[B! security] Trapezoidã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Trapezoid id:Trapezoid

securityã«é–¢ã™ã‚‹Trapezoidã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (21)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã£ã¦ã“ã†ã§ã™ã‹ï¼Ÿ ã‚ã‹ã‚Šã¾ã›ã‚“
â†‘ ã“ã®é€éŽã•ã‚Œã¦ã„ã‚‹iframeã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ã®æœ€å‰é¢ã«é…ç½®ã•ã‚Œã¦ã„ã¾ã™ â€»ã¯ã¦ãªã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ã‚‹ã¨ã€ã©ã®ã‚ˆã†ã«ãƒœã‚¿ãƒ³ãŒè¢«ã£ã¦ã„ã‚‹ã®ã‹ã‚ã‹ã‚Šã‚„ã™ããªã‚Šã¾ã™
Trapezoid 2009/03/05
vimperatorã®hintãªã‚‰å¤§ä¸ˆå¤«ï¼ï¼ï¼ï¼ï¼‘ï¼‘ï¼‘ï¼‘

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
Trapezoid 2008/08/13
firefox

xpcom

security

url
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - æ—¥æœ¬ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãŒçµ‚äº†ã™ã‚‹æ—¥
â– æ—¥æœ¬ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãŒçµ‚äº†ã™ã‚‹æ—¥ ï¼ˆæ³¨è¨˜ï¼šã“ã®æ—¥è¨˜ã¯ã€6æœˆ8æ—¥ã«æ›¸ãå§‹ã‚ãŸã®ã‚’ã‚ˆã†ã‚„ãæ›¸ãä¸Šã’ãŸã‚‚ã®ã§ã‚ã‚‹ã€‚ãã®ãŸã‚ã€è€ƒå¯Ÿã¯åŸºæœ¬çš„ã«6æœˆ8æ—¥ã®æ™‚ç‚¹ã§ã®ã‚‚ã®ã§ã‚ã‚Šã€ãã®å¾Œæ˜Žã‚‰ã‹ã«ãªã£ãŸã“ã¨ã«ã¤ã„ã¦ã¯è„šæ³¨ã§ã„ãã¤ã‹è£œè¶³ã—ãŸã€‚ï¼‰ çµ‚ã‚ã‚Šã®å§‹ã¾ã‚Š ä»Šå¹´3æœˆ31æ—¥ã€NTTãƒ‰ã‚³ãƒ¢ã®iãƒ¢ãƒ¼ãƒ‰ãŒã€å¥‘ç´„è€…å›ºæœ‰IDï¼ˆå€‹ä½“è˜åˆ¥ç•ªå·ï¼‰ã‚’å…¨ã¦ã®Webã‚µãƒ¼ãƒã«ç¢ºèªãªã—ã«è‡ªå‹•é€šçŸ¥ã™ã‚‹ã‚ˆã†ã«ãªã£ãŸ*1ã€‚ã“ã®ã“ã¨ã¯æ–½è¡Œ1ã‹æœˆå‰ã«NTTãƒ‰ã‚³ãƒ¢ã‹ã‚‰äºˆå‘Šã•ã‚Œã¦ã„ãŸã€‚ é‡è¦ãªãŠçŸ¥ã‚‰ã›:ã€Žiãƒ¢ãƒ¼ãƒ‰IDã€ã®æä¾›é–‹å§‹ã«ã¤ã„ã¦, NTTãƒ‰ã‚³ãƒ¢, 2008å¹´2æœˆ28æ—¥ ãƒ‰ã‚³ãƒ¢ã¯ã€ãŠå®¢æ§˜ã®åˆ©ä¾¿æ€§ãƒ»æº€è¶³ã®å‘ä¸Šã¨ã€ã€Œiãƒ¢ãƒ¼ãƒ‰(R)ã€å¯¾å¿œã‚µã‚¤ãƒˆã®æ©Ÿèƒ½æ‹¡å……ã‚’å›³ã‚‹ãŸã‚ã€iãƒ¢ãƒ¼ãƒ‰ä¸Šã§é–²è¦§å¯èƒ½ãªå…¨ã¦ã®ã‚µã‚¤ãƒˆã¸ã®æä¾›ã‚’å¯èƒ½ã¨ã—ãŸãƒ¦ãƒ¼ã‚¶IDã€Žiãƒ¢ãƒ¼ãƒ‰IDã€ï¼ˆä»¥ä¸‹ã€iãƒ¢ãƒ¼ãƒ‰IDï¼‰æ©Ÿèƒ½ã‚’æä¾›ã„ãŸã—ã¾ã™ã€‚ ï¼ˆç•¥ï¼‰ â– ãŠå®¢æ§˜ã”åˆ©ç”¨ä¸Šã®æ³¨æ„ ãƒ»iãƒ¢ãƒ¼ãƒ‰IDé€šçŸ¥è¨å®šã¯
Trapezoid 2008/07/12
net

