[B! ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] mimesisã®ãƒ

mimesis id:mimesis

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹mimesisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (236)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å½“ç¤¾ã‚µãƒ¼ãƒã¸ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚‹ ä¸€éƒ¨ãƒ‡ãƒ¼ã‚¿æµå‡ºã®å¯èƒ½æ€§ã«é–¢ã™ã‚‹ è©³ç´°èª¿æŸ»ã®ã”å ±å‘Šï¼ˆæœ€çµ‚å ±ï¼‰
2018å¹´12æœˆ20æ—¥ç™ºè¡¨ã®ã€Œä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚‹ä¸€éƒ¨ãƒ‡ãƒ¼ã‚¿æµå‡ºã®å¯èƒ½æ€§ã«é–¢ã™ã‚‹ãŠè©«ã³ã¨ãŠçŸ¥ã‚‰ã›ï¼ˆç¬¬ä¸€å ±ï¼‰ã€ã«ã¤ã„ã¦ã€ãŠå®¢ã•ã¾ãŠã‚ˆã³ææºå…ˆä¼æ¥ã®çš†æ§˜ã€é–¢ä¿‚è€…ã®çš†æ§˜ã«ã¯å¤šå¤§ãªã‚‹ã”å¿ƒé…ã¨ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã—ã¾ã—ãŸã“ã¨ã‚’ã€å¿ƒã‚ˆã‚ŠãŠè©«ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ 2018å¹´9æœˆ17æ—¥ã‹ã‚‰12æœˆ6æ—¥ã«ã‹ã‘ã¦å½“ç¤¾ã®ä¿æœ‰ã™ã‚‹ã‚µãƒ¼ãƒã¸ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŠã‚ˆã³ãŠå®¢æ§˜æƒ…å ±æµå‡ºã®å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ãŒåˆ¤æ˜Žã—ãŸãŸã‚ã€æœ¬ä»¶ã‚’å…¬è¡¨ã—ã€ç™ºç”Ÿã®åŽŸå› ã«ã¤ã„ã¦ã€è©³ç´°ãªèª¿æŸ»ã‚’é€²ã‚ã¦ã¾ã„ã‚Šã¾ã—ãŸã€‚ ç¬¬ä¸‰è€…æ©Ÿé–¢ã«ã‚ˆã‚‹ãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯èª¿æŸ»*1ãŠã‚ˆã³ç¤¾å†…èª¿æŸ»ã®çµæžœã€å½“ç¤¾ã§ç®¡ç†ã™ã‚‹ãŠå®¢æ§˜æƒ…å ±ã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒæµå‡ºã—ãŸç—•è·¡ã¯ç¢ºèªã•ã‚Œã¾ã›ã‚“ã§ã—ãŸã€‚ã“ã®ãŸã³ã®çµŒç·¯ãªã‚‰ã³ã«ç¬¬ä¸‰è€…æ©Ÿé–¢ã«ã‚ˆã‚‹èª¿æŸ»ã®çµæžœã€å†ç™ºé˜²æ¢ç–ç‰ã«ã¤ã„ã¦ä¸‹è¨˜ã®é€šã‚Šã”å ±å‘Šã„ãŸã—ã¾ã™ã€‚ 1. æœ¬ä»¶ã®æ¦‚è¦ãªã‚‰ã³ã«èª¿æŸ»æ¦‚è¦ã€çµŒç·¯ 2018å¹´12æœˆ6æ—¥ã€å½“ç¤¾ã§åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ï¼ˆAWS*2ï¼‰ã«ãŠã„ã¦ã€ä¸æ£ã‚¢ã‚¯ã‚»
mimesis 2019/02/01
åŽŸå› ä¸æ˜Ž

ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Safariã®ã‚ªãƒ¼ãƒˆã‚³ãƒ³ãƒ—ãƒªãƒ¼ãƒˆã®ä¸æ€è°ãªæŒ™å‹• - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
mimesis 2017/11/10
â€œã€ŒåŒã˜åå‰ã®ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ãŒå˜åœ¨ã—ã¦ã„ã‚‹ã®ãŒåŽŸå› ãªã®ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã§ã¯ãªã„ã€â€ã¨ã‹ã‚ã‚Šå¾—ãªã„ã‚“ã ã‘ã©ã€‚è¨˜äº‹ã¯3å¹´å‰ã ã‘ã©ã¾ã ã“ã®å®Ÿè£…ãªã‚“ã ã‚ã†ã‹ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Safari
