[B! ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] inoueyuworksã®ãƒ

inoueyuworks id:inoueyuworks

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹inoueyuworksã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (22)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Critical vulnerabilities in JSON Web Token libraries
TL;DR: If you are using node-jsonwebtoken, pyjwt, namshi/jose, php-jwt or jsjwt with asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512) please update to the latest version. See jwt.io for more information on the vulnerable libraries. (Updated 2015-04-20) This is a guest post from Tim McLean, who is a member of the Auth0 Security Researcher Hall of Fame. Tim normally blogs at www.timmclean.
inoueyuworks 2021/05/10
jwt ã® alg ãƒ˜ãƒƒãƒ€éƒ¨åˆ†ã«å«ã¾ã‚Œã‚‹ã€ç½²åã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®å€¤ã‚’ã€æ¤œè¨¼ã®ãƒ•ã‚§ãƒ¼ã‚ºã§åˆ©ç”¨ã—ã¦ã—ã¾ã†ã¨ã€ attacker ãŒæ”»æ’ƒã—ã†ã‚‹ã€‚æ¤œè¨¼å´ã¯ã€æ¤œè¨¼ã™ã‚‹ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã‚’ãƒ—ãƒã‚°ãƒ©ãƒ çš„ã«æ±ºã‚æ‰“ã¤ã¹ãã§ã‚ã‚‹ã€‚

jwt

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
badssl.com
badssl.com ðŸŽ›Dashboard Dashboard ðŸŽ«Certificate expired wrong.host self-signed untrusted-root revoked pinning-test no-common-name no-subject incomplete-chain sha256 sha384 sha512 1000-sans 10000-sans ecc256 ecc384 rsa2048 rsa4096 rsa8192 extended-validation ðŸŽŸClient Certificate Certificate Downloads client client-cert-missing ðŸ–¼Mixed Content mixed-script very mixed mixed-favicon mixed-form âœï¸HTTP h
inoueyuworks 2021/01/06
ssl/tls ã® ssl certificate ã¯ã„ã‚ã„ã‚ãªç†ç”±ã§ fail ã™ã‚‹ãŒã€ãã‚Œã‚’åˆ†é¡žã—ã¦ã€å®Ÿéš›ã«ãã®è¨¼æ˜Žæ›¸ã§é€šä¿¡ã™ã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’ç”¨æ„ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã€‚ ex. usecase: ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚µãƒãƒ¼ãƒˆã§ãƒ–ãƒ©ã‚¦ã‚¶è¨å®šã«é–¢ã™ã‚‹è¨ºæ–

tls

ssl

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

http
ãƒªãƒ³ã‚¯
ã€Linuxã€‘/dev/random ã¨ /dev/urandomã®é•ã„ - Man On a Mission
ã”ã‚ã‚“ãªã•ã„ã€ã“ã®è¨˜äº‹ã¯ç§ã«ã‚ˆã‚Šå‰Šé™¤ã•ã‚Œã¾ã—ãŸ 2022/04/16 ãªã«ã‚„ã‚‰å½“è¨˜äº‹ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹æ•°ãŒæ€¥ã«ä¼¸ã³ã¦ã¦ã€ãªãœã“ã‚“ãªåœ°å‘³è¨˜äº‹ãŒï¼Ÿã¨æ€ã£ã¦ãŸã‚‰ã€ã©ã†ã‚‚å®¹é‡ç„¡åˆ¶é™ã‚¯ãƒ©ã‚¦ãƒ‰ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã‚µãƒ¼ãƒ“ã‚¹ã¸ã®å«ŒãŒã‚‰ã›ã‚’ç¤ºå”†ã™ã‚‹å‹•ããŒã‚ã‚Šã€ãã®æµã‚Œã§ã‚¢ã‚¯ã‚»ã‚¹ã•ã‚Œã¦ã‚‹ã‚ˆã†ã§ã™ã€‚ ãã†ã„ã†ã‚¢ã‚¯ã‚»ã‚¹ãŒã©ã®ãã‚‰ã„ã®å‰²åˆãªã®ã‹ã‚‚ã€å®Ÿéš›ã«ãã®ã‚ˆã†ãªè¡Œç‚ºã«èµ°ã‚‹ã‹ã©ã†ã‹ã‚‚ã‚ã‹ã‚Šã¾ã›ã‚“ãŒã€å½“è¨˜äº‹ãŒãã‚Œã‚’å¹‡åŠ©ã™ã‚‹ã‚ˆã†ãªå½¢ã«ãªã‚‹ã¨æ¥è…¹ãªã®ã§ã€ã„ã£ãŸã‚“å†…å®¹ã‚’å‰Šé™¤ã—ã¾ã—ãŸã€‚ çœŸé¢ç›®ãªç›®çš„ã§ãŸã©ã‚Šç€ã„ãŸæ–¹ã¯ã”ã‚ã‚“ãªã•ã„ã€‚ãŸã¶ã‚“åŒå†…å®¹ã‚’æ‰±ã£ãŸè¨˜äº‹ã¯ãƒãƒƒãƒˆã«ã‚ãµã‚Œã¦ã‚‹ã¨æ€ã†ã®ã§ã€ãã¡ã‚‰ã‚’ã”å‚ç…§ãã ã•ã„ã€‚ ã»ã¨ã¼ã‚ŠãŒå†·ã‚ãŸã‚‰æˆ»ã—ã¾ã™â€¦ã€‚ ãã‚Œã«ã—ã¦ã‚‚ã€æŽ’æ³„ç‰©ã®åç§°ã‚’ã‚ã‚ã„ã¦å–œã¶å°å¦ç”Ÿã¿ãŸã„ãªè¡Œå‹•ã‚’å–ã‚‰ã‚Œã‚‹æ–¹ãŒçµæ§‹ã„ã‚‹ã£ã½ã„ã“ã¨ã«æˆ¦æ…„ã—ã¦ã¾ã™ãŒã€ã¾ã‚ã€å¼·ã„å¹¼å…æ€§ã‚’æŒã¤äººãŒåœ¨è·æ—¥æ•°æœ€é•·é¦–ç›¸ã ã£ãŸã‚Šã™ã‚‹å›½ã§ã™ã®ã§ã€æ•´åˆã—ã¦ã„ã‚‹ã¨ã¯ã„ãˆã‚‹ã®ã‹ãª
inoueyuworks 2020/11/18
linux ã¯ã‚«ãƒ¼ãƒãƒ«å†…éƒ¨ã«ã‚¨ãƒ³ãƒˆãƒãƒ”ãƒ¼ãƒ—ãƒ¼ãƒ«ã‚’ä¿æŒã—ã¦ã„ã‚‹ã€‚ /dev/random ã¯ã€ãã®ã‚¨ãƒ³ãƒˆãƒãƒ”ãƒ¼ã‚’ä½¿ã„ãã‚‹ã¨ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã€‚ /dev/urandom ã¯ã€å†åˆ©ç”¨ã™ã‚‹ã€‚

