[B! session fixation] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

session fixationã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

JVN#36925871: e-Pares ã«ãŠã‘ã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šã®è„†å¼±æ€§
e-Pares ã¯æ–½è¨æƒ…å ±ç®¡ç†ã‚·ã‚¹ãƒ†ãƒ ã§ã™ã€‚e-Pares ã«ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚
ockeghem 2010/06/03
ã€ŽIPA ãŠã‚ˆã³ JPCERT/CC ã«å±Šå‡ºã‚‰ã‚ŒãŸæœ¬è„†å¼±æ€§ã¯ã€(è²¡)åœ°æ–¹è‡ªæ²»æƒ…å ±ã‚»ãƒ³ã‚¿ãƒ¼ å¹³æˆ20å¹´åº¦ ã‚¦ã‚§ãƒ–å¥åº·è¨ºæ–äº‹æ¥ã«ã¦ç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ ã€

jvn

security

session fixation
ãƒªãƒ³ã‚¯
æºå¸¯é›»è©±å‘ã‘Webã‚¢ãƒ—ãƒªã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã¯ã©ã†ãªã£ã¦ã„ã‚‹ã‹ - ockeghem's blog
æœ€è¿‘è³¼å…¥ã—ãŸPHPÃ—æºå¸¯ã‚µã‚¤ãƒˆ å®Ÿè·µã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é›†ã‚’èªã‚“ã§ã„ã¦å¦™ãªæ„Ÿã˜ãŒã—ãŸã®ã§ã€ã“ã®æ„Ÿè¦šã¯ãªã‚“ã ã‚ã†ã¨æ€ã£ã¦ã„ãŸã‚‰ã€ãã®ç†ç”±ã«æ°—ã¥ã„ãŸã€‚æœ¬æ›¸ã«å‡ºã¦ãã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã€PHPã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†æ©Ÿæ§‹ã‚’ä½¿ã£ã¦ã„ãªã„ã®ã ã€‚ãã‚“ãªé¦¬é¹¿ãªã¨æ€ã£ãŸãŒã€ç›®æ¬¡ã«ã‚‚ç´¢å¼•ã«ã‚‚ã€Œã‚»ãƒƒã‚·ãƒ§ãƒ³ã€ã‚„ã€Œsessionã€ã¨ã„ã†èªžã¯å‡ºã¦ã“ãªã„ã€‚ã‚µãƒ³ãƒ—ãƒ«ãƒ—ãƒã‚°ãƒ©ãƒ ã®CD-ROMä¸Šã§ session ã‚’æ¤œç´¢ã—ã¦ã‚‚å‡ºã¦ã“ãªã„ã®ã§ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã¯ã©ã“ã§ã‚‚ä½¿ã£ã¦ã„ãªã„ã®ã ã‚ã†ã€‚ ãã†ã¯è¨€ã£ã¦ã‚‚ã€æœ¬æ›¸ã«ã¯ãƒ–ãƒã‚°ã‚„SNSãªã©èªè¨¼ãŒå¿…è¦ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚‚ç™»å ´ã™ã‚‹ã€‚æœ¬æ›¸ã§æŽ¡ç”¨ã—ã¦ã„ã‚‹èªè¨¼æ–¹å¼ã¯ã“ã†ã ã€‚ æºå¸¯é›»è©±ã®å€‹ä½“è˜åˆ¥ç•ªå·ã‚’ç”¨ã„ãŸã€ã„ã‚ã‚†ã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã®ã¿ã‚’ä½¿ã† èªè¨¼çŠ¶æ…‹ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†æ©Ÿæ§‹ã§ç¶æŒã—ãªã„ã€‚å…¨ã¦ã®ãƒšãƒ¼ã‚¸ã§æ¯Žå›žèªè¨¼ã™ã‚‹ ãã®ãŸã‚ã€ã€Œiãƒ¢ãƒ¼ãƒ‰IDã€ãªã©ã€ãƒ¦ãƒ¼ã‚¶ã«ç¢ºèªã›ãšã«è‡ªå‹•çš„ã«é€ä¿¡ã•ã‚Œã‚‹IDã‚’ç”¨ã„ã‚‹ ã¤ã¾ã‚Šã€å…¨ã¦
ockeghem 2009/07/14
/id:nihen ã„ã‚„ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã—ã¦ãªã„ã§ã™ã‚ˆï½ž ç§ã‚‚å…ƒã€…ã¯é•å’Œæ„Ÿã‹ã‚‰ã‚¹ã‚¿ãƒ¼ãƒˆã—ãŸã‚ã‘ã§