mobilephone

security
ãƒªãƒ³ã‚¯
ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ©Ÿå™¨ãŒãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸æ”¹ã–ã‚“å¹‡åŠ©ï¼šARPã‚¹ãƒ—ãƒ¼ãƒ•ã‚£ãƒ³ã‚°ã®è„…å¨ |
ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«è„†å¼±æ€§ã‚’çªã„ãŸä¸æ£ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒåŸ‹ã‚è¾¼ã¾ã‚Œã‚‹äº‹ä¾‹ãŒç›¸æ¬¡ã„ã§ã„ã¾ã™ã€‚ TrendLabs Malware Blogï¼šã€ŒTotal Recall: The Month of Mass Compromisesã€ï¼ˆ2008å¹´5æœˆ30æ—¥ä»˜ã‘ï¼‰ ãã®åŸ‹ã‚è¾¼ã¿æ‰‹æ³•ã¯æ§˜ã€…ã§ã™ã€‚ã“ã‚Œã¾ã§ã€ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã«ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚µãƒ¼ãƒã‚’æŠ±ãˆãŸç’°å¢ƒãŒæ¨™çš„ã¨ãªã‚Šã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã‚ˆã‚ŠåŸ‹ã‚è¾¼ã¾ã‚ŒãŸäº‹ä¾‹ã«é–¢å¿ƒãŒé«˜ã¾ã£ã¦ã„ã¾ã—ãŸã€‚ã—ã‹ã—ãªãŒã‚‰ã€ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã«ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚µãƒ¼ãƒã‚’æŠ±ãˆã¦ã„ãªã„ç’°å¢ƒã«ãŠã„ã¦ã‚‚ã€ä¸æ£ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã®åŸ‹ã‚è¾¼ã¿è„…å¨ã«ã•ã‚‰ã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå›žã¯æ—¥æœ¬å›½å†…ã«ã¦ç¢ºèªã•ã‚ŒãŸãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°æ¥è€…ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ©Ÿå™¨ï¼šãƒ«ãƒ¼ã‚¿ãŒãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã•ã‚Œã€ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸æ”¹ã–ã‚“ã‚’å¹‡åŠ©ã—ãŸäº‹ä¾‹ã«ã¤ã„ã¦ç´¹ä»‹ã„ãŸã—ã¾ã™ã€‚ â– ç›¸äº’é€šä¿¡ã¨æ©Ÿå™¨ã®å½¹å‰² ä»Šå›žã®æ”»æ’ƒã‚’ç†è§£ã™ã‚‹ã«ã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã«ãŠã‘ã‚‹ãƒ‡ãƒ¼ã‚¿å–ã‚Šæ‰±ã„ã®èƒŒæ™¯ã‚’çŸ¥ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™
Trapezoid 2008/06/04
network

security
ãƒªãƒ³ã‚¯
mod rewriteã‚’ä½¿ç”¨ã—ãŸç°¡æ˜“WAF
(Last Updated On: 2018å¹´8æœˆ8æ—¥)http://www.0x000000.com/?i=567 ã«mod rewriteã‚’åˆ©ç”¨ã—ãŸç°¡æ˜“WAF(Web Application Firewall)ã®å®šç¾©ä¾‹ãŒæŽ²è¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚åŒã˜ã‚ˆã†ãªã‚¢ã‚¤ãƒ‡ã‚¢ã‚’ãŠæŒã¡ã®æ–¹ã€æ—¢ã«ä¼¼ãŸã‚ˆã†ãªè¨å®šã‚’ä½¿ã‚ã‚Œã¦ã„ã‚‹æ–¹ã‚‚å¤šã„ã¨ã¯æ€ã„ã¾ã™ã€‚ ç°¡å˜ãªWAFã§ã™ãŒã€å®Ÿç”¨æ€§ã‚‚é«˜ã„ã§ã™ã€‚ä¾‹ãˆã°ã€ãƒŒãƒ«æ–‡å—ã‚„HTMLç‰¹æ®Šæ–‡å—ã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¯æ§˜ã€…ãªæ”»æ’ƒã§åˆ©ç”¨ã•ã‚Œã¾ã™ã€‚ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§å¯¾å‡¦ãŒå¿˜ã‚Œã‚‰ã‚ŒãŒã¡ãªCOOOKIEã‚„REFERã€USER_AGENTç‰ã«ç‰¹æ®Šæ–‡å—ãŒå…¥ã£ã¦ã„ãŸå ´åˆã«ã‚¢ã‚¯ã‚»ã‚¹ã‚’æ‹’å¦ã™ã‚‹éƒ¨åˆ†ã ã‘ã‚‚ã§å°Žå…¥ã™ã‚‹ä¾¡å€¤ã¯ååˆ†ã«ã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ å…ƒãƒã‚¿ã®ã‚µã‚¤ãƒˆã¯è‹±èªžã§ã™ãŒã€è§£èª¬ä»˜ãã§ã™ã€‚ ã“ã‚Œã‚’å…¥ã‚Œã‚‹ã¨å•é¡Œã¨ãªã‚‹å ´åˆã‚‚ã‚ã‚‹ã®ã§ã€å†…å®¹ã‚’ç†è§£ã—ã¦ã‹ã‚‰åˆ©ç”¨ã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ RewriteEngine On Op
Trapezoid 2008/05/19
apache

