[B! CSRF] Kenji_sã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Kenji_s id:Kenji_s

CSRFã«é–¢ã™ã‚‹Kenji_sã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (69)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

SameSiteæ”»æ’ƒè€…ãŒCodeIgniter4ã¨Shieldã§ã®CSRFä¿è·ã‚’å›žé¿ã§ãã‚‹è„†å¼±æ€§ã®è§£èª¬ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
CodeIgniter4ã¨CodeIgniter Shieldã§ã®çµ„ã¿åˆã‚ã›ã§ã€CSRFä¿è·ã‚’å›žé¿ã§ãã‚‹è„†å¼±æ€§ã«é–¢ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹§å‘ŠãŒ2022/08/08ã«å…¬è¡¨ã•ã‚Œã¾ã—ãŸã€‚ä»Šæ—¥ã¯ã€ã“ã®è„†å¼±æ€§ã«ã¤ã„ã¦è§£èª¬ã—ã¦ãŠãã¾ã™ã€‚ SameSite Attackers may Bypass the CSRF Protection Â· Advisory Â· codeigniter4/shield ãªãŠã€ã“ã®æ”»æ’ƒæ–¹æ³•ã¯CodeIgniterã«é™å®šã•ã‚Œã‚‹ã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ä¿®æ£æ¸ˆã¿ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ CodeIgniter 4.2.3 CodeIgniter Shield 1.0.0-beta.2 å‰ææ¡ä»¶ ã“ã®è„†å¼±æ€§ã‚’æ”»æ’ƒã™ã‚‹ã«ã¯ã€æ”»æ’ƒè€…ãŒæ”»æ’ƒå¯¾è±¡ã®ã‚µã‚¤ãƒˆã¨åŒã˜ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚µã‚¤ãƒˆã‚’æ”¯é…ä¸‹ã«ç½®ã„ã¦ã„ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ ç°¡å˜ã«è¨€ãˆã°ã€ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚µã‚¤ãƒˆã®ãƒšãƒ¼ã‚¸ã‚’æ›¸ãæ›ãˆã‚‰ã‚Œã‚‹ã¨ã„ã†ã“ã¨ã§ã™ã€‚ã“ã‚Œã¯ãã®ã‚µ
Kenji_s 2022/08/16
CodeIgniter4