mobile

security

php

session

session fixation

ã‚»ãƒ«ã‚¯ãƒž
ãƒªãƒ³ã‚¯
PHPã®Session Adoptionã¯é‡å¤§ãªè„…å¨ã§ã¯ãªã„ - ockeghem's blog
ãªãœPHPã‚¢ãƒ—ãƒªã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒå¤šã„ã®ã‹?ï¼šç¬¬25å›žã€€PHPã®ã‚¢ã‚ãƒ¬ã‚¹è…±ã«ã¦ã€å¤§åž£é–ç”·æ°ãŒPHPã®Session Adoptionå•é¡Œã«ã¤ã„ã¦å–ã‚Šä¸Šã’ã¦ã„ã‚‹ã€‚å¤§åž£æ°ã¯åº¦ã€…ã“ã®å•é¡Œã‚’å–ã‚Šä¸Šã’ã¦ã„ã‚‹ãŒã€ä»Šã®ã¨ã“ã‚æ°ã®ä¸»å¼µã«åŒèª¿ã™ã‚‹äººã‚’è¦‹ã‹ã‘ãªã„ã€‚ãã‚Œã‚‚ãã®ã¯ãšã§ã€å¤§åž£æ°ã®ä¸»å¼µã¯é–“é•ã£ã¦ã„ã‚‹ã¨ç§ã¯æ€ã†ã€‚ ä»¥ä¸‹ã€å¤§åž£æ°ã®ä¸»å¼µã‚’å®Ÿéš›ã«è©¦ã—ã¦ã¿ã‚‹å½¢ã§ã€é †ã«èª¬æ˜Žã—ã‚ˆã†ã€‚ å¤§åž£æ°ã®ä¸»å¼µ å¤§åž£æ°ã®ä¸»å¼µã¯ã€PHPã«ã¯Session Adoptionè„†å¼±æ€§ãŒã‚ã‚‹ãŸã‚ã«ã€æ¨™æº–çš„ãªSession Fixationå¯¾ç–ã§ã‚ã‚‹session_regenerate_id()ã‚’æ–½ã—ã¦ã‚‚ã€ãã®å¯¾ç–ã¯æœ‰åŠ¹ã§ã¯ãªã„ã¨ã„ã†ã‚‚ã®ã ã€‚ ã—ã‹ã—ï¼Œå®Ÿéš›ã«ã¯ç¾åœ¨ã«è‡³ã‚‹ã¾ã§PHPã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã¯ä¿®æ£ã•ã‚Œãªã„ã¾ã¾ã«ãªã£ã¦ã„ã¾ã™ã€‚ã“ã®ãŸã‚ã«ï¼Œæœ¬æ¥ã¯session_regenerate_idé–¢æ•°ã‚’ãƒã‚°ã‚¤ãƒ³
ockeghem 2009/05/15
2009/5/15ã®æ—¥è¨˜ï¼ˆå†ï¼‰

php

security

session fixation

cookie

cookie monster

å¤§åž£é–ç”·

ã‚»ãƒ«ã‚¯ãƒž
ãƒªãƒ³ã‚¯
ç¬¬25å›žã€€PHPã®ã‚¢ã‚ãƒ¬ã‚¹è…± â”€â”€ ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç† | gihyo.jp
PHPã«ã¯HTTPã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒæ¨™æº–ã§ä»˜ã„ã¦ãã¾ã™ã€‚ã“ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã«ã¯éžå¸¸ã«é‡å¤§ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œãšã«æ®‹ã£ã¦ã„ã¾ã™ã€‚ãã®è„†å¼±æ€§ã¨ã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã§ã™ã€‚ ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã¨ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šåŒ–æ”»æ’ƒã«åˆ©ç”¨ã•ã‚Œã‚‹è„†å¼±æ€§ã§ã™ã€‚PHPã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã«è„†å¼±ã§ã‚ã‚‹ã“ã¨ã¯ã€ã‹ãªã‚Šä»¥å‰ã€ä½•å¹´ã‚‚å‰ã‹ã‚‰çŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ã—ã‹ã—ã€é–‹ç™ºè€…ã®ç†è§£ä¸è¶³ã‚ˆã‚Šè„†å¼±æ€§ãŒæ”¾ç½®ã•ã‚ŒãŸã¾ã¾ã«ãªã£ã¦ã„ã¾ã™ã€‚ ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã¨ã¯ ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã¨ã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ç‰ã‹ã‚‰é€ä¿¡ã•ã‚ŒãŸæœªåˆæœŸåŒ–ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’ãã®ã¾ã¾åˆ©ç”¨ã—ã¦ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚’åˆæœŸåŒ–ã—ã¦ã—ã¾ã†è„†å¼±æ€§ã§ã™ã€‚ãƒ¦ãƒ¼ã‚¶ãŒé€ä¿¡ã—ã¦ããŸIDã§ã‚‚ç¬¬ä¸‰è€…ã«äºˆæƒ³ã§ããªã„æ–‡å—åˆ—ã§ã‚ã‚Œã°å¤§ä¸ˆå¤«ãªã®ã§ã¯ï¼Ÿã¨è€ƒãˆã‚‹æ–¹ã‚‚ã„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ãã®é€šã‚Šã§ç¬¬ä¸‰è€…ã«äºˆæƒ³ã§ããªã‘ã‚Œã°å•é¡Œãªã„ã§ã™ã—ã€ä»®ã«äºˆæƒ³ã§ãã¦ã‚‚ãƒã‚°ã‚¤ãƒ³ã™ã‚‹éš›
ockeghem 2009/05/13
å¤§åž£æ°ã¯session fixationã«ã¤ã„ã¦æ ¹æœ¬çš„ã«å‹˜é•ã„ã‚’ã—ã¦ã„ã‚‹ http://d.hatena.ne.jp/ockeghem/20090130/p1ã€ä¸ã§ã‚‚ã€Œã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’æº–å‚™ã™ã‚‹ã€ã®é …ã‚’å‚ç…§ / â†‘ id:hilde session_regenerate_id()ã§å¤§ä¸ˆå¤«ã§ã™/æ—¥è¨˜æ›¸ã„ãŸ http://d.hatena.ne.jp/ockeghem/20090515/p1