security
ãƒªãƒ³ã‚¯
PDFã€€åƒå¤œä¸€å¤œ: 2008å¹´04æœˆ03æ—¥ ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–
Webã¯ä¿®ç†ãŒå¿…è¦ã â€” Turduckenå•é¡Œ New Yorkã§3æœˆã«é–‹å‚¬ã•ã‚ŒãŸAjax World East2008ã§ã€Yahooã®Douglas Crockfordæ°ãŒã€ã€ŒWebã‚’ä¿®ç†ã§ãã‚‹ã‹ã€ã¨ã„ã†é¡Œã§è¬›æ¼”ã—ã¦ã„ã¾ã™ã€‚ â—‹è¬›æ¼”ã‚’ç´¹ä»‹ã—ãŸãƒ–ãƒã‚°ï¼šCrockford Speaks on â€œFixing the Webâ€ and Appears on Channel 9 â—‹MSDNã®ãƒãƒ£ãƒ³ãƒãƒ«9ã§ã®ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼ï¼šhttp://channel9.msdn.com/Showpost.aspx?postid=391047 â—‹è¬›æ¼”å†…å®¹ã®PowerPointã‚¹ãƒ©ã‚¤ãƒ‰ï¼šhttp://yui blog.com/assets/crockford/crockford-fix.zip Douglas Crockfordæ°ã¯Javascriptåˆ†é‡Žã§å¤§å¤‰æœ‰åãªäººã‚‰ã—ã„ã§ã™ãŒã€è¬›æ¼”å†…å®¹ã‚’è¦‹ã¾ã™ã¨ç›¸å½“ã«ã‚·ãƒ§ãƒƒã‚ãƒ³
Trapezoid 2008/04/10
ajax

security

presentation
ãƒªãƒ³ã‚¯
Greasemonkeyã®å…±é€šãªè½ã¨ã—ç©´ã‚’é¿ã‘ã‚‹ - minghaiã®æ—¥è¨˜
Greasemonkeyã®éŽåŽ»ã«ãŠã„ã¦ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã®è§£èª¬ã€‚ Greasemonkeyã ã‘ã«é™ã‚‰ãšã€JavaScriptã«ã‚ˆã‚‹ãƒ¦ãƒ¼ã‚¶æ‹¡å¼µã‚’ä½œæˆã—ã¦ã„ã‚‹å…¨ã¦ã®æ–¹ã«å¯¾ã—ã¦ä¸€èªã®ä¾¡å€¤ãŒã‚ã‚‹ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã ã¨æ€ã‚ã‚Œã¾ã™ã€‚ åŽŸæ–‡ï¼šO'Reilly Media - Techno logy and Business Training Greasemonkeyã®å…±é€šãªè½ã¨ã—ç©´ã‚’é¿ã‘ã‚‹ Greasemonkeyã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ´å²ãŒã‚ãªãŸã®ä»Šã«ã©ã†å½±éŸ¿ã™ã‚‹ã®ã‹ (è‘—) Mark pilgrim "Greasemonkey Hacks"ã®è‘—è€… 2005/11/11 æ˜”ã€…ã€ã‚ã‚‹ã¨ã“ã‚ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒã‚ã‚Šã¾ã—ãŸã€‚ï¼ˆã“ã‚Œã¯æ™®é€šã®ãŠã¨ãŽè©±ã§ã¯ãªã„ã‹ã‚‰ãã®ã¾ã¾èªã‚“ã§ãã ã•ã„ã€‚ï¼‰ Greasemonkeyã®ã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ã¯æœ€åˆã«æ›¸ã‹ã‚Œã¦ä»¥æ¥å¤§å¹…ã«å¤‰æ›´ã•ã‚Œã¦ããŸã€‚Version0.3ã¯åˆã‚ã¦åºƒç¯„å›²ã«äººæ°—ã‚’å¾—ãŸãƒãƒ¼
Trapezoid 2008/03/14
firefox