ãƒªãƒ³ã‚¯
GitHub Security
GitHub Bug Bounty Software security researchers are increasingly engaging with internet companies to hunt down vulnerabilities. Our bounty program gives a tip of the hat to these researchers and provides rewards of $30,000 or more for critical vulnerabilities. If you have found a vulnerability, submit it here. You can find useful information in our rules, scope, targets and FAQ sections. Happy hac
mimesis 2017/08/31
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
HowTos/OS_Protection
mimesis 2017/05/20
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Security Harden CentOS 7
Security Harden CentOS 7 Based on a Minimal Install Issues with Security Hardening Why use OpenSCAP ? Kickstart Secure Partition Mount Options Install NTP Configure System for AIDE Install AIDE Prevent Users Mounting USB Storage Enable Secure (high quality) Password Policy Secure /etc/login.defs Pasword Policy Set Last Logon/Access Notification Max Password Login Attempts per Session Set Deny For
mimesis 2017/05/19
CentOS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

OpenSCAP
ãƒªãƒ³ã‚¯
A new security header: Referrer Policy
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. Regular readers will know how fond I am of the existing security headers so it's great to hear that we're getting another! Referrer Policy will allow a site to control the value of the referer header in links away from their pages. What's a referrer? When a user c
mimesis 2017/04/24
Referrer-Policy

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
GMOåä¼šç¤¾ã®ã‚¯ãƒ¬ã‚«æƒ…å ±æ¼ãˆã„äº‹ä»¶ã€â€œè¤’ã‚ã‚‰ã‚Œã‚‹å¯¾å¿œâ€ã‚’è€ƒãˆãŸ
GMOåä¼šç¤¾ã®ã‚¯ãƒ¬ã‚«æƒ…å ±æ¼ãˆã„äº‹ä»¶ã€â€œè¤’ã‚ã‚‰ã‚Œã‚‹å¯¾å¿œâ€ã‚’è€ƒãˆãŸï¼šåŠå¾„300ãƒ¡ãƒ¼ãƒˆãƒ«ã®ITï¼ˆ1/2 ãƒšãƒ¼ã‚¸ï¼‰ ç´„70ä¸‡ä»¶ã®æƒ…å ±ãŒæ¼ãˆã„ã—ãŸã¨ã¿ã‚‰ã‚Œã‚‹GMOãƒšã‚¤ãƒ¡ãƒ³ãƒˆã‚²ãƒ¼ãƒˆã‚¦ã‚§ã‚¤ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹äº‹ä»¶ã€‚100ï¼…æƒ…å ±æ¼ãˆã„äº‹æ•…ã‚’é˜²ãã“ã¨ã¯ã§ããªã„æ™‚ä»£ã€äº‹ä»¶ã‚’èµ·ã“ã—ãŸä¼æ¥ãŒã™ã¹ãâ€œè¤’ã‚ã‚‰ã‚Œã‚‹å¯¾å¿œâ€ã‚’è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ã¾ãŸã€æƒ…å ±æ¼ãˆã„äº‹æ•…ãŒèµ·ãã¾ã—ãŸã€‚ æ±äº¬éƒ½ç¨Žã®æŒ‡å®šä»£ç†ç´ä»˜è€…ã§ã‚ã‚‹ãƒˆãƒ¨ã‚¿ãƒ•ã‚¡ã‚¤ãƒŠãƒ³ã‚¹ãŒã€å†å§”è¨—æ¥è€…ã§ã‚ã‚‹GMOãƒšã‚¤ãƒ¡ãƒ³ãƒˆã‚²ãƒ¼ãƒˆã‚¦ã‚§ã‚¤ã«ã‚µã‚¤ãƒˆé‹å–¶ã‚’å§”è¨—ã—ã¦ã„ãŸã€Œæ±äº¬éƒ½ã®éƒ½ç¨Žã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ãŠæ”¯æ‰•ã‚µã‚¤ãƒˆã€ã§ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒç™ºè¦šã—ã€ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ç•ªå·ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚³ãƒ¼ãƒ‰ï¼ˆCVVï¼‰ã‚’å«ã‚€æƒ…å ±ãŒå¤–éƒ¨ã«æ¼ãˆã„ã—ã¾ã—ãŸã€‚ ã“ã®è¨˜äº‹ã‚’åŸ·ç†ã—ã¦ã„ã‚‹æ™‚ç‚¹ã§ã¯ã€ã¾ã ç¬¬1å ±ã—ã‹å‡ºã¦ã„ãªã„çŠ¶æ³ã§ã™ãŒã€67ä¸‡ä»¶ä»¥ä¸Šã®æƒ…å ±ãŒæ¼ãˆã„ã—ãŸã¨ç™ºè¡¨ã•ã‚Œã¦ã„ã‚‹ã®ã§ã€å¯¾è±¡ã¨ãªã‚‹äººã¯å¼•ãç¶šãæƒ…å ±ã‚’ãƒã‚§ãƒƒã‚¯ã—ã¦ãã ã•ã„ï¼ˆç·¨æ³¨ï¼šãã®å¾Œ
mimesis 2017/03/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
WordPress ã‚’ã•ã‚‰ã«å®‰å…¨ã«ã™ã‚‹ãŸã‚ã® HTTP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ˜ãƒƒãƒ€ãƒ¼ã¾ã¨ã‚ â€“ Capital P â€“ WordPressãƒ¡ãƒ‡ã‚£ã‚¢
ä»Šå¹´ã«ãªã£ã¦ã‹ã‚‰å¸¸æ™‚ SSL ãŒæœ¬æ ¼çš„ã«æ™®åŠã—å§‹ã‚ã¾ã—ãŸã€‚ ã“ã®æµã‚Œã¯èª°ã‚‚ãŒã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’å®‰å…¨ã«åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ã—ã‚ˆã†ã¨ã„ã†è¶£æ—¨ãªã‚“ã§ã™ãŒã€æ¥è¨ªè€…ã®å®‰å…¨ã‚’å®ˆã‚‹ãŸã‚ã«ã¿ãªã•ã‚“ãŒå¯¾ç–å¯èƒ½ãªã“ã¨ã¯ä»–ã«ã‚‚ãŸãã•ã‚“ã‚ã‚Šã¾ã™ã€‚ ã“ã“ã§ç´¹ä»‹ã™ã‚‹å„ç¨®ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ãƒ¼ã¯ã€ã‚‚ã— XSS ãªã©ã®è„†å¼±æ€§ãŒã‚ã£ãŸå ´åˆã§ã‚‚ã€æ¥è¨ªè€…ãŒãã®å½±éŸ¿ã‚’ã†ã‘ãªã„ã‚ˆã†ã«ã€ã“ã®ã‚µã‚¤ãƒˆã¯ã“ã†ã„ã†ãƒãƒªã‚·ãƒ¼ã§ã§ãã¦ã‚‹ã‹ã‚‰ã€ãã‚Œã«ãƒžãƒƒãƒã—ãªã„ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã¯å®Ÿè¡Œã—ãªã„ã§ï¼ã¨ã‚ã‚‰ã‹ã˜ã‚æ¥è¨ªè€…ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«ãŠçŸ¥ã‚‰ã›ã™ã‚‹ã“ã¨ã§ã€æ¥è¨ªè€…ã®å®‰å…¨ã‚’å®ˆã‚‹ãŸã‚ã®ã‚‚ã®ã§ã™ã€‚ æ ¹æœ¬çš„ã«ã¯ã€WordPress ã‚’ã¤ãã«æœ€æ–°ç‰ˆã«ä¿ã¤ã€ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚„ãƒ†ãƒ¼ãƒžã¯ä¿¡é ¼ã§ãã‚‹ã‚‚ã®ã‚’ä½¿ç”¨ã™ã‚‹ãªã©ã®ä¸€èˆ¬çš„ãªå¯¾ç–ãŒåˆ¥é€”å¿…è¦ãªã®ã§èª¤è§£ã®ãªã„ã‚ˆã†ã«ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ X-XSS-Protection ä»¥ä¸‹ã®ã‚ˆã†ãªãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ãƒ¼ã‚’å‡ºåŠ›ã™ã‚‹ã“ã¨ã§ã€ãƒ–ãƒ©ã‚¦ã‚¶ã® XSS ãƒ•ã‚£ãƒ«ã‚¿ãƒ¼æ©Ÿèƒ½ã‚’å¼·
