[B! security] okusa75ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

okusa75 id:okusa75

securityã«é–¢ã™ã‚‹okusa75ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠ Whitetip
BitArts Whtitetipã¯ã€Webã‚·ã‚¹ãƒ†ãƒ ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®æ¬ é™¥ã‚’è¦‹ã¤ã‘ã‚‹ã“ã¨ã‚’æ”¯æ´ã™ã‚‹ãŸã‚ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã§ã™ã€‚ ã“ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ã€BitArtsãŒ2004å¹´ã‚ˆã‚Šæä¾›ã—ã¦ã„ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§æ¤œæŸ»æ”¯æ´ã‚µãƒ¼ãƒ“ã‚¹ã«ãŠã„ã¦ã€è‡ªç¤¾ã§åˆ©ç”¨ã™ã‚‹ä½œæ¥æ”¯æ´ãƒ„ãƒ¼ãƒ«ã¨ã—ã¦é–‹ç™ºã—ã¦ããŸã‚‚ã®ã§ã™ã€‚ ã“ã®åº¦ã€åˆ©ç”¨æ¡ä»¶ã®åˆ¶é™ä»˜ãã§ã¯ã‚ã‚Šã¾ã™ãŒã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å“è³ªå‘ä¸Šã®ãŸã‚ã€ä¸€èˆ¬ã®é–‹ç™ºè€…ã®çš†æ§˜ã«ã”åˆ©ç”¨é ‚ã‘ã‚‹ã‚ˆã†ã€Whitetipç„¡å„Ÿç‰ˆã‚’å…¬é–‹ã™ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚ ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ è£œè¶³èª¬æ˜Ž è¿½åŠ è¨˜äº‹ãŒã‚ã‚Šã¾ã™ã€‚ã”å‚ç…§ãã ã•ã„ã€‚ Webè„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠWhitetipã®è£œè¶³èª¬æ˜Ž (2010/10/7) æ¤œæŸ»é …ç›® ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ OSã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ Webã‚µãƒ¼ãƒã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆãƒ•ã‚¡ã‚¤ãƒ« HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹åˆ†å‰² ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ–ãƒ©ã‚¦ã‚¸ãƒ³ã‚° ãƒªã‚½ãƒ¼ã‚¹ä½
okusa75 2010/10/05
WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Web Application Exploits and Defenses
A Codelab by Bruce Leban, Mugdha Bendre, and Parisa Tabriz Want to beat the hackers at their own game? Learn how hackers find security vulnerabilities! Learn how hackers exploit web applications! Learn how to stop them! This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks. The best way to learn things is by doing, so you'll get a chance to
okusa75 2010/05/11
è„†å¼±æ€§ã‚’ä½“æ„Ÿãƒ»å®Ÿé¨“ã§ãã‚‹ã‚µã‚¤ãƒˆ

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

google
ãƒªãƒ³ã‚¯
WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼å¿…è¦‹ï¼WEBè„†å¼±æ€§åŸºç¤ŽçŸ¥è˜æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ç‡ˆæ˜Žæ—¥è¨˜
ä»¥ä¸‹ã¯ã€WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ç”¨ã®WEBè„†å¼±æ€§ã®åŸºç¤ŽçŸ¥è˜ã®ä¸€è¦§ã§ã™ã€‚ WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®äººã¯ã“ã‚Œã‚’èªã‚ã°WEBè„†å¼±æ€§ã®åŸºç¤Žã‚’ãƒžã‚¹ã‚¿ãƒ¼ã—ã¦WEBãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æ›¸ãã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã§ã™ã€‚ ã¾ãŸã€WEBè„†å¼±æ€§ã®ç°¡æ˜“ãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã¨ã—ã¦ã‚‚å°‘ã—åˆ©ç”¨ã§ãã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã«ã¯ã€é–‹ç™ºè¦ä»¶æ›¸ã‚„ãƒ—ãƒã‚°ãƒ©ãƒ ä»•æ§˜æ›¸é€šã‚Šã«é–‹ç™ºã™ã‚Œã°è‰¯ã„ã¨ã„ã†ã‚ã‘ã«ã¯ã„ãã¾ã›ã‚“ã€‚ ãã†ã€WEBè„†å¼±æ€§ã‚’ç‹™ã†æ‚ªæ„ã®ãƒ¦ãƒ¼ã‚¶ã«ã‚‚å¯¾å‡¦ã—ãªã„ã¨ã„ã‘ãªã„ã®ã§ã™ã€‚ ä»Šå›žã€WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã«ã‚ãŸã£ã¦ã®WEBè„†å¼±æ€§ã‚’ã€ä»¥ä¸‹ã®ä¸€è¦§ã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ã“ã®ã¾ã¨ã‚ãŒWEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã®å‚è€ƒã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ»ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚„èªå¯åˆ¶å¾¡ã®æ¬ è½ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(Directory Traversal) CSRFï¼ˆ
okusa75 2010/05/10
web