greasemonkey

security
ãƒªãƒ³ã‚¯
ã€ŒWinnyã¯æ—¢ã«å¿…è¦ãªæŠ€è¡“ã§ã¯ãªãã€å±é™ºæ€§ã‚’èªè˜ã™ã¹ãã€é«˜æœ¨æ°è¬›æ¼”
å¤§é˜ªå¼è·å£«ä¼šé¤¨ã§17æ—¥ã€æƒ…å ±å‡¦ç†æŠ€è¡“ã¨åˆ‘äº‹äº‹ä»¶ã«é–¢ã™ã‚‹ã‚·ãƒ³ãƒã‚¸ã‚¦ãƒ ãŒé–‹å‚¬ã•ã‚ŒãŸã€‚ã‚·ãƒ³ãƒã‚¸ã‚¦ãƒ ã¯ã€Winnyäº‹ä»¶ã®åˆ¤æ±ºã‚’å¥‘æ©Ÿã«IT æŠ€è¡“ã¨åˆ‘äº‹äº‹ä»¶ã‚’è€ƒãˆã‚‹ã¨ã„ã†å†…å®¹ã§ã€å¤§é˜ªå¼è·å£«ä¼šåˆ‘äº‹å¼è·å§”å“¡ä¼šã€æƒ…å ±å‡¦ç†å¦ä¼šã€æƒ…å ±ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ³•å¦ä¼šãŒå…±åŒã§ä¸»å‚¬ã—ãŸã€‚ ã‚·ãƒ³ãƒã‚¸ã‚¦ãƒ ã§ã¯ã€Winnyã®é–‹ç™ºè€…ã§ã‚ã‚‹é‡‘åå‹‡æ°ã«ã‚ˆã‚‹Winnyã®æ¦‚èª¬ã‚„ã€ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã‚½ãƒ•ãƒˆã«é–¢ã™ã‚‹åˆ‘äº‹æ³•çš„ãªå•é¡Œç‚¹ãªã©ã€æŠ€è¡“ã¨æ³•å¾‹ã®ä¸¡é¢ã‹ã‚‰Winnyã‚„ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã‚½ãƒ•ãƒˆã®å•é¡Œç‚¹ã«ã¤ã„ã¦ã®è¬›æ¼”ãŒè¡Œãªã‚ã‚ŒãŸã€‚åˆå¾Œã®è¬›æ¼”ã§ã¯ã€ç”£æ¥æŠ€è¡“ç·åˆç ”ç©¶æ‰€ã®é«˜æœ¨æµ©å…‰æ°ãŒã€Œãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã®æŠ±ãˆã‚‹æŠ€è¡“çš„ãªå•é¡Œç‚¹ã€ã¨é¡Œã—ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è¦³ç‚¹ã‹ã‚‰è¦‹ãŸWinnyã®å•é¡Œç‚¹ã‚’èªžã£ãŸã€‚ â— Winnyã¯ã€ŒäººãŒæœ›ã¾ãªã„ã€ã“ã¨ã‚’æ¢ã‚ã‚‰ã‚Œãªã„ç‚¹ãŒå•é¡Œ é«˜æœ¨æ°ã¯ã¾ãšå‰æã¨ã—ã¦ã€ã€ŒWinnyãŒã©ã®ã‚ˆã†ãªç›®çš„ã‚„æ„å›³ã§é–‹ç™ºã•ã‚ŒãŸã®ã‹ã¨ã„ã†è©±ã¨ã¯ç„¡é–¢ä¿‚ã«ã€çµæžœã¨ã—ã¦ã®Winnyã‚’åŸºã«è°è«–ã‚’
Trapezoid 2007/02/23
p2p

