Practical Web Cache Poisoning | PortSwigger Web Security Blog
Published: 09 August 2018 at 23:20 UTC Updated: 02 October 2023 at 14:39 UTC AbstractWeb cache poisoning has long been an elusive vulnerability, a 'theoretical' threat used mostly to scare developers into obediently patching issues that nobody could actually exploit. In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery sys
dalliã®æŒ™å‹•ã‚’検証ã—ã¦ã¿ãŸ - HK's Weblog
Rails4ã§memcachedã‚’ã‚ャッシュストアã§ä½¿ã†å®šç•ªgemã¨ã„ãˆã°dalliã¨RailsGuideã«æ›¸ã„ã¦ã‚る。ãŸã ã€ã“ã®gemãŒå®Ÿéš›ã©ã†ã‚†ã†æŒ™å‹•ã‚’ã™ã‚‹ã®ã‹ã‚°ã‚°ã£ã¦ã¿ã¦ã‚‚ã‚ã¾ã‚Šæ—¥æœ¬èªžã®æƒ…å ±ãŒè¦‹ã¤ã‹ã‚‰ãªã‹ã£ãŸã®ã§è©¦ã—ã¦ã¿ãŸã€‚ 環境 Ruby-2.0.0p353 Rails-4.0.2 dalli-2.7.0 æ£å¸¸æ™‚ã®ãƒ‘フォーマンス Requests per second: 8.65 [#/sec] (mean) Time per request: 578.181 [ms] (mean) Time per request: 115.636 [ms] (mean, across all concurrent requests) memcachedサーãƒãŒ2å°ã‚ã‚‹å ´åˆã€ã‚ã‚‹ã‚ーã¯2å°ã®ã‚µãƒ¼ãƒã«åˆ†æ•£ã—ã¦ã‚¹ãƒˆã‚¢ã•ã‚Œã¦ã—ã¾ã†ã®ã‹? Railsã§ã¯ä¸‹è¨˜ã®ã‚ˆã†ã«config.cache_storeã®
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
処ç†ã‚’実行ä¸ã§ã™
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
{{#tags}}- {{label}}
{{/tags}}