚ <script>ã‚¿ã‚°ã®srcã‚’ç´°å·¥ã™ã‚‹ã“ã¨ã«ã‚ˆã‚‹XSS ã“ã‚“ãªãƒšãƒ¼ã‚¸
tacshiss 2011/02/07
xss

security
ãƒªãƒ³ã‚¯
1 2 3 4 æ¬¡ã®ãƒšãƒ¼ã‚¸