linux

random

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Is MD5 considered insecure?
inoueyuworks 2020/10/28
md5 ã‚’ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒãƒƒã‚·ãƒ¥ã«ã™ã‚‹ã®ã¯ã€æœ€æ—©è„†å¼±ã§ã‚ã‚‹ã€‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰èªè¨¼ãŒç›®çš„ãªã‚‰ã°ã€ PBKDF2 or bcrypt ã‚’ã€ãƒãƒƒã‚·ãƒ¥æ©Ÿèƒ½ãŒæ¬²ã—ã„ãªã‚‰ã°ã€ SHA-256 ã‚’ä½¿ã„ã¾ã—ã‚‡ã†ã€‚

md5

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PBKDF2

bcrypt
ãƒªãƒ³ã‚¯
ã€Œã‚·ã‚¹ãƒ†ãƒ ã‚’éš ã™ã€ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’é«˜ã‚ã‚‹ã®ã¯æœ¬å½“ã«æ‚ªãªã®ã‹ï¼Ÿ
ã‚·ã‚¹ãƒ†ãƒ ã‚„ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®æ§‹é€ ã‚’ç§˜åŒ¿ã™ã‚‹ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’é«˜ã‚ã‚‹ã€Œéš ãºã„ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£(Security by Obscurity)ã€ã¯ã€ç¾ä»£ã§ã¯æœ¬è³ªçš„ãªå®‰å…¨æ€§ã‚’ç¢ºä¿ã§ãã¦ã„ãªã„ã¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ã—ã‹ã—ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å°‚é–€å®¶ã§ã‚ã‚‹Utku Åženæ°ã¯ã€Œéš ãºã„ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯éŽå°è©•ä¾¡ã•ã‚Œã¦ã„ã‚‹ã€ã¨æŒ‡æ‘˜ã—ã¦ã„ã¾ã™ã€‚ Security by Obscurity is Underrated â€“ Utku Sen - Blog â€“ computer security, programming https://utkusen.com/blog/security-by-obscurity-is-underrated.html è„†å¼±æ€§ã®ã‚ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã‚’æ”»æ’ƒè€…ã‹ã‚‰éš ã™ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’é«˜ã‚ã‚ˆã†ã¨ã™ã‚‹ã€Œéš ãºã„ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã¯ã€ã²ã¨ãŸã³ã‚·ã‚¹ãƒ†ãƒ ã®æ§‹é€ ãŒå¤–éƒ¨ã«æ¼ã‚Œã‚‹ã¨æ”»æ’ƒã‚’é˜²ãæ‰‹ã ã¦ãŒãªã„ã“ã¨ã‹ã‚‰ã€ç¾
inoueyuworks 2020/09/26
éš ã™ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£(Security by Obscurity)ã®åŠ¹ç”¨ã«ã¤ã„ã¦ã®ã¾ã¨ã‚ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚° - Wikipedia
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã«ãŠã„ã¦ã€ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚° ã¨ã¯ã€è„†å¼±æ€§ã‚’æ¸›ã‚‰ã™ã“ã¨ã§ã‚·ã‚¹ãƒ†ãƒ ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å …ç‰¢ã«ã™ã‚‹ã“ã¨ã€‚ã‚·ã‚¹ãƒ†ãƒ ã¯å¤šé¢çš„ãªè„†å¼±æ€§ã‚’æŠ±ãˆã¦ãŠã‚Šã€åŽŸç†çš„ã«ã¯ã€å˜ä¸€ã®æ©Ÿèƒ½ã—ã‹æŒãŸãªã„ã‚·ã‚¹ãƒ†ãƒ ã¯ã€è¤‡æ•°ã®æ©Ÿèƒ½ã‚’æŒã£ãŸã‚·ã‚¹ãƒ†ãƒ ã‚ˆã‚Šã‚‚å …ç‰¢ã§ã‚ã‚‹ã€‚å¿…è¦ã®ãªã„ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®å‰Šé™¤ã€ä¸è¦ãªãƒ¦ãƒ¼ã‚¶ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚„ãƒ‡ãƒ¼ãƒ¢ãƒ³ã‚’åœæ¢ãªã©ã§ã€æ”»æ’ƒå¯èƒ½ãªå´é¢ã‚’æ¸›ã‚‰ã™ã“ã¨ãŒã§ãã‚‹ã€‚ Unix ã‚„ Linux ã«ã¯ã€è¤‡æ•°ã®ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚°æ–¹æ³•ãŒã‚ã‚‹ã€‚ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚°ã®éš›ã«ã¯ã€ä½µã›ã¦ä»–ã®æ–¹æ³•ã‚‚ç”¨ã„ã‚‰ã‚Œã‚‹ã“ã¨ãŒã‚ã‚Šã€ç‰¹ã«ã€Exec Shield ã‚„ PaX ã¨ã„ã£ãŸãƒ‘ãƒƒãƒã‚’ã‚«ãƒ¼ãƒãƒ«ã«é©ç”¨ã™ã‚‹ã€ä¾µå…¥æ¤œçŸ¥ã‚·ã‚¹ãƒ†ãƒ ã‚„ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã€ä¾µå…¥é˜²æ¢ã‚·ã‚¹ãƒ†ãƒ ã‚’å°Žå…¥ã—ãƒãƒ¼ãƒˆã‚’å¡žããªã©ã®æ–¹æ³•ãŒæŽ¡ã‚‰ã‚Œã‚‹ã€‚ã¾ãŸã€ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚°ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚„ãƒ„ãƒ¼ãƒ«ã‚‚å˜åœ¨ã™ã‚‹ã€‚Bastille Linux ã€Solaris å‘ã‘ã®JASS ã€Apache/PHP Hardener ãªã©
inoueyuworks 2020/09/09
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã«ãŠã„ã¦ã€ãƒãƒ¼ãƒ‰ãƒ‹ãƒ³ã‚° ã¨ã¯ã€è„†å¼±æ€§ã‚’æ¸›ã‚‰ã™ã“ã¨ã§ã‚·ã‚¹ãƒ†ãƒ ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å …ç‰¢ã«ã™ã‚‹ã“ã¨ã€‚ referred as "hardening standard". æ—¥æœ¬èªžã§ã¯ãŠãã‚‰ãã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åŸºæº–ã€

hardening

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
OWASP Top Ten | OWASP Foundation
This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Important note: OWASP Top Ten 2025 Current project status as of September 2024: We are planning to announce the release of the OWASP Top 10:2025 in the first half of 2025. Data Collection (Now - December 2024): Please donate your application penetration testing statistics. Stay Tune
inoueyuworks 2020/08/04
ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã®ã€è„†å¼±æ€§ top 10.

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

OWASP

ãƒ©ãƒ³ã‚ãƒ³ã‚°

web
ãƒªãƒ³ã‚¯
Are HTTP cookies port specific?
The current cookie specification is RFC 6265, which replaces RFC 2109 and RFC 2965 (both RFCs are now marked as "Historic") and formalizes the syntax for real-world usages of cookies. It clearly states: Introduction ... For historical reasons, cookies contain a number of security and privacy infelicities. For example, a server can indicate that a given cookie is intended for "secure" connections,
inoueyuworks 2020/08/01
ç¾åœ¨ã® cookie ã®ä»•æ§˜ (RFC 6265) ã§ã¯ã€ cookie ã¯ domain-wise ã§ç®¡ç†ã•ã‚Œã¦ãŠã‚Šã€ port ã¯åŒä¸€åŒ–ã•ã‚Œã‚‹ã€‚