security

winny
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ASPã¨ã‹JSPã¨ã‹PHPã¨ã‹ERBã¨ã‹ã€é€†ã ã£ãŸã‚‰ã‚ˆã‹ã£ãŸã®ã«
â– ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è§£èª¬æ›¸ç±ã®è„†å¼±æ€§ã‚’ã©ã†ã™ã‚‹ã‹ å°åˆ·ã•ã‚Œã¦æµé€šã™ã‚‹æ›¸ç±ã«è„†å¼±æ€§ãŒã‚ã‚‹ã€ã¤ã¾ã‚ŠæŽ²è¼‰ã•ã‚Œã¦ã„ã‚‹ã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã«ã‚ºãƒãƒªè„†å¼±æ€§ãŒã‚ã‚‹ã¨ã‹ã€è„†å¼±æ€§ã‚’ç”£ã¿ã‚„ã™ã„ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¹ã‚¿ã‚¤ãƒ«ã‚’èº«ã«ã¤ã‘ã•ã›ã¦ã„ã‚‹è§£èª¬ãŒã‚ã‚Šã€ãã‚ŒãŒè„†å¼±ãªãƒ—ãƒã‚°ãƒ©ãƒžã‚’ç”Ÿç”£ã—ç¶šã‘ã‚‹æ ¹æºã«ãªã£ã¦ã„ã‚‹å•é¡Œã¯ã€ã€Œãªã‚“ã¨ã‹ã—ãªã„ã¨ã„ã‘ãªã„ããˆã€ã¨ä»¥å‰ã‹ã‚‰è¨€ã‚ã‚Œã¦ããŸã€‚ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢è£½å“ã®è„†å¼±æ€§ã¯ã€æŒ‡æ‘˜ãŒã‚ã‚Œã°ãƒ‘ãƒƒãƒãŒæä¾›ã•ã‚ŒãŸã‚Šä¿®æ£ç‰ˆã«å·®ã—æ›¿ãˆã‚‰ã‚ŒãŸã‚Šã™ã‚‹ãŒã€æ›¸ç±ã®è„†å¼±æ€§ã¯ã©ã†ã‹ã€‚æ£èª¤è¡¨ãŒå·®ã—è¾¼ã¾ã‚Œã‚‹ã¨ã‹ã€å›žåŽã™ã‚‹æŽªç½®ãŒã¨ã‚‰ã‚Œã‚‹ã‹ã¨ã„ã†ã¨ã€ãã‚Œã¯æœ›ã‚ãã†ã«ãªã„ã€‚è¨€è«–ã«ã¯è¨€è«–ã§å¯¾æŠ—ã™ã‚Œã°ã‚ˆã„ã¨ã„ã†ã“ã¨ã«ãªã‚‹ã ã‚ã†ã‹ã€‚ ä¹…ã—ã¶ã‚Šã«ã„ãã¤ã‹ã®æ›¸ç±ã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸã€‚å…ˆæœˆåœ’ç”°ã•ã‚“ã®æ—¥è¨˜ãªã©ã§æ¯”è¼ƒçš„è©•åˆ¤è‰¯ãç´¹ä»‹ã•ã‚Œã¦ã„ãŸ2å†Šã‚’èªã‚“ã ã€‚ å±±æœ¬å‹‡, PHPå®Ÿè·µã®ãƒ„ãƒœ ã‚»ã‚ãƒ¥ã‚¢ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ç·¨, ä¹å¤©ç¤¾, 2004å¹´6æœˆ GIJOE, PHP
Trapezoid 2007/02/06
programming

security
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒã«DoSè€æ€§ã‚’ä»˜ã‘ã‚‹ - stanaka's blog
ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒ“ã‚¹ã§ã¯ã€ã‚¢ã‚¯ã‚»ã‚¹ãŒé›†ä¸ã—ã¦ã€ã‚µã‚¤ãƒˆãŒè½ã¡ã‚‹ã€ã¨ã„ã†ã®ã¯ã€ã‚ˆãã‚ã‚‹è©±ã§ã™ã€‚ç´”ç²‹ã«äººæ°—ãŒå‡ºã¦ã‚¢ã‚¯ã‚»ã‚¹é›†ä¸ã™ã‚‹ãªã‚‰ã€ã‚µãƒ¼ãƒç®¡ç†å´ã®è²¬ä»»ã¨è¨€ã‚ã‚Œã¦ã‚‚ã€ã—ã‹ãŸãªã„ã¨æ€ã„ã¾ã™ã€‚ã—ã‹ã—ã€botã‚„F5ã‚¢ã‚¿ãƒƒã‚¯ã«ã‚ˆã‚‹çªç™ºçš„ãªé›†ä¸ã‚¢ã‚¯ã‚»ã‚¹ã§ã€è½ã¡ã¦ã—ã¾ã†ã€ã¨ã„ã†ã®ã¯ã€é‹å–¶å´ã¨ã—ã¦ã‚‚ã€ã‚ã¾ã‚Šç´å¾—ãŒã„ãã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ãã®ã‚ˆã†ãªçªç™ºçš„ãªã‚¢ã‚¯ã‚»ã‚¹ã«å¯¾å¿œã™ã‚‹ãŸã‚ã«ã€å¤§é‡ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’ã—ã¦ãã‚‹ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’æ¤œå‡ºã—ã€å„ªå…ˆåº¦ã‚’è½ã™ã‹ã€ã‚¢ã‚¯ã‚»ã‚¹ç¦æ¢ã«ã™ã‚‹æ–¹æ³•ãªã©ãŒã‚ã‚Šã¾ã™ã€‚ ã¨ã„ã†ã‚ã‘ã§ã€Apacheãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã§ãã‚Œã‚’æ¤œå‡ºã™ã‚‹ãŸã‚ã®mod_dosdetectorã‚’é–‹ç™ºã—ã¾ã—ãŸã€‚(ã¡ãªã¿ã«ã‚³ã‚¢éƒ¨åˆ†ã®é–‹ç™ºæœŸé–“ã¯ã€Apacheãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã£ã¦ã€ã©ã†æ›¸ãã‚“ã ã£ã‘ã€ã¨ã„ã†çŠ¶æ…‹ã‹ã‚‰ã€3æ—¥ã§ã—ãŸã€‚) mod_dosdetectorã¯ã€Apacheãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¨ã—ã¦å‹•ä½œã—ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®IPã‚¢ãƒ‰ãƒ¬ã‚¹ã”ã¨ã«ã‚¢ã‚¯ã‚»ã‚¹é »åº¦ã‚’æ¸¬å®šã—ã€è¨
Trapezoid 2007/02/04
mod_dosdetector

