Cross-Site Request Forgery For POST Requests With An XML Body | pentestmonkey
Cross-Site Request Forgery For POST Requests With An XML Body I recently had cause to create a proof-of-concept for a site that seemed to be vulnerable to Cross-Site Request Forgery (CSRF). I say “seemed†because there was no CSRF protection, but I was finding the XML POST body really hard to forge (It was a SOAP / XMLRPC type request). Eventually Sid from notsosecure.com pointed me in the right
SHA-1 証明書ã®è¦åˆ¶ãƒ»å½±éŸ¿ã¨ SSL ã®ã‚¨ãƒ©ãƒ¼ã«ã¤ã„㦠（å‰ç·¨ï¼‰ | ã•ãらã®ãƒŠãƒ¬ãƒƒã‚¸
ã¯ã˜ã‚ã« ã¯ã˜ã‚ã¾ã—ã¦ã€ã‚µã‚¤ãƒãƒ¼ãƒˆãƒ©ã‚¹ãƒˆã®å‚ç”°ã§ã™ã€‚SSL サーãƒãƒ¼è¨¼æ˜Žæ›¸ã®ã‚µãƒãƒ¼ãƒˆãƒ‡ã‚¹ã‚¯ã§ãƒ†ã‚¯ãƒ‹ã‚«ãƒ«ã‚µãƒãƒ¼ãƒˆã‚’主ã«æ‹…当ã—ã¦ã„ã¾ã™ã€‚ ã“ã®ãŸã³ã€ã•ãらã®ãƒŠãƒ¬ãƒƒã‚¸ã«å¯„稿ã•ã›ã¦ã„ãŸã ãã“ã¨ã¨ãªã‚Šã¾ã—ãŸã€‚ã©ã†ãžã€ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ ã•ã¦ã€ä»Šå›žã¯ç§ãŒãŠå®¢æ§˜ã‹ã‚‰ã‚ˆãèžã‹ã‚Œã‚‹ã€SSL/TLS (以é™ã¯ã€SSL ã ã‘ã«çœç•¥ã—ã¦è¨˜è¼‰ã—ã¾ã™)ã«é–¢ã™ã‚‹ãŠè©±ã‚’以下㮠2 本立ã¦ã§ã”紹介ã—ã¾ã™ã€‚ SHA-1 証明書ã®è¦åˆ¶ãƒ»å½±éŸ¿ã®æŒ¯ã‚Šè¿”ã‚Šã¨æœ€æ–°å‹•å‘ SSL 接続時ã«ã‚ˆãã‚ã‚‹ã‚»ã‚ュリティè¦å‘Šãƒ»ã‚¨ãƒ©ãƒ¼ã¨ãã®å¯¾ç– ãªãŠã€SSL ã«é–¢ã™ã‚‹åŸºæœ¬çš„ãªãŠè©±ã¯å½“社ã®å‚本ãŒå¯„稿ã—ã¦ã„る「改ã‚ã¦çŸ¥ã‚ã†ã€SSLサーãƒãƒ¼è¨¼æ˜Žæ›¸ã¨ã¯ï¼Ÿã€ã‚·ãƒªãƒ¼ã‚ºã‚’ã”一èªãã ã•ã„。 第 1 部： SHA-1 証明書ã®è¦åˆ¶ãƒ»å½±éŸ¿ã®æŒ¯ã‚Šè¿”ã‚Šã¨æœ€æ–°å‹•å‘ SHA-1 証明書ã®è¦åˆ¶ã®æŒ¯ã‚Šè¿”ã‚Š ã¾ãšã€SHA-1 証明書（署åアルゴリズム㌠SHA-1 ã® SSL
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
処ç†ã‚’実行ä¸ã§ã™
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
第20回サイãƒãƒ¼çŠ¯ç½ªã«é–¢ã™ã‚‹ç™½æµœã‚·ãƒ³ãƒã‚¸ã‚¦ãƒ ＆第11å›žæƒ…å ±å±æ©Ÿç®¡ç†ã‚³ãƒ³ãƒ†ã‚¹ãƒˆ
CSRF on JSON requests | IT Security Concepts
Announcement: ELB stickiness updates to support Feb 2020 Chromium CORs changes
{{#tags}}- {{label}}
{{/tags}}