CSRF

Auth
ãƒªãƒ³ã‚¯
2022å¹´1æœˆã«ãŠã„ã¦CSRFæœªå¯¾ç–ã®ã‚µã‚¤ãƒˆã¯ã©ã®æ¡ä»¶ã§è¢«å®³ã‚’å—ã‘ã‚‹ã‹
ã‚µãƒžãƒª2020å¹´2æœˆã«Google Chromeã¯Cookieã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®æŒ™å‹•ã‚’samesite=laxã«å¤‰æ›´ã—ã¾ã—ãŸãŒã€2022å¹´1æœˆ11æ—¥ã«Firefoxã‚‚åŒæ§˜ã®ä»•æ§˜ãŒå°Žå…¥ã•ã‚Œã¾ã—ãŸã€‚ã“ã®å¤‰æ›´ã¯ãƒ–ãƒ©ã‚¦ã‚¶å´ã§CSRFè„†å¼±æ€§ã‚’ç·©å’Œã™ã‚‹ãŸã‚ã®ã‚‚ã®ã§ã€ç‰¹å®šã®æ¡ä»¶ä¸‹ã§ã¯ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆå´ã§CSRFå¯¾ç–ã‚’ã—ã¦ã„ãªãã¦ã‚‚CSRFæ”»æ’ƒã‚’å—ã‘ãªããªã‚Šã¾ã™ã€‚ã“ã®è¨˜äº‹ã§ã¯ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxã«ã¤ã„ã¦ã®åŸºç¤Žçš„ãªèª¬æ˜Žã«åŠ ãˆã€æœ€è¿‘ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®æŒ™å‹•ã®é•ã„ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ ï¼ˆ2022å¹´1æœˆ29æ—¥è¿½è¨˜ï¼‰ æœ¬æ—¥ç¢ºèªã—ãŸã¨ã“ã‚ã€Firefoxã«ãŠã‘ã‚‹ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxã¯ã‚ãƒ£ãƒ³ã‚»ãƒ«ã•ã‚Œã€å¾“æ¥ã®æŒ™å‹•ã«æˆ»ã£ãŸã‚ˆã†ã§ã™ï¼ˆFirefox 96.0.3ã«ã¦ç¢ºèªï¼‰ã€‚ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxè‡ªä½“ã¯å…ˆè¡Œã—ã¦Google Chromeã«ã¦å®Ÿè£…ã•ã‚Œã¦ã„ã¾ã—ãŸãŒã€ç´°ã‹ã„æŒ™å‹•ã®å·®ç•°ã§æ—¢å˜ã‚µã‚¤ãƒˆã«ä¸å…·åˆãŒ
Kenji_s 2022/01/28
CSRF
ãƒªãƒ³ã‚¯
è§£ç”ï¼šCSRFã®é˜²æ¢ç–ã«é–¢ã™ã‚‹ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã«ãƒ„ãƒƒã‚³ãƒŸã‚’å…¥ã‚Œã‚‹
ã“ã®è¨˜äº‹ã¯ã€å…ˆæ—¥ã®è¨˜äº‹ã€Œå•é¡Œï¼šCSRFã®é˜²æ¢ç–ã«é–¢ã™ã‚‹ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã«ãƒ„ãƒƒã‚³ãƒŸã‚’å…¥ã‚Œã‚‹ã€ã«å¯¾ã™ã‚‹è§£ç”ç·¨ã§ã™ã€‚ã¾ã å•é¡Œã‚’è¦‹ã¦ã„ãªã„æ–¹ã¯ã€å…ˆã«å•é¡Œã‚’èªã‚“ã§ï¼ˆã§ãã‚Œã°è‡ªåˆ†ã§è§£ç”ã‚’è€ƒãˆã¦ï¼‰ã‹ã‚‰ã“ã®è¨˜äº‹ã‚’ãŠèªã¿ã„ãŸã ãã¨ã‚ˆã„ã¨æ€ã„ã¾ã™ã€‚ ãã‚Œã§ã¯ã€è§£ç”ã‚’èª¬æ˜Žã—ã¾ã™ã€‚ è¨å•: ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆæ—§ç‰ˆã®ç¿»è¨³ã§ã‚ã‚‹JPCERT/CCè¨³ï¼ˆä»¥ä¸‹ã®å¼•ç”¨éƒ¨åˆ†ï¼‰ã‚’å…ƒã«ä»¥ä¸‹ã®è¨å•ã«ç”ãˆã‚ˆã€‚ å¼•ç”¨ï¼ˆå†æŽ²ï¼‰ Cookie ã®äºŒé‡é€ä¿¡ Cookie ã®äºŒé‡é€ä¿¡ã¯ã€Cookie ãŠã‚ˆã³ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ãƒ¼ã®åŒæ–¹ã§ãƒ©ãƒ³ãƒ€ãƒ ãªå€¤ã‚’é€ä¿¡ã—ã€ã‚µãƒ¼ãƒãƒ¼å´ã§ Cookie ã®å€¤ã¨ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®å€¤ãŒç‰ã—ã„ã‹ã©ã†ã‹æ¤œè¨¼ã™ã‚‹æ‰‹æ³•ã§ã™ã€‚ ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã‚µã‚¤ãƒˆã«ãƒã‚°ã‚¤ãƒ³ ã™ã‚‹ã¨ãã€ã‚µã‚¤ãƒˆã¯æš—å·å¼·åº¦ã®é«˜ã„ç–‘ä¼¼ãƒ©ãƒ³ãƒ€ãƒ å€¤ã‚’ç”Ÿæˆã—ã€ãã®å€¤ã‚’ Cookie ã¨ã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒžã‚·ãƒ³ã«ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ ID ã¨ã¯åˆ¥ã«é€ã‚Šã¾ã™ ã€‚ã©ã‚“ãªå½¢ã§ã‚ã‚Œã€ã‚µã‚¤ãƒˆã¯ã“ã®å€¤ã‚’ä¿å˜ã—ã¦ãŠãå¿…
Kenji_s 2021/10/08
CSRF
ãƒªãƒ³ã‚¯
SPAã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€ï½žPHP Conference Japan 2021
2. å¾³ä¸¸æµ©ã®è‡ªå·±ç´¹ä»‹ â€¢ çµŒæ´ â€“ 1985å¹´ äº¬ã‚»ãƒ©æ ªå¼ä¼šç¤¾å…¥ç¤¾ â€“ 1995å¹´ äº¬ã‚»ãƒ©ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚·ã‚¹ãƒ†ãƒ æ ªå¼ä¼šç¤¾(KCCS)ã«å‡ºå‘ãƒ»è»¢ç± â€“ 2008å¹´ KCCSé€€è·ã€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾(ç¾ç¤¾å:EGã‚»ã‚ãƒ¥ã‚¢ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã‚ºæ ªå¼ä¼šç¤¾)è¨ç«‹ â€¢ çµŒé¨“ã—ãŸã“ã¨ â€“ äº¬ã‚»ãƒ©å…¥ç¤¾å½“æ™‚ã¯CADã€è¨ˆç®—å¹¾ä½•å¦ã€æ•°å€¤ã‚·ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãªã©ã‚’æ‹…å½“ â€“ ãã®å¾Œã€ä¼æ¥å‘ã‘ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚½ãƒ•ãƒˆã®ä¼ç”»ãƒ»é–‹ç™ºãƒ»äº‹æ¥åŒ–ã‚’æ‹…å½“ â€“ 1999å¹´ã‹ã‚‰ã€æºå¸¯é›»è©±å‘ã‘ã‚¤ãƒ³ãƒ•ãƒ©ã€ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã®ä¼ç”»ãƒ»é–‹ç™ºã‚’æ‹…å½“ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ç›´é¢ã€ç ”ç©¶ã€ç¤¾å†…å±•é–‹ã€å¯„ç¨¿ãªã©ã‚’é–‹å§‹ â€“ 2004å¹´ã«KCCSç¤¾å†…ãƒ™ãƒ³ãƒãƒ£ãƒ¼ã¨ã—ã¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ¥ã‚’ç«‹ã¡ä¸Šã’ â€¢ ç¾åœ¨ â€“ EGã‚»ã‚ãƒ¥ã‚¢ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã‚ºæ ªå¼ä¼šç¤¾å–ç· å½¹CTO https://www.eg-secure.co.jp/ â€“
Kenji_s 2021/10/03
PHP