cookie

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

http
ãƒªãƒ³ã‚¯
PCI DSS 3.2.1 ã«å¯¾å¿œã™ã‚‹AWSã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– | DevelopersIO
ã“ã‚“ã«ã¡ã¯ã€‚ ã”æ©Ÿå«Œã„ã‹ãŒã§ã—ã‚‡ã†ã‹ã€‚ "No human labor is no human error" ãŒå¤§å¥½ããªå‰äº• äº®ã§ã™ã€‚ AWS ä¸Šã§æ±ºæ¸ˆç³»ã‚·ã‚¹ãƒ†ãƒ ã‚’ç¨¼åƒã•ã›ã‚‹ã“ã¨ã¯ã™ã§ã«çã—ãã‚ã‚Šã¾ã›ã‚“ã€‚ ä»Šå¾Œã‚‚äº‹ä¾‹ã¯ä¼¸ã³ã¦ã„ãã¨æƒ³åƒã—ã¾ã™ã€‚ AWS ã§ç¨¼åƒã•ã›ã‚‹ã“ã¨ã®ãƒ¡ãƒªãƒƒãƒˆã¯å¤šãã‚ã‚Šã¾ã™ãŒã€ä¸€ç•ªã®ãƒ¡ãƒªãƒƒãƒˆã¯ é«˜ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã ã¨è€ƒãˆã¦ã„ã¾ã™ã€‚ ç‰©ç†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯ãƒ‡ãƒ¼ã‚¿ï¼ã‚»ãƒ³ã‚¿ãƒ¼äº‹æ¥ç¤¾ã®ãªã‹ã§ã‚‚ãƒˆãƒƒãƒ—ã‚¯ãƒ©ã‚¹ã®å …ç‰¢ã•ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ PCI DSS è¦ä»¶9 ã€Œã‚«ãƒ¼ãƒ‰ä¼šå“¡ãƒ‡ãƒ¼ã‚¿ã¸ã®ç‰©ç†ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶é™ã™ã‚‹ã€ã¯ AWS ãŒå–å¾—ã—ã¦ã„ã‚‹èªå®šã«ã‚ªãƒ•ãƒãƒ¼ãƒ‰ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã€‚ è«–ç†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯æ±ºæ¸ˆäº‹æ¥ç¤¾ã§æ‹…ä¿ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ãŒã€AWS ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã—ã£ã‹ã‚Šæ´»ç”¨ã™ã‚Œã°ã‚»ã‚ãƒ¥ã‚¢ãªã‚·ã‚¹ãƒ†ãƒ ã‚’æ§‹ç¯‰å¯èƒ½ã§ã™ã€‚ æœ¬ã‚¨ãƒ³ãƒˆãƒªã§ã¯ãã®è¾ºã‚Šã‚’è¨˜è¿°ã—ã¦ã„ãã¾ã™ã€‚ ã‚½ãƒ¼ã‚¹ å…¬å¼ãŒå…¬é–‹ã—ã¦ã„ã‚‹æƒ…å ±ã‚’åŸºã«è¨˜è¿°ã—ã¦ã„ã¾ã™ã€‚
inoueyuworks 2020/07/22
ã‚¯ãƒ©ã‚¹ãƒ¡ã‚½ãƒƒãƒ‰ã«ã‚ˆã‚‹ã€ aws ã«ã‚ˆã‚‹ PCI DSS å®Ÿç¾ã«ã¤ã„ã¦ã®è§£èª¬è¨˜äº‹

