[B! IDS] mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mi1kman id:mi1kman

IDSã«é–¢ã™ã‚‹mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

IDSãŠã‚ˆã³IPSã‚µãƒ¼ãƒ“ã‚¹ã‚’æ‹¡å¼µã€IPv6ç’°å¢ƒã«å®Œå…¨å¯¾å¿œï¼ˆNTTãƒ‡ãƒ¼ã‚¿å…ˆç«¯æŠ€è¡“ï¼‰ | ScanNetSecurity
NTTãƒ‡ãƒ¼ã‚¿å…ˆç«¯æŠ€è¡“æ ªå¼ä¼šç¤¾ã¯8æœˆ1æ—¥ã€ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ç›£è¦–ã‚µãƒ¼ãƒ“ã‚¹ãŠã‚ˆã³ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹é®æ–ã‚µãƒ¼ãƒ“ã‚¹ã‚’æ‹¡å¼µã€IPv6æ©Ÿå™¨ã«å¯¾å¿œã—ãŸã¨ç™ºè¡¨ã—ãŸã€‚ã“ã‚Œã¯IPv6ç’°å¢ƒã®æœ¬æ ¼çš„ãªæ™®åŠã‚’è¦‹æ®ãˆã€IPv4ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒå‰²ã‚ŠæŒ¯ã‚‰ã‚ŒãŸæ©Ÿå™¨ã ã‘ã§ã¯ãªãã€IPv6ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒå‰²ã‚ŠæŒ¯ã‚‰ã‚ŒãŸæ©Ÿå™¨ã«å¯¾ã—ã¦ã‚‚ã‚µãƒ¼ãƒ“ã‚¹ã‚’å¯èƒ½ã«ã—ãŸã¨ã„ã†ã‚‚ã®ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€ã€ŒIPv4/IPv6ãƒ‡ãƒ¥ã‚¢ãƒ«ã‚¹ã‚¿ãƒƒã‚¯ç’°å¢ƒã®ã‚·ã‚¹ãƒ†ãƒ ã€ã€ŒIPv6/IPv4ãƒˆãƒ©ãƒ³ã‚¹ãƒ¬ãƒ¼ã‚¿ã‚’ä»‹ã—ãŸIPv6ã‚·ã‚¹ãƒ†ãƒ ã€ã€ŒIPv6ã®ã¿ã§æ§‹ç¯‰ã•ã‚ŒãŸã‚·ã‚¹ãƒ†ãƒ ã€ãªã©ã«ãŠã„ã¦ã‚‚å¾“æ¥ã¨åŒã˜å“è³ªã§ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚‹ã€‚ å¯¾å¿œã—ãŸã‚µãƒ¼ãƒ“ã‚¹ã¯ã€ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹å¯¾ç–ã‚’ã‚¢ã‚¦ãƒˆã‚½ãƒ¼ã‚·ãƒ³ã‚°ã™ã‚‹ã“ã¨ã§ã€24æ™‚é–“365æ—¥ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã‚’ä½Žæ¸›ã§ãã‚‹ã€Œä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ç›£è¦–ã‚µãƒ¼ãƒ“ã‚¹ï¼ˆIDSï¼‰ã€ãŠã‚ˆã³ã€é¡§å®¢å›ºæœ‰ã®ã‚·ã‚¹ãƒ†ãƒ ç’°å¢ƒã«ã‚ã‚ã›ã¦IPSã®ãƒãƒªã‚·ãƒ¼ã‚’ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºãƒ»é‹ç”¨ã—ã€ãƒ¯ãƒ¼ãƒ ç‰ã®æ”»æ’ƒã‚’é®æ–ãƒ»æ¤œçŸ¥ã™ã‚‹ã€Œä¸æ£ã‚¢ã‚¯ã‚»ã‚¹
mi1kman 2012/08/04
IDS