Conference

Security

JWT

CORS

SPA

CSRF
ãƒªãƒ³ã‚¯
How to Send AJAX request with CSRF token in CodeIgniter 4 - Makitweb
Kenji_s 2020/12/20
CodeIgniter4

Ajax

CSRF
ãƒªãƒ³ã‚¯
PHPã§CSRFå¯¾ç–ã‚’è‡ªå‹•çš„ã«è¡Œã†æ–¹æ³•
(Last Updated On: 2018å¹´8æœˆ13æ—¥)PHPã§Webãƒšãƒ¼ã‚¸ã«CSRFå¯¾ç–ã‚’è¿½åŠ ã™ã‚‹ã®ã¯ç°¡å˜ã§ã™ã€‚å…¨ã¦ã®ãƒšãƒ¼ã‚¸ã«CSRFå¯¾ç–ã‚’è¿½åŠ ã™ã‚‹å ´åˆã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ï¼‘ã¤ã‚¤ãƒ³ã‚¯ãƒ«ãƒ¼ãƒ‰ã™ã‚‹ä»¥å¤–ã€ã»ã¨ã‚“ã©ä½•ã‚‚è¡Œã†å¿…è¦ãŒã‚ã‚Šã¾ã›ã‚“ã€‚ CSRF Protection for PHPã®æ©Ÿèƒ½ è‡ªå‹•çš„ã«HTMLãƒ•ã‚©ãƒ¼ãƒ ã‚„ãƒªãƒ³ã‚¯ã«CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’è¿½åŠ CSRFãƒˆãƒ¼ã‚¯ãƒ³ã®æœ‰åŠ¹æœŸé™ã‚’è¨å®šå¯èƒ½ ã¾ã ã¾ã å¤šãã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒå›ºå®šã‹ã¤æœ‰åŠ¹æœŸé™ã‚’è¨å®šã—ãªã„ã®CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’ä½¿ã£ã¦ã„ã¾ã™ã€‚ã“ã®çŠ¶æ…‹ã§ã¯ä¸€æ—¦CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’ç›—ã¾ã‚Œã‚‹ã¨ã€æ”»æ’ƒè€…ã«ã„ã¤ã¾ã§ã§ã‚‚æ”»æ’ƒã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã“ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å ´åˆã€æœ‰åŠ¹æœŸé™ä»˜ãã®CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’Webãƒšãƒ¼ã‚¸ã«è‡ªå‹•è¿½åŠ ã—ã¦é˜²å¾¡ã—ã¾ã™ã€‚ å¾Œã§è¨˜è¼‰ã™ã‚‹ã‚ˆã†ã«PHP 7.1ã§output_rewrite_var()ã®ãƒã‚°ã‚’å®Œå…¨ã«ç›´ã—ã¾ã—ãŸã€‚ãªã®ã§PHP 7.1ä»¥é™ã®åˆ©ç”¨ãŒãŠå‹§
Kenji_s 2018/06/01
PHP