mimesis 2017/03/10
WordPress

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
SHAttered attack (SHA-1ã‚³ãƒªã‚¸ãƒ§ãƒ³ç™ºè¦‹) â€“ IIJ Security Diary
æš—å·ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®ã†ã¡ãƒ‡ã‚¸ã‚¿ãƒ«ç½²åãªã©ã®ç”¨é€”ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ã²ã¨ã¤ã€SHA-1 ã®ã‚³ãƒªã‚¸ãƒ§ãƒ³(è¡çª)ãŒå ±å‘Šã•ã‚Œã¾ã—ãŸã€‚ ä»Šå›žè¦‹ã¤ã‘ã‚‰ã‚ŒãŸæ”»æ’ƒæ‰‹æ³•ã¯ SHAtterd attack ã¨åä»˜ã‘ã‚‰ã‚Œã¾ã—ãŸ[1]SHAttered attack https://shattered.it/ https://shattered.io/[2]Google Security Blog, Announcing the first SHA1 collision https://security.google blog.com/2017/02/announcing-first-sha1-collision.htmlã€‚(æš—å·å¦çš„)ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã¯ã€ç•°ãªã‚‹ãƒ‡ãƒ¼ã‚¿ã‚’ç•°ãªã‚‹å›ºå®šé•·ãƒ‡ãƒ¼ã‚¿ã«åœ§ç¸®ã™ã‚‹ã“ã¨ãŒä¿è¨¼ã•ã‚Œã¦ã„ã¾ã™ã€‚SHA-1 ã¯160ãƒ“ãƒƒãƒˆã®å‡ºåŠ›é•·ã‚’æŒã¤ã“ã¨ã‹ã‚‰ã€2^80ç¨‹åº¦ã¨ã„ã†è†¨å¤§ãª SHA-1 è¨ˆç®—
mimesis 2017/02/28
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãªã›ã‚™è‡ªç¤¾ã¦ã‚™è„†å¼±æ€§è¨ºæ–ã‚’è¡Œã†ã¸ã‚™ããªã®ã‹
2. Profile: ä¸Šé‡Ž å®£ (Sen UENO) æ ªå¼ä¼šç¤¾ãƒˆãƒ©ã‚¤ã‚³ãƒ¼ãƒ€ ä»£è¡¨å–ç· å½¹ å¥ˆè‰¯å…ˆç«¯ç§‘å¦æŠ€è¡“å¤§å¦é™¢å¤§å¦ã§æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å°‚æ”»ã€eã‚³ãƒžãƒ¼ã‚¹é–‹ç™ºãƒ™ãƒ³ãƒãƒ£ãƒ¼ã§æ± è¨¼ãƒžã‚¶ãƒ¼ã‚ºä¸Šå ´ãªã©ã‚’çµŒã¦ã€2006å¹´ã«æ ªå¼ä¼šç¤¾ãƒˆãƒ©ã‚¤ã‚³ãƒ¼ãƒ€ã‚’è¨ç«‹ ä¼æ¥ã‚„å®˜å…¬åºãªã©ã«ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ•™è‚²ã‚„æ¼”ç¿’ã€è„†å¼±æ€§è¨ºæ–ã€ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ ãƒ†ã‚¹ãƒˆãªã©ã‚’æä¾› æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€èªŒã€ŽScanNet Securityã€ç·¨é›†é•·ã€ OWASP Japan Chapter ãƒªãƒ¼ãƒ€ãƒ¼ã€Hardening ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆå®Ÿè¡Œå§”å“¡ã€ JNSA ISOG-J WG1ãƒªãƒ¼ãƒ€ãƒ¼ã€SECCON å®Ÿè¡Œå§”å“¡ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚ãƒ£ãƒ³ãƒ—è¬›å¸«ä¸»æŸ»ã€ ç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ç ”ç©¶å“¡ãªã©ã‚’å‹™ã‚ã‚‹ ä¸»ãªè‘—æ›¸ Webã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ‹…å½“è€…ã®ãŸã‚ã®è„†å¼±æ€§è¨ºæ–ã‚¹ã‚¿ãƒ¼ãƒˆ ã‚¬ã‚¤ãƒ‰ - ä¸Šé‡Žå®£ãŒæ•™ãˆã‚‹æƒ…å ±æ¼ãˆã„ã‚’é˜²ãæŠ€è¡“ã€ HTTPã®æ•™ç§‘æ›¸ï¼ˆæ—¥æœ¬èªžã€