IPS

ç›£è¦–

IPv6
ãƒªãƒ³ã‚¯
ä»Šå›žã® shibuya.pm ã§ä¸€ç•ªå›°ã£ãŸã“ã¨ - kazuhoã®ãƒ¡ãƒ¢ç½®ãå ´
Mâ—‹SQL Conference & Expo å‚åŠ ä¸ã®ãŸã‚ã€ã‚¢ãƒ¡ãƒªã‚«ã‹ã‚‰ shibuya.pm é–¢é€£ã®ãƒ–ãƒã‚°ã‚¨ãƒ³ãƒˆãƒªã‚’èªã‚“ã§ã„ã‚‹ã‚ã‘ã§ã™ãŒã€‚ä¸€ç•ªå›°ã‚‹ã®ã¯ç™ºè¡¨è€…ã®çš†ã•ã‚“ãŒ shellcode (ã‚ã‚‹ã„ã¯ãã‚Œã£ã½ã„ã‚‚ã®) ã‚’ãƒ–ãƒã‚°ã«è²¼ã‚Šã¾ãã£ã¦ã‚‹ã“ã¨ã€‚ ãƒ›ãƒ†ãƒ«ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå›žç·š (LODGENET) ã«æŽ¥ç¶šã•ã‚Œã¦ã„ã‚‹ IDS ãŒã€ã©ã†ã‚‚ HTTP ä¸Šã‚’æµã‚Œã‚‹ shellcode ã‚’ç›£è¦–ã—ã¦ã„ã‚‹ã‚‰ã—ãã€x86 ãƒã‚¤ãƒŠãƒª*1ãŒæµã‚ŒãŸçž¬é–“ã«ã€ ã€Œæ”»æ’ƒã‚’æ¤œçŸ¥ã—ã¾ã—ãŸã€‚10åˆ†é–“å›žç·šã‚’åˆ‡æ–ã—ã¾ã™ã€ ã£ã¦è¡¨ç¤ºãŒã§ã¦ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã«ã¤ãªãŒã‚‰ãªããªã‚‹ã€‚ã“ã‚Œã˜ã‚ƒä»•äº‹ã«ãªã‚“ãªã„ã‚ˆãƒ¼ >< LODGENET-- ã¨ã„ã†ã“ã¨ã§ã€å›žç·šæ–ä¸ã®æ€’ã‚Šã«ã¾ã‹ã›ã¦ãƒ–ãƒã‚°æ›´æ–°ã€‚IDS é–‹ç™ºè€…ã®æ„å›³ã¯ã‚ã‹ã‚‹ã‚“ã ã‘ã©ã€ã„ã£ãŸã„ã©ã“ã®è£½å“ãªã‚“ã ã‚ã€‚ ã¡ãªã¿ã« MySâ—‹L ãŒä¼ã›å—ãªã®ã¯ã€ã“ã®ã©ã†ã§ã‚‚ã„ã„ã‚¨ãƒ³ãƒˆãƒªãŒ http://jp
mi1kman 2009/04/24
ã¸ã‡>ã€Œãƒ›ãƒ†ãƒ«ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå›žç·š (LODGENET) ã«æŽ¥ç¶šã•ã‚Œã¦ã„ã‚‹ IDS ãŒã€ã©ã†ã‚‚ HTTP ä¸Šã‚’æµã‚Œã‚‹ shellcode ã‚’ç›£è¦–ã—ã¦ã„ã‚‹ã‚‰ã—ãã€x86 ãƒã‚¤ãƒŠãƒª*1ãŒæµã‚ŒãŸçž¬é–“ã«ã€ (ç•¥)ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã«ã¤ãªãŒã‚‰ãªããªã‚‹ã€‚ã€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