CSRF
ãƒªãƒ³ã‚¯
ã‚ˆã‚Šé«˜åº¦ãªCSRFå¯¾ç– â€“ URL/URIå€‹åˆ¥ã«ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã™ã‚‹æ–¹æ³•
(Last Updated On: 2018å¹´8æœˆ13æ—¥)ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã¯è‰²ã€…ãªå ´é¢ã§åˆ©ç”¨ã§ãã¾ã™ã€‚ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ä½¿ã„æ–¹ã€ç‰¹ã«ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«ã‚µã‚¤ãƒ³ã™ã‚‹æ–¹æ³•ã¨ã—ã¦ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚’ä½¿ã‚ãšURIå€‹åˆ¥ã®CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’ç”Ÿæˆã—ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã™ã‚‹æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ è«–ç†çš„ãªèƒŒæ™¯ ã¾ãšå‰ææ¡ä»¶ã¨ãªã‚‹çŸ¥è˜ã‚’æ•´ç†ã—ã€ãªãœã“ã®ã‚¨ãƒ³ãƒˆãƒªã®ã‚ˆã†ãªãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ä½¿ã„æ–¹ã‚’ã—ã¦ã„ã‚‹ã®ã‹ç´¹ä»‹ã—ã¾ã™ã€‚ å¤§åˆ¥ã™ã‚‹ã¨ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã«ã¯äºŒç¨®é¡žã‚ã‚Šã¾ã™ã€‚ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ç¨®åˆ¥ã‚’æ£ã—ãåŒºåˆ¥ã™ã‚‹ã“ã¨ãŒé‡è¦ã§ã™ã€‚ æš—å·å¦çš„ãªãƒãƒƒã‚·ãƒ¥é–¢æ•° â€“ SHA2ãªã© æš—å·å¦çš„ã§ãªã„ãƒãƒƒã‚·ãƒ¥é–¢æ•°Â â€“ CRCãªã© æš—å·å¦çš„ãªãƒãƒƒã‚·ãƒ¥é–¢æ•°ã«ã¯æ¬¡ã®ç‰¹å¾´ãŒã‚ã‚Šã¾ã™ã€‚ åŒä¸€ã®ãƒãƒƒã‚·ãƒ¥å€¤ã§ã‚ã‚‹ã®ã«ã€ãã£ãã‚Šã ãŒå®Ÿã¯ç•°ãªã‚‹ã¨ã„ã†ã‚ˆã†ãªãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®ä½œæˆãŒä¸å¯èƒ½ã§ã‚ã‚‹ã“ã¨ ãƒãƒƒã‚·ãƒ¥å€¤ã‹ã‚‰ã€ãã®ã‚ˆã†ãªãƒãƒƒã‚·ãƒ¥å€¤ã¨ãªã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å¾—ã‚‹ã“ã¨ãŒ(äº‹å®Ÿä¸Š)ä¸å¯èƒ½ã§ã‚ã‚‹ã“
Kenji_s 2017/02/28
CSRF
ãƒªãƒ³ã‚¯
ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’CSRFãƒˆãƒ¼ã‚¯ãƒ³ã«ä½¿ã†ã¹ãã§ãªã„ç†ç”±
malaã•ã‚“ã‚‚2å¹´ç¨‹å‰ã«æ›¸ã‹ã‚Œã¦ã„ã‚‹ã®ã§ã™ãŒã€æœªã ã«å›½å†…ã®CSRFå¯¾ç–ã®è§£èª¬ã§ã€Œã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’CSRFãƒˆãƒ¼ã‚¯ãƒ³ã¨ã—ã¦ä½¿ã†ã€ã¨ã„ã†ã‚¢ã‚¤ãƒ‡ã‚¢ãŒæŠ«éœ²ã•ã‚Œã¦ã„ã¦è¾Ÿæ˜“ã—ã¾ã™ã€‚ å–©ãˆè©±ã¯å¥½ãã§ãªã„ã§ã™ãŒã€ã€Œè¤‡æ•°ã®ã‚µã‚¤ãƒˆã§åŒã˜ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦ã„ãŸã‚‰ä¸€ç®‡æ‰€ã‹ã‚‰æ¼æ´©ã—ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒªã‚¹ãƒˆæ”»æ’ƒã‚’å—ã‘ãŸã€ã¨ã„ã†ã®ã‚’å½·å½¿ã—ã¾ã™ã€‚ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã¨CSRFãƒˆãƒ¼ã‚¯ãƒ³ã¯å˜ç´”ã«åˆ¥ã®å€¤ã«ã—ãŸæ–¹ãŒã„ã„ã§ã™ã€‚ ã•ã¦ã“ã®ã‚¨ãƒ³ãƒˆãƒªã®æœ¬é¡Œã¯ã“ã“ã‹ã‚‰ã§ã€CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚ˆã‚Šã‚‚ã‚€ã—ã‚ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã®æ–¹ã§ã™ã€‚æœ€è¿‘ã¯443ç•ªãƒãƒ¼ãƒˆã¸ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã§ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å¤§é‡ã«é€ã‚‰ã›ã¦ãã‚Œã‚’ã‚ãƒ£ãƒ—ãƒãƒ£ã—ã€ã™ã¹ã¦ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«å…±é€šã—ã¦å«ã¾ã‚Œã¦ãã‚‹Cookieä¸ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’è§£èªã™ã‚‹BEAST/CRIMEç³»ã®æ”»æ’ƒãŒçŸ¥ã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ã“ã‚Œã‚‰ã¯åŸºæœ¬çš„ã«ã¯TLS/SSLã®å•é¡Œã§ã‚ã‚Šãã‚Œãžã‚Œå€‹åˆ¥ã«å¯¾ç–ãŒå˜åœ¨ã—ã¦ã„ã‚‹ã‚‚ã®ã®ã€åŸºæœ¬çš„ã«ã¯ã€Œã‚»ãƒƒã‚·ãƒ§ãƒ³IDãŒãš
Kenji_s 2016/12/21
CSRF
ãƒªãƒ³ã‚¯
VALUE-DOMAIN ã«å˜åœ¨ã—ã¦ã„ãŸã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¹—ã£å–ã‚Šå¯èƒ½ãª CSRF è„†å¼±æ€§ã«ã¤ã„ã¦ - debiruã¯ã¦ãªãƒ¡ãƒ¢
2015å¹´12æœˆã«ç§ãŒç™ºè¦‹ã—ãŸ VALUE-DOMAIN ã§ã® CSRF è„†å¼±æ€§ã«ã¤ã„ã¦ã€ãã®è„†å¼±æ€§ã®å ±å‘Šã¨ä¿®æ£ã¾ã§ã®çµŒç·¯ã‚’è¨˜ã—ã¦ãŠãã¾ã™ã€‚ ãã£ã‹ã‘ ã‚¢ã‚«ã‚¦ãƒ³ãƒˆå‰Šé™¤ãƒšãƒ¼ã‚¸ã®ä½œã‚Š ã‚¢ã‚«ã‚¦ãƒ³ãƒˆå‰Šé™¤ãƒšãƒ¼ã‚¸ã®å•é¡Œç‚¹ VALUE-DOMAIN ã¸ã®å ±å‘Š CSRF æ”»æ’ƒã«ã‚ˆã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¹—ã£å–ã‚Šã®å•é¡Œ IPA ã¸ã®å±Šå‡º ä½™è«‡ï¼šIPA ã¸ã®å±Šå‡ºã®ä»•æ–¹ã«ã¤ã„ã¦ IPA ã¸å±Šå‡ºã—ãŸå¾Œã®çŠ¶æ³ VALUE-DOMAIN ãƒ¦ãƒ¼ã‚¶ã®æ–¹ã¸ ãã£ã‹ã‘ æ•°å¹´å‰ã« VALUE-DOMAIN ã‚’åˆ©ç”¨ã—ã¦ã„ã¾ã—ãŸãŒæœ€è¿‘ã¯ä½¿ã£ã¦ã„ãªã„ã®ã§ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’å‰Šé™¤ã—ã‚ˆã†ã¨ã—ãŸã¨ã“ã‚ã€ã‚¢ã‚«ã‚¦ãƒ³ãƒˆå‰Šé™¤æ“ä½œã‚’è¡Œã†ãƒšãƒ¼ã‚¸ã®ä½œã‚ŠãŒã€Œä¸è‡ªç„¶ã§ã‚ã‚‹ã€ã“ã¨ã«æ°—ä»˜ãã¾ã—ãŸã€‚æ›´ã«èª¿ã¹ãŸã¨ã“ã‚ CSRF æ”»æ’ƒã«ã‚ˆã£ã¦ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¹—ã£å–ã‚ŠãŒå¯èƒ½ãªçŠ¶æ³ã§ã‚ã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã¾ã—ãŸã€‚ ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¹—ã£å–ã‚ŠãŒå¯èƒ½ãª CSRF è„†å¼±æ€§ã¯2015å¹´12æœˆ22æ—¥ã«IPAã«å ±å‘Šã—ã€2
Kenji_s 2016/04/17
CSRF
ãƒªãƒ³ã‚¯
GitHub - Ocramius/PSR7Csrf: PSR-7 storage-less CSRF token generation/validation
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
Kenji_s 2016/03/22
PSR-7