mimesis 2017/02/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å¾³ä¸¸æµ©ã®æ—¥è¨˜
ã“ã®è¨˜äº‹ã¯PHPã‚¢ãƒ‰ãƒ™ãƒ³ãƒˆã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼2014ã®22æ—¥ç›®ã®è¨˜äº‹ã§ã™ ã€‚ 2002å¹´3æœˆã«å…¬é–‹ã•ã‚ŒãŸIPAã®äººæ°—ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã€Œã‚»ã‚ãƒ¥ã‚¢ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ã€ãŒ2007å¹´6æœˆã«å¤§å¹…ã«æ›´æ–°ã•ã‚Œã¾ã—ãŸã€‚ãã—ã¦ã€ãã®ä¸€ç¯€ãŒPHPerãŸã¡ã‚’æ¿€ã—ãåˆºæ¿€ã™ã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ (1) ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¨€èªžã®é¸æŠž 1) ä¾‹ãˆã°ã€PHPã‚’é¿ã‘ã‚‹ çŸæ™‚æ—¥ã§ç´ æ—©ãã‚µã‚¤ãƒˆã‚’ç«‹ã¡ä¸Šã’ã‚‹ã“ã¨ã®ã¿ã«ç€ç›®ã™ã‚‹ã®ã§ã‚ã‚Œã°ã€PHPã¯æ‚ªã„å‡¦ç†ç³»ã§ã¯ãªã„ã€‚ã—ã‹ã—ã€ã“ã‚Œã¾ã§å¤šãã®è„†å¼±æ€§ã‚’ç”Ÿã‚“ã§ããŸçµŒç·¯ãŒã‚ã‚Šã€æ”¹å–„ãŒé€²ã‚“ã§ã„ã‚‹ã¨ã¯ã„ãˆã¾ã ååˆ†å …å›ºã¨ã¯è¨€ãˆãªã„ã€‚ ã‚»ã‚ãƒ¥ã‚¢ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼ˆã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ï¼‰ã‚ˆã‚Šå¼•ç”¨ ã€ŒPHPã‚’é¿ã‘ã‚‹ã€ã¨ã¾ã§è¨€ã‚ã‚Œã¦ã—ã¾ã£ãŸã‚ã‘ã§ã€å½“ç„¶ãªãŒã‚‰ãƒãƒƒãƒˆç•Œéšˆã§ã¯ç‚Žä¸Šã‚’èµ·ã“ã—ã€ç¾åœ¨ã¯ã‚‚ã†å°‘ã—ãƒžã‚¤ãƒ«ãƒ‰ãªè¡¨ç¾ã«å¤‰ã‚ã£ã¦ã„ã¾ã™(å‚ç…§)ã€‚ æœ¬ç¨¿ã§ã¯ã€å½“æ™‚ã®PHPã®çŠ¶æ³ã‚’æŒ¯ã‚Šè¿”ã‚‹æ‰‹æ®µã¨ã—ã¦ã€ã“ã®å¾ŒPHPã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿèƒ½ãŒã©ã®ã‚ˆã†ã«å¤‰åŒ–
mimesis 2017/01/25
ä¾‹ãˆã°ã€PHPã‚’é¿ã‘ã‚‹

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
blog.ishinao.net
ã©ã†ã—ã‚ˆã†ã‹ãªãƒ¼ã€‚å‰Šé™¤ã™ã‚‹ã®ã¯ç°¡å˜ãªã‚“ã ã‘ã©ã€ã²ã¨ã¾ãšä½•ã‚’ã‚„ã‚‹ã¤ã‚‚ã‚Šãªã®ã‹ã€ã—ã°ã‚‰ãæ§˜åã‚’è¦‹ã¦ãŠã“ã†ã€‚ã¯ã¦ãªã®æ–¹ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒå…ˆã«ç„¡åŠ¹ã«ãªã£ãŸã‚Šã™ã‚‹ã‹ãªï¼Ÿ ãƒžãƒ«ãƒã‚¢ã‚«ã‚¦ãƒ³ãƒˆã§ã°ã‚Šã°ã‚ŠæŠ•ç¨¿ã—ãŸã‚Šã—ãªã„é™ã‚Šã¯ã€åˆ¥ã«æ¶ˆã•ãªãã¦ã‚‚ã„ã„ã‹ãªãƒ¼ã¨æ€ã£ã¦ã„ã‚‹ã‚“ã ã‘ã©ã€å¤§é‡ã®ãƒžãƒ«ãƒã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯ã•ã™ãŒã«ã†ã–ã„ã—ãªãƒ¼ã€‚ ã¡ãªã¿ã«ã€HTTP_USER_AGENTã«Alexa Toolbarã¨ã‹å‡ºã¦ã„ã‚‹ã‚ãŸã‚Šã€ã„ã‹ã«ã‚‚ãã†ã„ã†æ–¹é¢ã§é£¯ã‚’é£Ÿã£ã¦ã„ã‚‹äººã£ã¦æ„Ÿã˜ã ã€‚ spamç”¨ã«è‡ªå‹•å–å¾—ã—ãŸã£ã½ã„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä¸€è¦§ apple5001sweet apple5002sweet apple5003sweet apple5004sweet apple5005sweet apple5006sweet apple5007sweet apple5008sweet apple5009sweet apple5010sweet egg501