PCI DSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

aws
ãƒªãƒ³ã‚¯
é€€è·ã¸ã®å‚™ãˆãŒé‡è¦ - Fox on Security
ãƒ‡ãƒ¼ã‚¿å¾©å…ƒã‚µãƒ¼ãƒ“ã‚¹ã®æ³•äººå•ã„åˆã‚ã›ã§å¤šã„ã®ã¯ã€Œé€€è·è€…PCèª¿æŸ»ã€ã€Œãƒ‡ãƒ¼ã‚¿å¾©æ—§ã€ã€Œç¤¾å†…ä¸æ£ã€ãªã®ã ãã†ã€‚æ¶ˆã—ãŸãƒ‡ãƒ¼ã‚¿ã‚’å¾©å…ƒã™ã‚‹ãƒ‹ãƒ¼ã‚ºã¯éžå¸¸ã«é«˜ã„ã‚ˆã†ã§ã™ã€‚ dime.jp é€€è·è€…ã®ãƒ‘ã‚½ã‚³ãƒ³ãƒ»ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³èª¿æŸ»ã§ã¯ã€ãƒ‡ã‚¸ã‚¿ãƒ«æ©Ÿå™¨ã«æ®‹ã•ã‚ŒãŸåŸºæœ¬æ“ä½œã®å±¥æ´ï¼ˆãƒã‚°ã‚¤ãƒ³ãƒ»ãƒã‚°ã‚ªãƒ•ï¼‰ã€USBæŽ¥ç¶šå±¥æ´ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¢ã‚¯ã‚»ã‚¹å±¥æ´ã€ãƒ•ã‚¡ã‚¤ãƒ«ã®å‰Šé™¤æ—¥ç‰ã‚’æ‰‹ãŒã‹ã‚Šã«ã€é€€è·è€…ãŒé€€è·æ™‚ãªã„ã—ã¯åœ¨è·ä¸ã«ä¸æ£è¡Œç‚ºã‚’è¡Œã£ã¦ã„ãªã„ã‹ã‚’èª¿æŸ»ã€‚ è·è€…èª¿æŸ»ã®å ´åˆã€ç›¸è«‡ã‚’å—ã‘ã‚‹ãªã‹ã§ç‰¹ã«å¤šã„ã®ã¯ã€Œé€€è·è€…ãŒåœ¨è·ä¸ã«ä½¿ç”¨ã—ã¦ã„ãŸãƒ‘ã‚½ã‚³ãƒ³ã‹ã‚‰ãƒ‡ãƒ¼ã‚¿ãŒå¤§é‡ã«å‰Šé™¤ãªã„ã—ã¯åˆæœŸåŒ–ã•ã‚Œã¦ã„ãŸã€ã¨ã„ã†ã‚±ãƒ¼ã‚¹ã ã€‚ å®Ÿéš›ã«å¯¾è±¡ç¤¾å“¡ãŒä½¿ç”¨ã—ã¦ã„ãŸãƒ‘ã‚½ã‚³ãƒ³ã‚’èª¿æŸ»ã™ã‚‹ã¨ã€åœ¨è·ä¸ã«ç¤¾å†…ã®é¡§å®¢æƒ…å ±ã‚„æŠ€è¡“æƒ…å ±ã‚’é–²è¦§ãƒ»ã‚³ãƒ”ãƒ¼ã—ã€USBã‚„ã‚¯ãƒ©ã‚¦ãƒ‰ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã‚’åˆ©ç”¨ã—ã¦å¤–éƒ¨ã¸æŒã¡å‡ºã—ã¦ã„ãŸã“ã¨ãŒåˆ¤æ˜Žã—ãŸäº‹ä¾‹ã‚‚å¤šæ•°ã‚ã£ãŸã¨ã„ã†ã€‚æ·±åˆ»ãªã‚‚ã®ã«ãªã‚‹ã¨ã€é€€è·è€…ãŒç¤¾ã®æ©Ÿå¯†æƒ…å ±ã‚’æŒã¡
inoueyuworks 2020/07/04
é€€è·è€…ãŒæ‚ªã„ã“ã¨ã‚’ã—ã¦ã„ãªã‹ã£ãŸã‹ã‚’ç›£æŸ»ã§ãã‚‹çŠ¶æ…‹ã«ã—ã¦ãŠã‹ãªã„ã¨ã€æœ€æ‚ªãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯ã™ã‚‹ã“ã¨ã«ãªã‚Šã€ãã®æ–¹ãŒé«˜é¡ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Windows 10 - ãƒ‘ã‚½ã‚³ãƒ³ï¼ˆç”»é¢ï¼‰ã‚’ãƒãƒƒã‚¯ - é›¢å¸ä¸ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç¢ºä¿