CSRF
ãƒªãƒ³ã‚¯
CodeIgniter: ignore CSRF in many URIs
Kenji_s 2016/02/15
CodeIgniter

CSRF
ãƒªãƒ³ã‚¯
XSSã‚„CSRFãƒªã‚¹ã‚¯ã‚’è»½æ¸›ã™ã‚‹ã€Entry Point Regulationã¨ã¯ - ASnoKaze blog
Entry Point Regulation ã¨ã¯ åå°„åž‹XSSãƒ»XSSIãƒ»CSRFã®ãƒªã‚¹ã‚¯ã‚’è»½æ¸›ã™ã‚‹ãƒ¦ãƒ¼ã‚¶ã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆä¸Šã®ä»•çµ„ã¿ã¨ã—ã¦ã€W3Cã§Entry Point Regulationã¨ã„ã†ä»•æ§˜ãŒç–å®šä¸ã§ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å£(Entry Point)ã«å¹¾ã¤ã‹ã®åˆ¶é™ã‚’ã‹ã‘ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚åˆ¥ã‚ªãƒªã‚¸ãƒ³ã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®æ™‚ã«ã€ã‚¯ã‚¨ãƒªãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚„HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒœãƒ‡ã‚£(POSTãƒ¡ã‚½ãƒƒãƒ‰)ãŒä»˜ã„ã¦ã„ã‚Œã°ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã€ã¨è¨€ã£ãŸäº‹ãŒãƒžãƒ‹ãƒ•ã‚§ã‚¹ãƒˆã§æŒ‡ç¤ºã§ãã‚‹ã‚ˆã†ã«ãªã‚Šãã†ã§ã™ã€‚ EPRã«ãŠã‘ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚«ãƒ†ã‚´ãƒª å„ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆ(URL)ã¯ã©ã®ã‚ˆã†ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘ä»˜ã‘ã‚‹ã“ã¨ãŒå¯èƒ½ã‹æŒ‡å®šã§ãã¾ã™ã€‚ãã®æ™‚ã«æŒ‡å®šã™ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã¯ä»¥ä¸‹ã«åˆ†é¡žã•ã‚Œã¾ã™ navigational requestï¼šcontext frame typeã¯"top-level", "auxiliary", "neste
Kenji_s 2015/11/11
XSS

CSRF

Security
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)ã¨ãã®å¯¾ç–
æœ¬è³‡æ–™ã¯ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹è„†å¼±æ€§ã®ã²ã¨ã¤ã€CSRF (ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª) ã®ä»•çµ„ã¿ã¨ãã®å¯¾ç–ã«é–¢ã™ã‚‹èª¬æ˜Žè³‡æ–™ã§ã™ã€‚ ã¾ãŸã€CSRF å¯¾ç–ã®ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ã„ãã¤ã‹ã«ã¤ã„ã¦ã€ãã®æ¦‚è¦ã¨é©ç”¨ä¾‹ã‚‚ç´¹ä»‹ã—ã¦ã„ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã®æ–¹ã€…ãŒã€CSRF è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç†è§£ã‚’æ·±ã‚ã€ã‚ˆã‚Šã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®é–‹ç™ºã®ä¸€åŠ©ã¨ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ è‡ªç¿’ç”¨ã®è³‡æ–™ã‚„å‹‰å¼·ä¼šã§ã®è³‡æ–™ã¨ã—ã¦ã”æ´»ç”¨ãã ã•ã„ã€‚ 2015 å…¬é–‹æ—¥ ã‚¿ã‚¤ãƒˆãƒ« PDF
Kenji_s 2015/10/06
CSRF
ãƒªãƒ³ã‚¯
GitHub - paragonie/anti-csrf: Full-Featured Anti-CSRF Library
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
Kenji_s 2015/09/18
CSRF

Library

PHP
ãƒªãƒ³ã‚¯
ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã‚’å†è€ƒ â€“ ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨è€ƒãˆã‚‹
(Last Updated On: 2018å¹´8æœˆ8æ—¥)ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã‚’å†è€ƒã—ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã«ã¯ SSRFï¼ˆã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼‰ CSRFï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼‰ XXE(XMLã‚¨ã‚¯ã‚¹ã‚¿ãƒ¼ãƒŠãƒ«ã‚¨ãƒ³ãƒ†ã‚£ãƒ†ã‚£ï¼‰ ãªã©ãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã‚‰ã¯ã€Œãƒªã‚¯ã‚¨ã‚¹ãƒˆã€ã‚’ã€Œå½è£…ã€ï¼ˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼‰ã™ã‚‹æ”»æ’ƒã§ã™ã€‚åå‰ã‹ã‚‰ã¯ç›´æ„Ÿçš„ã«ã©ã®ã‚ˆã†ãªæ”»æ’ƒãªã®ã‹ã‚ˆãè§£ã‚‰ãªã„ã§ã™ãŒã€ã€Œæ”»æ’ƒãƒªã‚¯ã‚¨ã‚¹ãƒˆã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã¨è€ƒãˆã‚‹ã¨è§£ã‚Šã‚„ã™ã„ã¨æ€ã„ã¾ã™ã€‚ ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã¨ã¯ï¼Ÿ ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã¨ã¯å½è£…ã—ãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æ£å½“ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆã¨ã—ã¦å‡¦ç†ã—ã¦ã—ã¾ã†å•é¡Œã§ã™ã€‚ã“ã®å•é¡Œã¯å¤ã„UNIXç³»ã‚·ã‚¹ãƒ†ãƒ ã§åˆ©ç”¨ã•ã‚Œã¦ã„ãŸãƒªãƒ¢ãƒ¼ãƒˆã‚·ã‚§ãƒ«ï¼ˆrã‚³ãƒžãƒ³ãƒ‰ã¨å‘¼ã°ã‚Œã¦ã„ãŸï¼‰ã‚’åˆ©ç”¨ã—ãŸå ´åˆã«ç™ºç”Ÿã™ã‚‹ã“ã¨ãŒåºƒãèªè˜ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¨™æº–çš„ã«ã¯ã€ŒçœŸæ£æ€§ã€ï¼ˆAuthenti
Kenji_s 2015/08/07
SSRF