mimesis 2017/01/25
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
RIPS - free PHP security scanner using static code analysis
vulnerabilities Code Execution Command Execution Cross-Site Scripting Header Injection File Disclosure File Inclusion File Manipulation LDAP Injection SQL Injection Unserialize with POP XPath Injection code audit interface scan and vulnerability statistics grouped vulnerable code lines (bottom up or top down) vulnerability description with example code, PoC, patch exploit creator file list and gra
mimesis 2017/01/20
Automated Security Analysis for PHP Applications

ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PHP
ãƒªãƒ³ã‚¯
Googleã¯å·¨å¤§ãªã‚¤ãƒ³ãƒ•ãƒ©ã‚’ã©ã†ã‚„ã£ã¦ã‚»ã‚ãƒ¥ã‚¢ã«ä¿ã£ã¦ã„ã‚‹ã‹ã€‚ç‹¬è‡ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒƒãƒ—åˆ©ç”¨ã‚„DoSå¯¾ç–ã€å®‰å…¨ãªã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢é–‹ç™ºãªã©ã€å…¨ä½“åƒã‚’è§£èª¬ã—ãŸãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚’å…¬é–‹
Googleã®ã‚¯ãƒ©ã‚¦ãƒ‰ã¯é–“é•ã„ãªãä¸–ç•Œæœ€å¤§è¦æ¨¡ã®ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚·ã‚¹ãƒ†ãƒ ã§ã™ã€‚è†¨å¤§ãªãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ã¨ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‹ã‚‰æ§‹æˆã•ã‚Œã‚‹ã“ã®å·¨å¤§ãªã‚·ã‚¹ãƒ†ãƒ ã‚’ã€åŒç¤¾ã¯ã©ã†ã‚„ã£ã¦ã‚»ã‚ãƒ¥ã‚¢ã«ä¿ã£ã¦ã„ã‚‹ã®ã‹ã€‚ãã®ã“ã¨ã‚’è§£èª¬ã—ãŸãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã€ŒGoogle Infrastructure Security Design Overviewã€ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã«ã¯ã€Googleã®ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼ã‚’æ§‹æˆã™ã‚‹ãƒ‡ãƒã‚¤ã‚¹ã®1ã¤1ã¤ã«ã¾ã§ç‹¬è‡ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒƒãƒ—ã‚’çµ„ã¿è¾¼ã‚“ã§æ£è¦ã®ãƒ‡ãƒã‚¤ã‚¹ã‹ã©ã†ã‹ã‚’ç›¸äº’ã«èªè¨¼ã™ã‚‹ã¨ã„ã†ç‰©ç†ãƒ¬ãƒ™ãƒ«ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‹ã‚‰ã€ä½•å±¤ã®ã‚‚ã®ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µãƒ¼ã‹ã‚‰ã®æƒ…å ±ã‚’é›†ç´„ã—ã¦Dosæ”»æ’ƒã‚’æ¤œçŸ¥ã™ã‚‹ã¨ã€ãã®é€šä¿¡ã‚’ç ´æ£„ã™ã‚‹ã¨ã„ã£ãŸDoSå¯¾ç–ã€‚ ãã—ã¦ãƒžã‚·ãƒ³ã‚‚å¾“æ¥å“¡ã‚‚ã‚µãƒ¼ãƒ“ã‚¹ã‚‚åŒ…æ‹¬ã™ã‚‹ã‚°ãƒãƒ¼ãƒãƒ«ãªåå‰ç©ºé–“ãªã©ã€ãã‚ã‚ã¦åºƒç¯„ã‹ã¤ç¶¿å¯†ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ–½ç–ãŒèª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ ã‚¯ãƒ©ã‚¦ãƒ‰ãŒã„ã‹ã«é«˜åº¦ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã§
mimesis 2017/01/16
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
PHPãƒ¡ãƒ¼ãƒ«é€ä¿¡ç”¨ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒPHPMailerã€ã€ŒSwiftMailerã€ã€Œzend-mailã€ã«ã€ã»ã¼åŒç¨®ã®è„†å¼±æ€§ã€€
mimesis 2017/01/10
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PHPMailer

SwiftMailer

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
NISCã€ã€Œãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ“ã‚®ãƒŠãƒ¼ã®ãŸã‚ã®æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒ³ãƒ‰ãƒ–ãƒƒã‚¯ã€ã‚’å…¨154ãƒšãƒ¼ã‚¸ã«æ”¹è¨‚ã—ã€ç„¡æ–™ã§æä¾›ã€€
mimesis 2016/12/16
èª°ã‹è©•ä¾¡ã¯ã‚ˆ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Attack method of open redirect using basic authentication / Basicèªè¨¼ã‚’ç”¨ã„ãŸã‚ªãƒ¼ãƒ—ãƒ³ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã®æ”»æ’ƒæ‰‹æ³• - http80
åƒè¶ŠãªãŒã‚‰ã€è„†å¼±æ€§"&'<<>\ Advent Calendar 2016 ã®6æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ ç«¯çš„ã«è¨€ã†ã¨ã€URLã«Basicèªè¨¼ã‚’åŸ‹ã‚è¾¼ã‚€æ–¹æ³•ãŒã‚ã‚‹ã®ã§ã™ãŒã€ã“ã‚Œã‚’ã‚ªãƒ¼ãƒ—ãƒ³ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã®æ”»æ’ƒã«å¿œç”¨ã§ãã¾ã™ã€‚ ã“ã®æ‰‹æ³•ã¯æ˜¨å¹´ã«ç™ºè¦‹ã—ã€ã‚‚ã†1å¹´ä»¥ä¸ŠçµŒã£ã¦ã„ã‚‹ã®ã§ã€æ—¢ã«ã”å˜çŸ¥ã®æ–¹ã‚‚ã„ã‚‹ã‹ã¨æ€ã‚ã‚Œã¾ã™ãŒã€Webåˆå‡ºã§ã—ã‚‡ã†ã‹ã€‚æ—¥ã€…ã®å¥å…¨ãªè„†å¼±æ€§è¨ºæ–ã«ã”æ´»ç”¨ãã ã•ã„ã€‚ www.adventar.org â—ã‚ªãƒ¼ãƒ—ãƒ³ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã®è„†å¼±æ€§ è¨ºæ–ãƒ™ãƒ³ãƒ€ã«ã‚ˆã£ã¦ã¯ã€Œã‚ªãƒ¼ãƒ—ãƒ³ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ã‚¿ã€ã€Œå¤–éƒ¨ã‚µã‚¤ãƒˆã¸èª˜å°Žå¯èƒ½ã€ã¨ã„ã£ãŸã‚¿ã‚¤ãƒˆãƒ«ã§æºã‚‰ãŽã¯ã‚ã‚Šã¾ã™ãŒã€æœ¬è³ªçš„ã«ã¯åŒã˜ã§ã™ã€‚*1 å®Ÿã¯ã“ã®è„†å¼±æ€§ã€OWASP TOP 10(2013)ã«ä»²é–“å…¥ã‚Šã—ã¦ã„ã‚‹æ‚ªã„ãƒ¤ãƒ„ã§ã™ã€‚ Top10-2013-A10: Unvalidated Redirects and Forwards (åŽŸæ–‡) æ—¥æœ¬èªžç‰ˆPDFã§ã¯ã€æœªæ¤œè¨¼ã®ãƒªãƒ€ã‚¤ãƒ¬
mimesis 2016/12/09