IDS

IPS

ç›£è¦–

èˆˆå‘³æ·±ã„
ãƒªãƒ³ã‚¯
ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã€ŒKAGOYA Internet Routingã€ã€ä¾µå…¥æ¤œçŸ¥æ©Ÿèƒ½ã‚’æ¨™æº–æè¼‰
ã‚«ã‚´ãƒ¤ãƒ»ã‚¸ãƒ£ãƒ‘ãƒ³ã¯4æœˆ2æ—¥ã€é‹å–¶ã™ã‚‹ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã€ŒKAGOYA Internet Routingã€ã«ãŠã„ã¦ã€å…±ç”¨ã‚µãƒ¼ãƒå…¨ãƒ—ãƒ©ãƒ³ã®æ¨™æº–ä»•æ§˜ã«ã€Œä¾µå…¥æ¤œçŸ¥ãƒ»ãƒ–ãƒãƒƒã‚¯ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã€ã‚’è¿½åŠ ã—ãŸã€‚ å¾“æ¥ã¯åŒç¤¾ã®ã€Œå°‚ç”¨ã‚µãƒ¼ãƒãƒ¼ãƒ—ãƒ©ãƒ³ã€ã¨ã€Œå°‚ç”¨ã‚µãƒ¼ãƒãƒ¼ãƒ—ãƒã€ã®ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚µãƒ¼ãƒ“ã‚¹ã¨ã—ã¦ä¾µå…¥æ¤œçŸ¥ãƒ»ãƒ–ãƒãƒƒã‚¯ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’æä¾›ã—ã¦ã„ãŸã€‚ä»Šå›žã®æŽªç½®ã«ã‚ˆã‚Šã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯æœˆé¡åŸºæœ¬æ–™é‡‘ã®ã¿ã§ã“ã®æ©Ÿèƒ½ã‚’åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚‹ã€‚ ä¾µå…¥æ¤œçŸ¥ãƒ»ãƒ–ãƒãƒƒã‚¯ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã¯ã€ã‚µãƒ¼ãƒã‚„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã¸ã®ä¸æ£ãªä¾µå…¥ã‚’é˜»æ¢ã™ã‚‹IPSã‚’åˆ©ç”¨ã—ã¦ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã‚„æœªçŸ¥ã®æ”»æ’ƒã€ã¾ãŸã¯ã‚µãƒ¼ãƒã«ä»•æŽ›ã‘ã‚‰ã‚ŒãŸæ‚ªæ„ã‚ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ãŒç™ºä¿¡ã™ã‚‹æƒ…å ±ãªã©ã‚’è‡ªå‹•æ¤œçŸ¥ã—ã€ã‚µãƒ¼ãƒã‚’é˜²å¾¡ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã€‚ ãªãŠã€ç¾åœ¨ã€å…±ç”¨ã‚µãƒ¼ãƒå„ãƒ—ãƒ©ãƒ³ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã¯ã€4æœˆ2æ—¥ã‹ã‚‰è‡ªå‹•çš„ã«ä¾µå…¥æ¤œçŸ¥ãƒ»ãƒ–ãƒãƒƒã‚¯ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚µãƒ¼ãƒ“ã‚¹ãŒé©ç”¨ã•ã‚Œã‚‹ã€‚
mi1kman 2009/04/09
ã¤ã„ã§ã«WAFã‚‚æ¨™æº–è£…å‚™ã—ã¦ã‚‚ã‚‰ãˆã‚Œã°è‰¯ã„ã®ã§ã¯/IPSãªã®ã‹?ç›£è¦–ã¯ã‚»ã‚³ãƒ ãƒˆãƒ©ã‚¹ãƒˆã‚·ã‚¹ãƒ†ãƒ ã‚ºãŒã‚„ã‚‹ã‚‰ã—ã„ http://www.kagoya.net/option/ips/