CSRF

XXE

Security
ãƒªãƒ³ã‚¯
æ›¸ç±ã€ŽWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã®CSRFè„†å¼±æ€§ã«ã¤ã„ã¦è¿½è©¦ã—ã¦ã¿ãŸ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
ä»¥ä¸‹ã®è¨˜äº‹ã‚ˆã‚‹ã¨ã€æ›¸ç±ã€ŽWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã®ã‚µãƒ³ãƒ—ãƒ«ã«CSRFè„†å¼±æ€§ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ãªã®ã§ã€ç¢ºèªã—ã¦ã¿ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚ æ›¸ç±ã€ŽWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã®CSRFè„†å¼±æ€§ | å¾³ä¸¸æµ©ã®æ—¥è¨˜ ã‚µãƒ³ãƒ—ãƒ«ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« ã¾ãšã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã®ä»˜éŒ²ã‚’æ›´æ–° | yohgaki's blogã‚ˆã‚Šã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰simple-bbs.tar.bz2ã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã¾ã™ã€‚ å±•é–‹ã—ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚’ä½œæˆã—ã¾ã™ã€‚ $ tar xvf simple-bbs.tar.bz2 $ (cd simple-bbs/dat/install/; php init db.php) ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚’ä½œæˆï¼š/Users/kenji/tmp/simple-bbs/dat/bbs.dat form_idãƒ†ãƒ¼ãƒ–ãƒ«ã‚’ä½œæˆã—ã¾ã—ãŸã€‚ userãƒ†ãƒ¼ãƒ–ãƒ«ã‚’ä½œæˆã—ã¾ã—ãŸã€‚ thre
Kenji_s 2015/06/30
CSRF
ãƒªãƒ³ã‚¯
Endpoint Protection - Symantec Enterprise
éŽåŽ»æ•°ã‚«æœˆã€ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚µã‚¤ãƒˆã¸ã¨èª˜å°Žã—ã‚ˆã†ã¨ã™ã‚‹ã•ã¾ã–ã¾ãªã‚¹ãƒ‘ãƒ æ”»æ’ƒãŒç¢ºèªã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã‚Œã‚‰ã®æ”»æ’ƒã®ã»ã¨ã‚“ã©ã¯ã€ä½•ã‚‰ã‹ã®ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°æ‰‹æ³•ã®ç‰¹å¾´ã‚’å‚™ãˆã¦ã„ã¾ã™ãŒã€ã¨ãã¨ã—ã¦ã€ç”»æœŸçš„ãªã‚½ãƒ¼ã‚·ãƒ£ãƒ«ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°æ‰‹æ³•ã‚‚ç™»å ´ã—ã¦ã„ã¾ã™ã€‚ã“ã“ã§ã¯ã€ãã†ã—ãŸæ‰‹æ³•ã®ãªã‹ã§ã‚‚ã€Facebook ã§ç‰¹ã«é‡è¦ãª CSRF å¯¾ç–ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ç›—ã¿å‡ºãã†ã¨ã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’æ¬ºãæ‰‹å£ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªæ”»æ’ƒ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã¨ã¯ã€ã‚ã‚‹ Web ã‚µã‚¤ãƒˆã§èªè¨¼æ¸ˆã¿ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚’å†åˆ©ç”¨ã—ã¦ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«æ°—ã¥ã‹ã‚Œãªã„ã¾ã¾ã€ã¾ãŸã¯åŒæ„ã‚’å¾—ãšã«ãã® Web ã‚µã‚¤ãƒˆã§æ‚ªè³ªãªå‡¦ç†ã‚’å®Ÿè¡Œã™ã‚‹æ”»æ’ƒã§ã™ã€‚ãŸã¨ãˆã°ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè‡ªåˆ†ã®ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒãƒ³ã‚ãƒ³ã‚°ã®ã‚µã‚¤ãƒˆã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ã‚‹ã¨ã—ã¾ã™ã€‚ã“ã® Web ã‚µã‚¤ãƒˆã« CSRF ã®è„†å¼±æ€§ãŒã‚ã‚‹ã¨ã€åˆ¥ã®æ‚ªè³ªãª Web ã‚µã‚¤
Kenji_s 2015/06/30
CSRF