apache

network

security

server
ãƒªãƒ³ã‚¯
IPAãŸã‚“ã‹ã‚‰ãŠç¤¼ãŒï¼ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã¯ã˜ã‚ã¦ã®ã»ã†ã“ã IPAãŸã‚“ã‹ã‚‰ã®è¿”äº‹ IPAãŸã‚“ã‹ã‚‰ã¸ã‚“ã˜ã“ãªã„ ã®ã¤ã¥ãã§ã™ï¼ï¼ï¼ è¿”äº‹ããŸã‚ˆï¼ ãã¦ã¾ã—ãŸï¼žï¼œ Date: Thu, 01 Feb 2007 20:43:06 +0900 To: Hamachiya2 Subject: ã€IPA#32334280/IPA#11631745/IPA#92669403/IPA#94436430ã€‘ å±Šå‡ºã„ãŸã ã„ãŸä»¶ã«ã¤ã„ã¦ - ----------------------------------------------------------------- ã“ã®ãƒ¡ãƒ¼ãƒ«ã¯ã€ä»¥ä¸‹ã®å–æ‰±ã„ç•ªå·ã«é–¢ã™ã‚‹é€£çµ¡ã§ã™ã€‚ IPA#32334280/IPA#11631745/IPA#92669403/IPA#94436430 - ----------------------------------------------------------------
Trapezoid 2007/02/04
ipa

security

ã¯ã¾ã¡ã¡ã‚ƒã‚“
ãƒªãƒ³ã‚¯
IPAãŸã‚“ã‹ã‚‰ã¸ã‚“ã˜ã“ãªã„ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã¡ã‚‡ã£ã¨ã¤ã¾ã‚“ãªã„ã®ã§ã€ã¤ã¾ã‚‹ã‚ˆã†ã«ã—ã¦ã¿ã¾ã—ãŸï¼ https://isec.ipa.go.jp/inq/servlet/InqMainServlet?id=index&gamenFlg=6 ã“ã‚Œã§æ˜¨æ—¥ã¨åŒã˜å®šåž‹æ–‡ã®è¿”äº‹ãŒããŸã‚‰ããŸã§æ„‰å¿«ã‹ãªã€ã¨ã‹æ€ã£ã¦â€¦ï¼ ã‚ã€IPAã®ã‚µã‚¤ãƒˆã®XSSã®å˜åœ¨ã¨å®Ÿè¨¼ã‚³ãƒ¼ãƒ‰ã¯ã€ã‚‚ã¡ã‚ã‚“æœ¬ç‰©ã ã‚ˆï¼ ãƒ¢ã‚¶ã‚¤ã‚¯ã‹ã‘ãŸã‘ã©ï¼
Trapezoid 2007/01/31
å‡„ã„ã‚ªãƒã

ã¯ã¾ã¡ã¡ã‚ƒã‚“

security

neta
ãƒªãƒ³ã‚¯
IPAãŸã‚“ã‹ã‚‰ã®è¿”äº‹ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
Date: Tue, 30 Jan 2007 10:37:05 +0900 From: "IPA/vuln/Info" To: root@hamachiya.com ã¯ã¾ã¡ã‚„ï¼’æ§˜ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§é–¢é€£æƒ…å ±ã‚’å±Šå‡ºã„ãŸã ãã€ã‚ã‚ŠãŒ ã¨ã†ã”ã–ã„ã¾ã™ã€‚ æœ¬ä»¶ã«ã¤ãã¾ã—ã¦ã€ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ä»¥ä¸‹ã®é …ç›®ã«è¨˜è¼‰ãŒã‚ã‚Šã¾ã™ã‚ˆ ã†ã«ã€å±Šå‡ºã®éš›ã«ã¯ç™ºè¦‹è€…æ§˜ã®æ°åã‚’ã”è¨˜å…¥é ‚ã„ã¦ãŠã‚Šã¾ã™ã€‚ ã“ã‚Œã¯ã€è²¬ä»»ã‚ã‚‹å±Šå‡ºã‚’ä¿ƒã™ãŸã‚ã§ã‚ã‚Šã€åŒ¿åã‚„ãƒãƒ³ãƒ‰ãƒ«ãƒãƒ¼ãƒ ã® å±Šå‡ºã¯å—ç†ã§ãã¾ã›ã‚“ã®ã§ã€å®Ÿåã§ã®å±Šå‡ºã«ã”å”åŠ›ã‚’ãŠé¡˜ã„è‡´ã—ã¾ã™ã€‚ ----------------------------------------------------------- ã€Œæƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ—©æœŸè¦æˆ’ãƒ‘ãƒ¼ãƒˆãƒŠãƒ¼ã‚·ãƒƒãƒ—ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã€P.17 Vï¼Žã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ä¿‚ã‚‹è„†å¼±æ€§é–¢é€£æƒ…å ±å–æ‰± 2. ç™ºè¦‹è€…ã®å¯¾å¿œ 4) å±Šã‘å‡ºã‚‹æƒ…å ±ã®å†…å®¹ ãƒ»ç™ºè¦‹è€…
Trapezoid 2007/01/30
ã¤ã„ã«IPAã«å–§å˜©ã‚’å£²ã£ãŸã¯ã¾ã¡ã¡ã‚ƒã‚“

