[B! sql] pero1ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

pero1 id:pero1

sqlã«é–¢ã™ã‚‹pero1ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (21)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã¨ã‚ã‚‹è¨ºæ–å“¡ã¨SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
7. é€šå¸¸ã®Webã‚µãƒ¼ãƒã¨ã®é€šä¿¡ <html> <body> <form action=â€œregisterâ€ method=â€œPOSTâ€> æ°å:vultest<BR> ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹:vulte [email protected]<BR> æ€§åˆ¥:ç”·<BR> ï¼ˆä»¥ä¸‹ç•¥ï¼‰ </html> POST /confirm.php HTTP/1.1 Host: example.jp ï¼ˆä»¥ä¸‹ç•¥ï¼‰ Cookie: PHP SESSID=xxxxxxxxxx name=vultest&mail=vultest%40example.jp&gender=1 HTTP Response HTTP Request 8. è‰²ã€…ã„ã˜ã£ã¦ã¿ã¦ã©ã†ã„ã†å¿œç”ãŒã‚ã‚‹ã‹ç¢ºèª POST /confirm.php HTTP/1.1 Host: example.jp ï¼ˆä»¥ä¸‹ç•¥ï¼‰ Cookie: PHP SESSID=xxxxxxxxxx name
pero1 2014/05/26
security

sql

injection
ãƒªãƒ³ã‚¯
åˆç´šã€œä¸ç´šè€…ã®ãŸã‚ã®SQLç‰¹è¨“ - å¿˜ã‚Œãªã„ã‚ˆã†ã«ãƒ¡ãƒ¢ã£ã¨ã
ã»ã¼ã»ã¼åˆå¿ƒè€…ã§SQLã®ç·´ç¿’ãŒã—ãŸã„ã£ã¦ã„ã†äººã€çŸ¥è˜ã®å†ç¢ºèªã‚’ã—ãŸã„äººã«ã‚ªã‚¹ã‚¹ãƒ¡ã®ã‚µã‚¤ãƒˆã€‚ SQLZOO ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ä½œã™ã‚‹ã®ã§ã€ã‚ã‚“ã©ãã•ã„ç’°å¢ƒè¨å®šã‚‚ãªã—ã€‚ ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚‚ã€MySQLã€Oracleã€SQL Serverã€Postgreã€Ingresã€DB2ã‹ã‚‰é¸ã¹ã‚‹ã€‚ ç°¡å˜ãªSELECTæ–‡ã‹ã‚‰å§‹ã¾ã£ã¦ã€SUMã‚„COUNTã¿ãŸã„ãªåŸºæœ¬çš„ãªé–¢æ•°ã®å•é¡Œã‚„ã€JOINã‚’ä½¿ã£ãŸã¡ã‚‡ã£ã¨é›£ã—ã‚ã®æ§‹æ–‡ã‚‚ã‚ã‚‹ã€‚ å®Ÿè¡Œç’°å¢ƒä»˜ãã®ãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã‚‚ã‚ã‚‹ã®ãŒã‚ˆã„ï¼(è¶…ä¾¿åˆ©ï¼)
pero1 2014/02/26
db

sql
ãƒªãƒ³ã‚¯
ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹è¨è¨ˆå¾¹åº•æŒ‡å—
DB ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãŸã‚ã®æŠ€è¡“å‹‰å¼·ä¼šï¼ˆç¬¬3å›žï¼‰ã§ä½¿ç”¨ã—ãŸè³‡æ–™ã§ã™ã€‚ä¸»ã«ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ¢ãƒ‡ãƒ«ã¨æ£è¦åŒ–ã«ã¤ã„ã¦è§£èª¬ã—ã¦ã„ã¾ã™ã€‚ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ¢ãƒ‡ãƒ«ã®é™ç•Œã«ã¤ã„ã¦æ£ã—ãèªè˜ã—ã¦ã“ãã€ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ¢ãƒ‡ãƒ«ã‚’ç†è§£ã—ãŸã¨è¨€ãˆã‚‹ã¨æ€ã„ã¾ã™ã€‚
pero1 2013/11/29
db

sql
ãƒªãƒ³ã‚¯
The SQL Injection Knowledge Base
Examples: SELECT * FROM Articles WHERE id = '1'''; SELECT 1 FROM dual WHERE 1 = '1'''''''''''''UNION SELECT '2'; Notes: You can use as many apostrophes and quotations as you want as long as they pair up. It is also possible to continue the statement after the chain of quotes. Quotes escape quotes.
pero1 2012/07/07
security