Windows 10 ã®ç”»é¢ã‚’ãƒãƒƒã‚¯ã™ã‚‹æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ãƒ‘ã‚½ã‚³ãƒ³ã§ä½œæ¥ã®é€”ä¸ã«ä½•ã‹ã—ã‚‰ã®æ‰€ç”¨ã§ã€ãƒ‘ã‚½ã‚³ãƒ³ã®å‰ã‹ã‚‰é›¢å¸ã™ã‚‹å ´åˆã¯ä»–ã®äººã«ç”»é¢ã‚’è¦‹ã‚‰ã‚Œãªã„ã‚ˆã†ã«ã€æ“ä½œã•ã‚Œãªã„ã‚ˆã†ã«ãƒ‘ã‚½ã‚³ãƒ³ï¼ˆç”»é¢ï¼‰ã‚’ãƒãƒƒã‚¯ã—ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ç¢ºä¿ã—ã¦ãŠã„ãŸã»ã†ãŒã„ã„ã§ã—ã‚‡ã†ã€‚ ã“ã“ã§ã¯ã€Œã‚¹ã‚¿ãƒ¼ãƒˆãƒ¡ãƒ‹ãƒ¥ãƒ¼ã€ã¨ã€Œã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆã‚ãƒ¼ã€ã‚’ä½¿ã£ã¦ã€ç”»é¢ã‚’ãƒãƒƒã‚¯ã™ã‚‹æ–¹æ³•ã‚’ã¿ã¦ã„ãã¾ã™ã€‚ ã‚¹ã‚¿ãƒ¼ãƒˆãƒ¡ãƒ‹ãƒ¥ãƒ¼ ã‚¹ã‚¿ãƒ¼ãƒˆãƒœã‚¿ãƒ³ã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ ã‚¹ã‚¿ãƒ¼ãƒˆãƒ¡ãƒ‹ãƒ¥ãƒ¼ãŒè¡¨ç¤ºã•ã‚Œã‚‹ã®ã§ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ã€Œã‚¢ã‚¤ã‚³ãƒ³ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã—ã‚‡ã†ã€‚ ã™ã‚‹ã¨ã€ãƒãƒƒãƒ—ã‚¢ãƒƒãƒ—ãƒ»ãƒ¡ãƒ‹ãƒ¥ãƒ¼ãŒè¡¨ç¤ºã•ã‚Œã‚‹ã®ã§ã€ã€Œãƒãƒƒã‚¯ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ãƒãƒƒã‚¯ç”»é¢ ã™ã‚‹ã¨ã€ã“ã®ã‚ˆã†ã«ãƒ‘ã‚½ã‚³ãƒ³ã®ç”»é¢ãŒãƒãƒƒã‚¯ã•ã‚Œã¾ã™ã€‚ ãƒãƒƒã‚¯ç”»é¢ã®ã©ã“ã‹ã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ ã‚µã‚¤ãƒ³ã‚¤ãƒ³ç”»é¢ ã‚µã‚¤ãƒ³ã‚¤ãƒ³ç”»é¢ãŒè¡¨ç¤ºã•ã‚Œã€PINï¼ˆãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ï¼‰ã‚’å…¥åŠ›ã™ã‚‹ã“ã¨ã§ ãƒãƒƒã‚¯ç”»é¢ã‚’è§£é™¤ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ãƒãƒƒã‚¯ç”»é¢ã¯è¡¨ç¤º
inoueyuworks 2020/06/25
ã‚¹ã‚¯ãƒªãƒ¼ãƒ³ãƒãƒƒã‚¯ã®ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆã‚ãƒ¼: Windows + L