neta

security
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã›
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã› ã„ã¤ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã„ãŸã ãèª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ãŠå®¢æ§˜ãŒã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸã‚µãƒ¼ãƒ“ã‚¹ã¯æœ¬æ—¥ã¾ã§ã«ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ä»Šå¾Œã¨ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”æ„›é¡§ãã ã•ã„ã¾ã™ã‚ˆã†ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
Trapezoid 2006/12/09
p2p

security

windows
ãƒªãƒ³ã‚¯
AAã§å›³è§£!ãšã°ã‚Šä¸€ç›®ã§å…¨ãè§£ã‚‰ãªã„ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
æœ€çµ‚æ›´æ–°æ—¥: Wednesday, 29-Nov-2006 02:46:05 JST Webãƒã‚° CSRF (Cross Site Request Forgeries) DoS (ã‚µãƒ¼ãƒ“ã‚¹æ‹’å¦) ã‚µãƒ‹ã‚¿ã‚¤ã‚º ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ Cookie Monster SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ HTTP Response Splitting (ãƒ¬ã‚¹ãƒãƒ³ã‚¹åˆ†å‰²) HTTPã®ãƒšãƒ¼ã‚¸ã®ãƒ•ãƒ¬ãƒ¼ãƒ ã«HTTPSã®ãƒšãƒ¼ã‚¸ã‚’è¡¨ç¤º ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚° Forceful Browsing (å¼·åˆ¶ãƒ–ãƒ©ã‚¦ã‚º) ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚¼ãƒãƒ‡ã‚¤(0day)æ”»æ’ƒ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ« ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ æ¨©é™æ˜‡æ ¼ OS ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚ªãƒ¼ãƒ—ãƒ³ãƒ—ãƒã‚ã‚· Webãƒã‚° ï¼¼ã€€ã€€__ã€€ã€€ï¼ ï¼¿ã€€ï¼ˆï½ï¼‰ã€€ï¼¿ãƒ“ãƒ¼ã‚³ãƒ¼ãƒ³ |ãƒŸ| ï¼ ã€€ï½€Â´ã€€ ï¼¼ ('A`
Trapezoid 2006/12/05
Xãƒ»Sãƒ»Sï¼Xãƒ»Sãƒ»Sï¼