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

å…¥é–€

ã¾ã¨ã‚

security
ãƒªãƒ³ã‚¯
ã‚°ãƒ¼ã‚°ãƒ«ã€ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã®è„†å¼±æ€§æ¤œæŸ»ãƒ„ãƒ¼ãƒ«ã€Œskipfishã€ã‚’å…¬é–‹
Googleã¯ç±³å›½æ™‚é–“3æœˆ19æ—¥ã€ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ã‚¦ã‚§ãƒ–ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¹ã‚ãƒ£ãƒŠã€Œskipfishã€ã‚’å…¬é–‹ã—ãŸã€‚ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ã‚¹ã‚ãƒ£ãƒ³ã—ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ã®æœ‰ç„¡ã‚’èª¿ã¹ã‚‰ã‚Œã‚‹ã‚‚ã®ã ã€‚ skipfishã§ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚’ã‚¹ã‚ãƒ£ãƒ³ã™ã‚‹ã¨ã€ãƒ–ãƒ©ã‚¤ãƒ³ãƒ‰SQLã‚„XMLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨ã„ã£ãŸã€Œå·§å¦™ãªä»•æŽ›ã‘ã€ã‚’å«ã‚€è„†å¼±æ€§ã®æœ‰ç„¡ãŒç¢ºèªã§ãã‚‹ã¨ã€Googleã®é–‹ç™ºè€…Michal Zalewskiæ°ã¯skipfishã®wikiã§è¿°ã¹ã¦ã„ã‚‹ã€‚ skipfishã¯å¯¾è±¡ã‚µã‚¤ãƒˆã¸ã®å†å¸°çš„ã‚¯ãƒãƒ¼ãƒ«ã¨è¾žæ›¸ãƒ™ãƒ¼ã‚¹ã®èª¿æŸ»ã‚’å®Ÿè¡Œã—ã€ãã®çµæžœã‚’è¡¨ç¤ºã—ãŸã‚¤ãƒ³ã‚¿ãƒ©ã‚¯ãƒ†ã‚£ãƒ–ãªã‚µã‚¤ãƒˆãƒžãƒƒãƒ—ã‚’ä½œæˆã™ã‚‹ã€‚è„†å¼±æ€§ãŒã‚ã‚‹å ´åˆã«ã¯å¼·èª¿è¡¨ç¤ºã™ã‚‹ã€‚ã¾ãŸã€skipfishãŒä½œæˆã™ã‚‹æœ€çµ‚ãƒ¬ãƒãƒ¼ãƒˆã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è©•ä¾¡ã®åˆ¤æ–ææ–™ã¨ã—ã¦åˆ©ç”¨ã§ãã‚‹ã€‚ åŒæ§˜ã®ã‚¹ã‚ãƒ£ãƒ³ãƒ„ãƒ¼ãƒ«ã¯ã€ã€ŒNiktoã€ã‚„ã€ŒNessusã€ãªã©ã€ã™ã§ã«å•†ç”¨ã§ã‚‚ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã§ã‚‚è¤‡æ•°å‡ºå›žã£
okusa75 2010/03/23
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

google

ãƒ„ãƒ¼ãƒ«
ãƒªãƒ³ã‚¯
Category:OWASP WebScarab Project - OWASP
This historical page is now part of the OWASP archive. This page contains content that is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these techno logies. This page may contain URLs that were once valid but may now link to sites or pages that no longer exist. Please use the newer Edition(s) like OWASP Zed Attack Proxy Project Welcome
okusa75 2008/09/19
HTTPã®è§£æžãƒ„ãƒ¼ãƒ«

security

ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°
ãƒªãƒ³ã‚¯
1