XSS
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)ã¨ãã®å¯¾ç–
æœ¬è³‡æ–™ã¯ã€web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹è„†å¼±æ€§ã®ã²ã¨ã¤ã€CSRF (ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª) ã®ä»•çµ„ã¿ã¨ãã®å¯¾ç–ã«é–¢ã™ã‚‹èª¬æ˜Žè³‡æ–™ã§ã™ã€‚ ã¾ãŸã€CSRF å¯¾ç–ã®ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ã„ãã¤ã‹ã«ã¤ã„ã¦ã€ãã®æ¦‚è¦ã¨é©ç”¨ä¾‹ã‚‚ç´¹ä»‹ã—ã¦ã„ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã®æ–¹ã€…ãŒã€CSRF è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç†è§£ã‚’æ·±ã‚ã€ã‚ˆã‚Šã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®é–‹ç™ºã®ä¸€åŠ©ã¨ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ è‡ªç¿’ç”¨ã®è³‡æ–™ã‚„å‹‰å¼·ä¼šã§ã®è³‡æ–™ã¨ã—ã¦ã”æ´»ç”¨ãã ã•ã„ã€‚ - æ”¹è¨‚ç‰ˆ+1: å›³ç‰ˆã‚„èª¤è¨˜ã®ä¿®æ£ (2015å¹´10æœˆ20æ—¥) â€» ã‚³ãƒ¡ãƒ³ãƒˆãã ã•ã£ãŸçš†æ§˜ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™! - æ”¹è¨‚ç‰ˆ: JPCERT/CC Web ã‚µã‚¤ãƒˆã«ã¦å…¬é–‹ (2015å¹´10æœˆ6æ—¥) - åˆç‰ˆ: OSC2015Hokkaido è¬›æ¼”è³‡æ–™ (2015å¹´6æœˆ13æ—¥) Read less
Kenji_s 2015/06/15
CSRF
ãƒªãƒ³ã‚¯
ç‹¬è‡ªãƒ˜ãƒƒãƒ€ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã ã‘ã®ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãªCSRFå¯¾ç–ã¯æœ‰åŠ¹ãªã®ã‹ï¼Ÿ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
ã€ŒWebAPIã®ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãªCSRFå¯¾ç–ã€ã¨ã„ã†2011-12-04ã®è¨˜äº‹ãŒã‚ã‚Šã¾ã—ãŸã€‚ ã“ã“ã§èª¬æ˜Žã•ã‚Œã¦ã„ã‚‹CSRFå¯¾ç–ã¯ã€ GETã€HEADã€OPTIONSãƒ¡ã‚½ãƒƒãƒ‰ã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã¯CSRFä¿è·ã®å¯¾è±¡å¤– HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã«X-Requested-Byãƒ˜ãƒƒãƒ€ãŒãªã‘ã‚Œã°ã‚¨ãƒ©ãƒ¼ã«ã™ã‚‹ ã¨ã„ã†éžå¸¸ã«ã‚·ãƒ³ãƒ—ãƒ«ãªã‚‚ã®ã§ã™ã€‚ ãã—ã¦ã€ã“ã®å¯¾ç–ã®åŽŸç†ã¨ã—ã¦ä»¥ä¸‹ã®èª¬æ˜ŽãŒã‚ã‚Šã¾ã—ãŸã€‚ form, iframe, imageãªã©ã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã§ã¯HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã«ç‹¬è‡ªã®ãƒ˜ãƒƒãƒ€ã‚’ä»˜ä¸Žã™ã‚‹ã“ã¨ãŒã§ãã¾ã›ã‚“ã€‚ç‹¬è‡ªã®ãƒ˜ãƒƒãƒ€ã‚’ã¤ã‘ã‚‹ã«ã¯XMLHttpRequestã‚’ä½¿ã†ã—ã‹ãªã„ã‚ã‘ã§ã™ã€‚ãã—ã¦XMLHttpRequestã‚’ä½¿ã†å ´åˆã«ã¯Same Origin PolicyãŒé©ç”¨ã•ã‚Œã‚‹ãŸã‚æ”»æ’ƒè€…ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã‹ã‚‰HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒãã‚‹ã“ã¨ã¯ãªã„ã€ã¨ã„ã†ã“ã¨ã®ã‚ˆã†ã§ã™ã€‚ ã“ã“ã§ã€ XMLHttpRequestã‚’ä½¿
Kenji_s 2015/03/24
CSRF

HTTP

PHP

Security
ãƒªãƒ³ã‚¯
Flashã¨ç‰¹å®šãƒ–ãƒ©ã‚¦ã‚¶ã®çµ„ã¿åˆã‚ã›ã§cross originã§ã‚«ã‚¹ã‚¿ãƒ ãƒ˜ãƒƒãƒ€ä»˜ä¸ŽãŒå‡ºæ¥ã¦ã—ã¾ã†å•é¡ŒãŒæœªã ã«ç›´ã£ã¦ã„ãªã„è©±
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
Kenji_s 2015/03/24
CSRF

Security

Flash

Vulnerability
ãƒªãƒ³ã‚¯
1 2 3 4 æ¬¡ã®ãƒšãƒ¼ã‚¸