Windows

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
OAuth 2.0 ã®ä»•çµ„ã¿ã¨èªè¨¼æ–¹æ³•
OAuth 2.0 ã®ä»•çµ„ã¿ã¨èªè¨¼æ–¹æ³•ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚OAuth 1.0 ã®èªè¨¼ãƒ•ãƒãƒ¼ã¨ãã‚Œã‚‰ã®å•é¡Œç‚¹ã‹ã‚‰ã€OAuth 2.0 ã®èªè¨¼ãƒ•ãƒãƒ¼ã€èªå¯ã‚³ãƒ¼ãƒ‰ã€ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³ã€ãƒªãƒ•ãƒ¬ãƒƒã‚·ãƒ¥ãƒˆãƒ¼ã‚¯ãƒ³ã¾ã§ç¶²ç¾…ã—ã¾ã™ã€‚
inoueyuworks 2020/06/01
OAuth2.0 ã®ã‚¢ã‚¯ãƒ†ã‚£ãƒ“ãƒ†ã‚£å›³

OAuth

OAuth2.0

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
How do I deal with a compromised server?
Want to improve this post? Provide detailed answers to this question, including citations and an explanation of why your answer is correct. Answers without enough detail may be edited or deleted. This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical Version I suspect that one
inoueyuworks 2020/05/03
compromised ãªã‚µãƒ¼ãƒãƒ¼ã«å¯¾ã™ã‚‹å¯¾å‡¦æ–¹æ³•ã® Canonical Question & Answer

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

compromised
ãƒªãƒ³ã‚¯
Crowdstrike Threat Landscape: APTs & Adversary Groups
View your global threat landscape below organized by eCrime, hacktivism, and nation states based on origin country. Map will show adversaries active within the past 90 days.
inoueyuworks 2019/10/18
adversarial entity ã® identification

cloudstrike

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ä¸€ç•ªåˆ†ã‹ã‚Šã‚„ã™ã„ OAuth ã®èª¬æ˜Ž - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article? ã¯ã˜ã‚ã« éŽåŽ»ä¸‰å¹´é–“ã€æŠ€è¡“è€…ã§ã¯ãªã„æ–¹ã€…ã« OAuthï¼ˆã‚ªãƒ¼ã‚ªãƒ¼ã‚¹ï¼‰ã®èª¬æ˜Žã‚’ç¹°ã‚Šè¿”ã—ã¦ãã¾ã—ãŸâ€»1,â€»2ã€‚ãã®çµæžœã€OAuth ã‚’ã‹ãªã‚Šåˆ†ã‹ã‚Šã‚„ã™ãèª¬æ˜Žã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ã“ã®è¨˜äº‹ã§ã¯ã€ãã®èª¬æ˜Žæ‰‹é †ã‚’ã”ç´¹ä»‹ã—ã¾ã™ã€‚ â€»1ï¼šAuthlete ç¤¾ã®å‰µæ¥è€…ã¨ã—ã¦è³‡é‡‘èª¿é”ã®ãŸã‚æŠ•è³‡å®¶å·¡ã‚Šã‚’ã—ã¦ã„ã¾ã—ãŸï¼ˆTechCrunch Japanï¼šã€ŽAPIã‚¨ã‚³ãƒŽãƒŸãƒ¼ç«‹ã¡ä¸ŠãŒã‚Šã®ã‚«ã‚®ã€OAuthæŠ€è¡“ã®AUTHLETEãŒ500 Startups Japanã‚‰ã‹ã‚‰1.4å„„å††ã‚’èª¿é”ã€ï¼‰ã€‚Authlete ã‚¢ã‚«ã‚¦ãƒ³ãƒˆç™»éŒ²ã¯ã“ã¡ã‚‰ï¼ â€»2ï¼šãã—ã¦ï¼’å›žç›®ã®
inoueyuworks 2019/07/23
OAuth