ãˆã€ã„ã¤ã®ã¾ã«ã‹IEã§BASICèªè¨¼URLåŸ‹ã‚è¾¼ã¿ã£ã¦ã§ããªããªã£ãŸã®ï¼Ÿ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãŸã£ãŸ1ãƒã‚¤ãƒˆã®æ›¸ãè¾¼ã¿ãŒå¼•ãèµ·ã“ã™ãƒ«ãƒ¼ãƒˆæ¨©é™ã§ã®å®Ÿè¡Œã®è„†å¼±æ€§ | POSTD
2016å¹´9æœˆ22æ—¥ï¼ˆæœ¨ï¼‰ã€‚ã“ã‚“ãªãƒ¡ãƒ¼ãƒ«ãŒç§ã®ã‚‚ã¨ã«é£›ã³è¾¼ã‚“ã§ãã¾ã—ãŸã€‚ ä»¶åï¼š ares_create_query OOB write c-aresãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆ ã®ãƒ¡ãƒ³ãƒ†ãƒŠã®ã²ã¨ã‚Šã¨ã—ã¦ã€c-aresã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã®æã‚ŒãŒã‚ã‚‹ã¨ã„ã†ãƒ¡ãƒ¼ãƒ«ã‚’å—ã‘å–ã£ãŸã®ã§ã™ã€‚å®Ÿéš›ã€ãã®ã¨ãŠã‚Šã§ã—ãŸã€‚ã“ã®å•é¡Œã‚’çŸ¥ã‚‰ã›ã¦ãã‚ŒãŸã®ã¯ã€ã‹ã¤ã¦ChromeOSã®è„†å¼±æ€§ã‚’Googleã«å ±å‘Šã—ãŸã“ã¨ã‚‚ã‚ã‚‹äººã§ã—ãŸã€‚ ã“ã®c-aresã®ä¸å…·åˆã‚’æ‚ªç”¨ã™ã‚‹ã¨ã€ ChromeOSä¸Šã§ã€rootãƒ¦ãƒ¼ã‚¶ãƒ¼ã¨ã—ã¦JavaScriptã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã§ãã‚‹ ã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ChromeOSå²ä¸Šæœ€æ‚ªã®è„†å¼±æ€§ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚å ±å‘Šè€…ã«ã¯ã€ç›¸å½“ãªé¡ã®å ±å¥¨é‡‘ãŒè´ˆã‚‰ã‚Œã‚‹ã“ã¨ã§ã—ã‚‡ã†ã€‚ ã“ã®å‹•ãã‚’å®Ÿç¾ã—ãŸã‚Šã€ã©ã†ã‚„ã£ã¦å®Ÿç¾ã™ã‚‹ã®ã‹ã‚’èª¬æ˜Žã—ãŸã‚Šã™ã‚‹ã®ã¯ã¨ã¦ã‚‚é¢å€’ãªä½œæ¥ã ã£ãŸã§ã—ã‚‡ã†ã€‚å ±å‘Šè€…ãŒã“ã‚Œã‚’ç™ºè¦‹ã—ãŸã“ã¨ã€ãã—ã¦ã•ã‚‰ã«æ·±ãæŽ˜ã‚Šä¸‹ã’ã¦ã€å†ç¾å¯
mimesis 2016/11/29
ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Have I Been Pwned: Check if your email has been compromised in a data breach
Breaches you were pwned in A "breach" is an incident where data has been unintentionally exposed to the public. Using the 1Password password manager helps you ensure all your passwords are strong and unique such that a breach of one service doesn't put your other services at risk. Pastes you were found in A paste is information that has been published to a publ icly facing website designed to share
mimesis 2016/11/29
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰

Email
ãƒªãƒ³ã‚¯
Linux OS ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£-2 â€” MIRACLE LINUX ã‚µãƒãƒ¼ãƒˆ&ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ | ã‚µã‚¤ãƒãƒ¼ãƒˆãƒ©ã‚¹ãƒˆæ ªå¼ä¼šç¤¾
mimesis 2016/11/06
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