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒ

IDS

IPS
ãƒªãƒ³ã‚¯
ASP.NET 1.1ã«æ–°ãŸãªSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½æ€§ï¼ŒIDS/IPS/WAFã‚’ç´ é€šã‚Š
ASP.NET 1.1ã‚’ä½¿ã£ã¦ã„ã‚‹Webã‚µã‚¤ãƒˆã«ï¼Œæ–°ãŸãªSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã®å¯èƒ½æ€§ãŒæ½œã‚“ã§ã„ã‚‹ã“ã¨ãŒåˆ†ã‹ã£ãŸã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ä¼šç¤¾ã§ã‚ã‚‹HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ã®å¾³ä¸¸ æµ©æ°ãŒè¦‹ä»˜ã‘ãŸï¼ˆHASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ãŒå…¬é–‹ã—ãŸæƒ…å ±ï¼‰ã€‚ åŒæ°ãŒç™ºè¦‹ã—ãŸã®ã¯ï¼Œä¸æ£ãªãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆãƒ»ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ã¦ï¼ŒIDS/IPSï¼ˆä¾µå…¥æ¤œçŸ¥/é˜²å¾¡ã‚·ã‚¹ãƒ†ãƒ ï¼‰ã‚„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ï¼ˆWAFï¼‰ã«ã‚ˆã‚‹æ¤œçŸ¥ã‚’å›žé¿ã™ã‚‹æ‰‹æ³•ã§ã‚ã‚‹ã€‚ä¸æ£ãªãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆãƒ»ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãŸæ¤œçŸ¥å›žé¿ã«ã¤ã„ã¦ã¯ï¼Œãƒ©ãƒƒã‚¯ãŒ2008å¹´10æœˆã«å…¬é–‹ã—ãŸã€Œã€CSLã€‘CSLç·Šæ€¥æ³¨æ„å–šèµ·ãƒ¬ãƒãƒ¼ãƒˆï½žæ–°æ‰‹ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’è¡Œä½¿ã™ã‚‹ãƒœãƒƒãƒˆã®ç¢ºèªï½žã€ã¨é¡Œã™ã‚‹ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã§ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹ã€‚å¾³ä¸¸æ°ãŒç™ºè¦‹ã—ãŸã®ã¯ï¼Œãã®æ‰‹å£ã®å¿œç”¨ç‰ˆã§ã‚ã‚‹ã€‚ ASPï¼ˆActive Server Pagesï¼‰ã§ã¯ï¼Œã€ŒDEC%LAREã€ã®ã‚ˆã†ã«ãƒ‘ãƒ¼ã‚»ãƒ³
mi1kman 2009/03/24
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ASP.NET

IDS

IPS

WAF

è„†å¼±æ€§

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± - UTF-8ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFã®æ¤œçŸ¥å›žé¿æŠ€è¡“
UTF-8ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFã®æ¤œçŸ¥å›žé¿æŠ€è¡“ HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ å…¬é–‹æ—¥:2009å¹´3æœˆ23æ—¥ æ¦‚è¦ æœ¬ãƒ¬ãƒãƒ¼ãƒˆã§ã¯ã€ASP.NET(1.1)ã‚’UTF-8æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«ã¦åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã«ãŠã„ã¦ã€ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFå›žé¿ã®å¯èƒ½æ€§ã«ã¤ã„ã¦å ±å‘Šã™ã‚‹ã€‚ èƒŒæ™¯ æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ãŒ2008å¹´10æœˆã«ã€Œã€CSLã€‘CSLç·Šæ€¥æ³¨æ„å–šèµ·ãƒ¬ãƒãƒ¼ãƒˆï½žæ–°æ‰‹ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’è¡Œä½¿ã™ã‚‹ãƒœãƒƒãƒˆã®ç¢ºèªï½žã€ã¨é¡Œã™ã‚‹ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚’ç™ºè¡¨ã—ãŸã€‚ã„ãã¤ã‹ã®æ–°ç¨®ã®æ”»æ’ƒæ‰‹æ³•ãŒèª¬æ˜Žã•ã‚Œã¦ã„ã‚‹ä¸ã§ã€ä¸æ£ãªãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãŸæ¤œçŸ¥å›žé¿ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã«ã¤ã„ã¦è¨€åŠã—ã¦ã„ã‚‹ã€‚å…·ä½“çš„ã«ã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãªæ–¹æ³•ã ã€‚ Active Server Pages(ASP)ã§ã¯ã€ã€ŒDEC%LAREã€ã®ã‚ˆã†ã«ãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆè¨˜å·ã«ç¶šã2æ–‡å—ãŒ16é€²æ•°ã§ãªã„å ´åˆã€ãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆè¨˜å·ã‚’
mi1kman 2009/03/24
ã‚ã‚Œã‚¿ã‚¤ãƒˆãƒ«ç›´ã£ã¦ã‚‹

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

UTF-7

ASP.NET

IDS

IPS

WAF

è„†å¼±æ€§

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
ãƒªãƒ³ã‚¯
Welcome to the Home of OSSEC
OSSEC - Open Source Security, Host-Based Intrusion Detection SystemOSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows. A list with all supported platforms is
mi1kman 2008/11/09
"OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response."

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

OSS

ãƒ„ãƒ¼ãƒ«

IDS
ãƒªãƒ³ã‚¯
1