oauth2

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

api

security
ãƒªãƒ³ã‚¯
ã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ã®åŽŸç† - Wikipedia
æš—å·æŠ€è¡“ã«ãŠã„ã¦ã€ã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ã®åŽŸç†ï¼ˆã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ã®ã’ã‚“ã‚Šã€Kerckhoffs' principle ã‚‚ã—ãã¯Kerckhoffs' assumptionï¼‰ã¨ã¯ã€19ä¸–ç´€ã«ã‚¢ã‚¦ã‚°ã‚¹ãƒˆãƒ»ã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ï¼ˆAuguste Kerckhoffsï¼‰ã«ã‚ˆã£ã¦ææ¡ˆã•ã‚ŒãŸæ¬¡ã®åŽŸç†ã§ã‚ã‚‹ï¼šæš—å·æ–¹å¼ã¯ã€ç§˜å¯†éµä»¥å¤–ã®å…¨ã¦ãŒå…¬çŸ¥ã«ãªã£ãŸã¨ã—ã¦ã€ãªãŠå®‰å…¨ã§ã‚ã‚‹ã¹ãã§ã‚ã‚‹ã€‚ ã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ã®åŽŸç†ã¯ã€æš—å·æ–¹å¼ã¯ç§˜å¯†ã«ã—ã‚ˆã†ã¨ã—ã¦ã‚‚ã‚¹ãƒ‘ã‚¤ã«ã‚ˆã£ã¦è¨è¨ˆæ›¸ãŒç›—ã¿å‡ºã•ã‚ŒãŸã‚Šæš—å·è£…ç½®ã”ã¨æ•µã«æ•ç²ã•ã‚ŒãŸã‚Šã—ã¦ã€é…ã‹ã‚Œæ—©ã‹ã‚Œæ•µã«è§£æžã•ã‚Œã¦ã—ã¾ã†ã¨ã„ã†çµŒé¨“å‰‡ã«åŸºã¥ãã€‚1883å¹´ã«å…¬è¡¨ã•ã‚ŒãŸè«–æ–‡ã«ã€è»ç”¨æš—å·ã«é–¢ã™ã‚‹æ¬¡ã®6å€‹ã®æ¡ä»¶ãŒç¤ºã•ã‚Œã¦ãŠã‚Š[1]ã€ãã®ã†ã¡ã®2ç•ªç›®ã®æ¡ä»¶ãŒç¾åœ¨ã€Œã‚±ãƒ«ã‚¯ãƒ›ãƒ•ã‚¹ã®åŽŸç†ã€ã¨å‘¼ã°ã‚Œã¦ã„ã‚‹ã€‚ æš—å·æ–¹å¼ã¯ã€ç¾å®Ÿçš„ã«ï¼ˆæ•°å¦çš„ã«ã€ã§ã¯ãªãã¦ã‚‚ã‚ˆã„ï¼‰é€†å¤‰æ›ä¸èƒ½ã§ã‚ã‚‹ã“ã¨ æš—å·æ–¹å¼ã¯ã€ç§˜å¯†ã§ã‚ã‚‹ã“ã¨ã‚’å¿…è¦ã¨ã›ãšã€æ•µã®æ‰‹ã«è½ã¡
inoueyuworks 2018/06/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚·ã‚¹ãƒ†ãƒ
ãƒªãƒ³ã‚¯
The Metasploit Project by H.D. Moore
The worldâ€™s most used penetration testing framework Knowledge is power, especially when itâ€™s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.
inoueyuworks 2018/02/21
ãªã‚“ã‹ã™ã£ã”ã„æ”»æ’ƒãƒ„ãƒ¼ãƒ«ã®ãƒ„ãƒ¼ãƒ«ç¾¤