php

session

session fixation

å¤§åž£é–ç”·
ãƒªãƒ³ã‚¯
https://blog.ohgaki.net/?blog=7&title=session-adoption-attack&disp=single&more=1&c=1&tb=1&pb=1
ockeghem 2009/01/29
å‰å›žã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯æ°—ãŒã¤ã‹ãªã‹ã£ãŸãŒã€Safari 3.2.1ã«ã¯Cookie Monster BugãŒã‚ã‚‹ã“ã¨ãŒå½“æ–¹ã§ã‚‚å†ç¾ã—ã¾ã—ãŸã€‚co.jpãƒ‰ãƒ¡ã‚¤ãƒ³ã§ã®ã‚¯ãƒƒã‚ãƒ¼è¨å®šãŒå¯èƒ½ã§ã—ãŸ

security

cookie

session fixation

å¤§åž£é–ç”·
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã«3ä»¶ã®è„†å¼±æ€§
ã‚¬ãƒ«ãƒ¼ãƒ³ã‚„Officeã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªãªã©3ä»¶ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã€‚ æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼ˆIPAï¼‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ã¨JPCERTã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ã¯6æœˆ27æ—¥ã€ã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã€Œã‚µã‚¤ãƒœã‚¦ã‚º Officeã€ãªã©ã«3ä»¶ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã¨ã—ã¦ã€JVN(Japan Vulnerability Notes)ã«æƒ…å ±ã‚’å…¬é–‹ã—ãŸã€‚ ç™ºè¦‹ã•ã‚ŒãŸè„†å¼±æ€§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã¨ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šã®åˆè¨ˆ3ä»¶ã€‚å¯¾è±¡è£½å“ã¯ã€CSRFãŒã‚µã‚¤ãƒœã‚¦ã‚º Office 6ãŠã‚ˆã³ã‚µã‚¤ãƒœã‚¦ã‚º ãƒ‡ãƒ‚ã‚¨ 6.0ï¼ˆ1.0ï¼‰ã‚ˆã‚Šå‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ 2.0.0ï½ž2.1.3ã€‚XSSã¨ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šãŒã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ 2.0.0ï½ž2.1.3ã¨ãªã£ã¦ã„ã‚‹ã€‚ CSRFã®è„†å¼±æ€§ã§ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè©²å½“è£½
ockeghem 2008/06/27
cyboz