security

ã¾ã¨ã‚

neta
ãƒªãƒ³ã‚¯
ã€Œmixiã®è£æŠ€ã€ã§ãƒ‘ãƒ‹ãƒƒã‚¯ã€€ãƒã‚°æ‚ªç”¨ã§ãƒ‡ãƒžå‡ºå›žã‚‹
ã€Œä»–äººã®ãƒšãƒ¼ã‚¸ã«ã€Žè¶³ã‚ã¨ã€ã‚’æ®‹ã•ãšã«è¨ªå•ã§ãã‚‹è£æŠ€ãŒã‚ã‚‹ã€â€•â€•SNSï¼ˆã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚ãƒ³ã‚°ã‚µãƒ¼ãƒ“ã‚¹ï¼‰ã€Œmixiã€ã§11æœˆ5æ—¥å¤œã€ã“ã‚“ãªã†ã‚ã•ãŒæµã‚ŒãŸã€‚ã ãŒã“ã®â€œè£æŠ€â€ã‚’å®Ÿè¡Œã™ã‚‹ã¨ã€ä»–ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè‡ªåˆ†ã®ãƒšãƒ¼ã‚¸ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ã¦ã—ã¾ã†ä¸å…·åˆãŒèµ·ãã‚‹ã€‚åŽŸå› ã¯mixiã®ãƒã‚°ã€‚ä¸€éƒ¨ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå®Ÿéš›ã«å®Ÿè¡Œã—ã¦ã—ã¾ã„ã€ä¸€æ™‚ãƒ‘ãƒ‹ãƒƒã‚¯ã«é™¥ã£ãŸã€‚é‹å–¶å…ƒã®ãƒŸã‚¯ã‚·ã‚£ã¯11æœˆ6æ—¥æœªæ˜Žã«ã“ã®ä¸å…·åˆã‚’ä¿®æ£ã—ã€ä»Šã¯é¨’å‹•ã¯åŽã¾ã£ã¦ã„ã‚‹ã€‚ æƒ…å ±ã¯5æ—¥å¤œã«ã€Œmixiã®è£æŠ€ã€ã€Œç›¸æ‰‹ã®ãƒšãƒ¼ã‚¸ã«è¶³ã‚ã¨ãŒæ®‹ã‚‰ãªã„æ–¹æ³•ã€ãªã©ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã§ã€è¦æ¨¡ã®å¤§ããªã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ãƒ¼ã«ãƒžãƒ«ãƒãƒã‚¹ãƒˆã•ã‚Œã¦ã„ãŸã€‚ å†…å®¹ã¯ã€è‡ªåˆ†ã®ãƒšãƒ¼ã‚¸ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶é™ã§ãã‚‹ã€Œã‚¢ã‚¯ã‚»ã‚¹ãƒ–ãƒãƒƒã‚¯ã€æ©Ÿèƒ½ã§ç‰¹å®šã®è¨å®šã‚’ã™ã‚Œã°ã€è‡ªåˆ†ã®ã€Œè¶³ã‚ã¨ã€ï¼ˆè‡ªåˆ†ãŒä»–äººã®ãƒšãƒ¼ã‚¸ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã“ã¨ã‚’çŸ¥ã‚‰ã›ã‚‹æ©Ÿèƒ½ï¼‰ãŒè¦‹ãˆãªããªã£ãŸã‚Šã€å‹äººé™å®šã§å…¬é–‹ã—ã¦ã„ã‚‹æ—¥è¨˜ã‚’ã€å‹äººã§ãªãã¦ã‚‚èªã‚ã‚‹ã‚ˆã†ã«
Trapezoid 2006/11/19
æ‡²ã‚Šãªã„ãªãƒ¼

mixi

security
ãƒªãƒ³ã‚¯
heiuma
Trapezoid 2006/11/06
SNS

security
ãƒªãƒ³ã‚¯
A. WEBãƒ—ãƒã‚°ãƒ©ãƒžã‚³ãƒ¼ã‚¹
Trapezoid 2006/10/24
Webã‚¢ãƒ—ãƒªã‚’çµ„ã‚€å‰ã«ã€‚

development

programming

security
ãƒªãƒ³ã‚¯
OBB vs AABB - Radium Software Development
This domain may be for sale!
Trapezoid 2006/09/07
"IC ã‚«ãƒ¼ãƒ‰ä¹—è»Šåˆ¸ Suica ã®å†…éƒ¨ã«ã¯ç›´è¿‘ 20 ä»¶ã®ä¹—è»Šå±¥æ´ãŒä¿å˜ã•ã‚Œã¦ã„ã‚‹ã€‚"

security

RFID

Suica
ãƒªãƒ³ã‚¯
XSS - è¡¨ç¤ºç³»ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã«å˜åœ¨ã™ã‚‹ç›²ç‚¹ :: ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®æ™‚é–“ã§ã™ï¼ XSSã¨ã„ã†ã¨â€¦ï¼ ã¾ã£ã•ãã«æ€ã„ã¤ãã®ãŒã€å…¥åŠ›ãƒ‡ãƒ¼ã‚¿é€ä¿¡ â†’ ç¢ºèªè¡¨ç¤ºã®éƒ¨åˆ†ã§ã®ç„¡å®³åŒ–æ¼ã‚Œã§ã™ã‚ˆãï¼ ãŸã¨ãˆã°ã“ã‚“ãªæ„Ÿã˜ã®ãƒ•ã‚©ãƒ¼ãƒ ã‹ã‚‰å—ã‘å–ã£ãŸãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’ã€ ç¢ºèªã¨ã—ã¦è¡¨ç¤ºã™ã‚‹ãƒšãƒ¼ã‚¸ã¨ã‹ï¼ (å…¥åŠ›) <form action="register.cgi" method="post"> ã‚¿ã‚¤ãƒˆãƒ«ï¼š<input type="text" name="title"> â† ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ã‚’å…¥åŠ› æœ¬æ–‡ï¼š<input type="text" name="body"> â† ã€Œã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼<script>alert(1)</script>ã€ã‚’å…¥åŠ› </form> (ç¢ºèª) <p>ã“ã®å†…å®¹ã§ç™»éŒ²ã—ã¦ã„ã„ï¼Ÿ</p> <p> ã‚¿ã‚¤ãƒˆãƒ«ï¼š ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼<br> æœ¬æ–‡ï¼š ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼<script>alert
Trapezoid 2006/08/02
programming

Security

xss

XSS

html

ã¯ã¾ã¡ã¡ã‚ƒã‚“

hatena

javascript
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