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Japan Vulnerability Notes
JVNVU#99084687: Siemensè£½å“ã«å¯¾ã™ã‚‹ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆï¼ˆ2024å¹´8æœˆï¼‰ã€€[2024/08/16 14:30] JVNVU#94517482: AVEVA Historianã«ãŠã‘ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã€€[2024/08/16 14:00] JVNVU#91739300: è¤‡æ•°ã®PTCè£½å“ã«ãŠã‘ã‚‹åˆ¶é™ã¾ãŸã¯èª¿æ•´ãªã—ã®ãƒªã‚½ãƒ¼ã‚¹ã®å‰²ã‚Šå½“ã¦ã®è„†å¼±æ€§ã€€[2024/08/16 14:00] JVNVU#99298639: Siemensè£½å“ã«å¯¾ã™ã‚‹ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆï¼ˆ2024å¹´7æœˆï¼‰ã€€[2024/08/14 17:45] JVNVU#98271228: Siemensè£½å“ã«å¯¾ã™ã‚‹ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆï¼ˆ2023å¹´12æœˆï¼‰ã€€[2024/08/14 17:45] JVNVU#94715153: Siemensè£½å“ã«å¯¾ã™ã‚‹ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆï¼ˆ2023å¹´4æœˆï¼‰ã€€[2024/08/14 17:45] JV
inoueyuworks 2018/02/21
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Linuxã‚³ã‚¢ãƒ¡ãƒ³ãƒãƒ¼ã«ã‚ˆã‚‹Meltdownã¨Spectre å¯¾å¿œçŠ¶æ³ã®èª¬æ˜Ž ï¼ˆ1/19æ›´æ–°ï¼‰ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article? ã¯ã˜ã‚ã« Linuxã®å®‰å®šã‚«ãƒ¼ãƒãƒ«ã®ã¨ã‚Šã¾ã¨ã‚å½¹ã€ã‚°ãƒ¬ãƒƒã‚°ãƒ»ã‚¯ãƒ©ãƒ¼ãƒãƒ¼ãƒˆãƒžãƒ³ã«ã‚ˆã‚‹ãƒ¡ãƒ«ãƒˆãƒ€ã‚¦ãƒ³ã¨ã‚¹ãƒšã‚¯ã‚¿ãƒ¼å•é¡Œã«é–¢ã™ã‚‹1/6æ™‚ç‚¹ã§ã®ç¾æ³ã®èª¬æ˜Žã®è¨³æ–‡ã§ã™ã€‚ å¤ªå—ã¯è¨³è€…ãŒä¸»è¦³ã§ç‹¬è‡ªã«ä»˜åŠ ã—ãŸã‚‚ã®ã§ã™ã€‚ 2018/1/19: å¯¾å¿œçŠ¶æ³ãŒGregæ°ã«ã‚ˆã‚Šã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã•ã‚Œã¾ã—ãŸã®ã§ã€è¿½è¨˜ã—ã¾ã—ãŸã€‚ ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ åŽŸæ–‡ã¯å½“äººã®ãƒ–ãƒã‚°ã§by-nc-sa3.0ã§å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã®æ–‡ç« ã®ãƒ©ã‚¤ã‚»ãƒ³ã‚¹ã‚‚åŽŸæ–‡ã«æº–ã˜ã¾ã™ã€‚ è¬è¾ž ä½•ã‚ˆã‚Šã‚‚ã¾ãšå¤šå¿™ãªä¸æƒ…å ±ã‚’ã‚·ã‚§ã‚¢ã—ã¦ãã‚ŒãŸåŽŸè‘—è€…ã®Gregæ°ã«ã€‚ è¡¨è¨˜é–“é•ã„ã«ã¤ã„ã¦æŒ‡æ‘˜ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ä»¥ä¸‹ä¿®æ£ã—ã¾ã—ãŸã€‚
inoueyuworks 2018/01/10
linux

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

meltdown

Spectre
ãƒªãƒ³ã‚¯
æŠ•æ©Ÿçš„å®Ÿè¡Œã«é–¢ã™ã‚‹è„†å¼±æ€§ã€ŒMeltdownã€ã¨ã€ŒSpectreã€ã«ã¤ã„ã¦è§£èª¬
ã‚ªãƒ³ãƒ—ãƒ¬ãƒŸã‚¹ã‹ã‚‰ã‚¯ãƒ©ã‚¦ãƒ‰ã¸ã®ç§»è¡Œã‚’ã¯ã˜ã‚ã€ãƒã‚¤ãƒ–ãƒªãƒƒãƒ‰ã‚¯ãƒ©ã‚¦ãƒ‰ç’°å¢ƒã‚’ã‚·ãƒ¼ãƒ ãƒ¬ã‚¹ã«ä¿è·ã—ãªãŒã‚‰ã€ã‚¯ãƒ©ã‚¦ãƒ‰ã®åˆ©ç‚¹ã‚’å®Ÿç¾ã—ã¾ã™ã€‚ è©³ã—ãã¯ã“ã¡ã‚‰
inoueyuworks 2018/01/10
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