xss

csrf

session fixation

security
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã›
å¹³ç´ ã‚ˆã‚Šã€ŒPHPãƒ—ãƒï¼ã€ã‚’ã”æ„›é¡§ã„ãŸã ãã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ 2006å¹´ã‚ˆã‚Šé‹å–¶ã—ã¦ã¾ã„ã‚Šã¾ã—ãŸã€ŒPHPãƒ—ãƒï¼ã€ã§ã™ãŒã€ã‚µãƒ¼ãƒ“ã‚¹ã®åˆ©ç”¨çŠ¶æ³ã‚’é‘‘ã¿ã¾ã—ã¦ã€2018å¹´9æœˆ25æ—¥ï¼ˆç«æ›œæ—¥ï¼‰ã‚’ã‚‚ã¡ã¾ã—ã¦ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã•ã›ã¦ã„ãŸã ãã“ã¨ã«ãªã‚Šã¾ã—ãŸã€‚ ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã«ä¼´ã„ã¾ã—ã¦ã€2018å¹´8æœˆ28æ—¥ï¼ˆç«æ›œæ—¥ï¼‰ã‚’æŒã¡ã¾ã—ã¦ã€æ–°è¦ä¼šå“¡ç™»éŒ²ãªã‚‰ã³ã«Q&AæŽ²ç¤ºæ¿ã¸ã®æ–°ãŸãªè³ªå•ã€å›žç”ã®æŠ•ç¨¿ã‚’åœæ¢ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ãªãŠã€ã”ç™»éŒ²ã„ãŸã ã„ãŸçš†æ§˜ã®å€‹äººæƒ…å ±ã«ã¤ãã¾ã—ã¦ã¯ã€ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†å¾Œã€å¼Šç¤¾ãŒè²¬ä»»ã‚’ã‚‚ã£ã¦æ¶ˆåŽ»ã„ãŸã—ã¾ã™ã€‚ ã“ã‚Œã¾ã§å¤šãã®çš†æ§˜ã«ã”åˆ©ç”¨ã‚’ã„ãŸã ãã¾ã—ã¦ã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚ ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã«ä¼´ã„ã€çš†æ§˜ã«ã¯ã”ä¸ä¾¿ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ã“ã¨ã€å¿ƒã‚ˆã‚ŠãŠè©«ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ æœ¬ä»¶ã«é–¢ã™ã‚‹ãŠå•ã„åˆã‚ã›ã¯ã“ã¡ã‚‰ã‚ˆã‚ŠãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
ockeghem 2008/06/08
php

security

session

session fixation
ãƒªãƒ³ã‚¯
XMLHttpRequest ã¨ ã‚»ãƒƒã‚·ãƒ§ãƒ³ (tonextone.com/type/)
PHP ã«ãŠã‘ã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã§ã¯ã€ $_GET ã§ã¯ãªãã€$_POST ã§ã‚‚ãªãã€$_COOKIE ã‹ã‚‰ã‚»ãƒƒã‚·ãƒ§ãƒ³ID ã‚’å—ã‘å–ã‚Šã€ ã•ã‚‰ã«ã€$_COOKIE ä»¥å¤–ã§åŠåˆ¸(ãƒã‚±ãƒƒãƒˆ)ã‚’å—ã‘å–ã£ã¦ã€ ã‚»ãƒƒã‚·ãƒ§ãƒ³ID ã¨ç…§åˆã—ã¦æ£å½“æ€§ã‚’ç¢ºã‹ã‚ã‚‹ã®ãŒå®šçŸ³ã ã€‚ 1. $_COOKIE ã«ã‚ˆã‚‹å—ã‘å–ã‚ŠãŒå¿…è¦ãªç†ç”±: 1.1 æ‚ªæ„ã®ç¬¬ä¸‰è€…ã¯ã€ã‚ãªãŸã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«å«ã¾ã‚Œã‚‹ $_GET, $_POST ã‚’ã€è‡ªç”±è‡ªåœ¨ã«å¤‰æ›´ã™ã‚‹ç½ ã‚’ä½œã‚Œã‚‹ã€‚ 1.2 PHP ã§ã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆå¤‰æ•°($_GET, $_POST, $_COOKIE)ã«ã‚ˆã£ã¦ã‚»ãƒƒã‚·ãƒ§ãƒ³ID ã‚’æŒ‡å®šã§ãã‚‹ã€‚ ã—ãŸãŒã£ã¦ã€ $_GET, $_POST ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’å—ã‘å–ã‚‹ã‚ˆã†ãªã‚·ã‚¹ãƒ†ãƒ ã§ã¯ã€ æ‚ªæ„ã®ç¬¬ä¸‰è€…ãŒä»•æŽ›ã‘ãŸç½ ã«ã‚ˆã£ã¦ã€ æ‚ªæ„ã®ç¬¬ä¸‰è€…ãŒæŒ‡å®šã—ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ID ã§ã€ ã‚ãªãŸã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ãŒé–‹å§‹ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ 2. $_COOKIE ä»¥å¤–ã§ã®
ockeghem 2007/07/13
ã€Œ$_GET, $_POST ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’å—ã‘å–ã‚‹ã‚ˆã†ãªã‚·ã‚¹ãƒ†ãƒ ã§ã¯ã€ç•¥ã€‘æ‚ªæ„ã®ç¬¬ä¸‰è€…ãŒæŒ‡å®šã—ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ID ã§ã€ã‚ãªãŸã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ãŒé–‹å§‹ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€<POSTã«ã‚ˆã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚’å¦å®šã™ã‚‹ç†ç”±ã«ã¯ãªã‚‰ãªã„

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

session fixation
ãƒªãƒ³ã‚¯
1