sql

db

injection
ãƒªãƒ³ã‚¯
ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®å†…éƒ¨å‹•ä½œã‚’çŸ¥ã‚‹
SQLã®ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã¯å¥¥ãŒæ·±ã„ã€‚ç‰¹ã«ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ã®è¦³ç‚¹ã‹ã‚‰ã€ãã†è¨€ãˆã‚‹ã ã‚ã†ã€‚ ã¿ãªã•ã‚“ã”æ‰¿çŸ¥ã®é€šã‚Šã€åŒã˜çµæžœã‚’å‡ºã™ãƒ—ãƒã‚°ãƒ©ãƒ ã§ã‚‚ã€SQLã®æ›¸ãæ–¹æ¬¡ç¬¬ã§å‡¦ç†æ™‚é–“ã«ä½•å€ã‚‚ã®å·®ãŒç”Ÿã˜å¾—ã‚‹ã€‚åŠ¹çŽ‡ã®æ‚ªã„SQLã‚’æ›¸ã„ã¦ã—ã¾ã†åŽŸå› ã¯ã€å¤šãã®å ´åˆã€ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®å†…éƒ¨å‹•ä½œã‚„ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«é–¢ã™ã‚‹ç†è§£ä¸è¶³ã§ã‚ã‚‹ã€‚ä¸¡è€…ã‚’ã‚ˆãçŸ¥ã£ãŸä¸Šã§æœ€é©ãªSQLã‚’æ›¸ã‘ã‚‹ã‚ˆã†ã«ãªã‚‹ã“ã¨ã¯ã€ã‚·ã‚¹ãƒ†ãƒ ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨ã—ã¦ã®é‡è¦ãªã‚¹ã‚ãƒ«ã®ä¸€ã¤ã§ã‚ã‚‹ã€‚ ç‰¹é›†ã€ŽåŸºç¤Žã‹ã‚‰ç†è§£ã™ã‚‹ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ã—ãã¿ã€ã§ã¯ã€ãƒªãƒ¬ãƒ¼ã‚·ãƒ§ãƒŠãƒ«ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®å†…éƒ¨å‹•ä½œã«ã¤ã„ã¦ã€åŸºæœ¬çš„ãªéƒ¨åˆ†ã‚’åˆ†ã‹ã‚Šã‚„ã™ãè§£èª¬ã—ã¦ã„ã‚‹ã€‚SQLãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã«å½¹ç«‹ã¤ã“ã¨ã¯ã‚‚ã¡ã‚ã‚“ã€SQLãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ã‚„ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹è¨è¨ˆã®ãŸã‚ã®åŸºç¤ŽçŸ¥è˜ã¨ã—ã¦ã‚‚ä¸å¯æ¬ ã ã€‚ ã‚¤ãƒ³ãƒˆãƒãƒ€ã‚¯ã‚·ãƒ§ãƒ³ ãƒ–ãƒ©ãƒƒã‚¯ãƒœãƒƒã‚¯ã‚¹ã®ã¾ã¾ã§ã„ã„ã®ï¼Ÿ Part 1ï¼šSQLæ–‡ã¯ã©ã®ã‚ˆã†ã«å®Ÿè¡Œã•ã‚Œã‚‹ã®ã‹ SQLå®Ÿè¡Œã¾ã§ã®
pero1 2011/07/02
db

sql

programing
ãƒªãƒ³ã‚¯
ä»Šå¤œã“ãã‚ã‹ã‚‹å®‰å…¨ãªSQLã®å‘¼ã³å‡ºã—æ–¹ã€€ï½ž é«˜æœ¨æµ©å…‰æ°ã«èžã„ã¦ã¿ãŸ
ã€Œå®‰å…¨ãªSQLã®å‘¼ã³å‡ºã—æ–¹ã€ã¨ã„ã†SQLã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ç„¦ç‚¹ã‚’å½“ã¦ãŸãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆãŒã€2010å¹´3æœˆã«IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼‰ã‹ã‚‰å…¬é–‹ã•ã‚ŒãŸã€‚ ã“ã‚Œã¯2006å¹´1æœˆã‹ã‚‰æä¾›ã•ã‚Œã¦ã„ã‚‹ã€Webã‚µã‚¤ãƒˆé–‹ç™ºè€…ã‚„é‹å–¶è€…å‘ã‘ã®ã‚»ã‚ãƒ¥ã‚¢Webã‚µã‚¤ãƒˆæ§‹ç¯‰ã®ãŸã‚ã®è³‡æ–™ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€ã®åˆ¥å†Šã¨ã—ã¦æ›¸ã‹ã‚ŒãŸã‚‚ã®ã§ã‚ã‚‹ã€‚ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€ãŒ92ãƒšãƒ¼ã‚¸ãªã®ã«å¯¾ã—ã¦ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦ã ã‘ã§40ãƒšãƒ¼ã‚¸ã‚‚ã®åˆ†é‡ãŒã‚ã‚‹ã€‚ãªãœã“ã‚“ãªã«åˆ†åŽšã„ã®ã ã‚ã†ã‹ã€‚ ã“ã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆä½œæˆã«å”åŠ›ã—ãŸã¨ã„ã†ã€ç‹¬ç«‹è¡Œæ”¿æ³•äººç”£æ¥æŠ€è¡“ç·åˆç ”ç©¶æ‰€ æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶ã‚»ãƒ³ã‚¿ãƒ¼ã®é«˜æœ¨æµ©å…‰æ°ã«ãŠè©±ã‚’ä¼ºã†ã“ã¨ãŒã§ããŸã€‚é«˜æœ¨æ°ã¯å€‹äººãƒ–ãƒã‚°ã€Œé«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ã€ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®å•é¡Œã‚’è¿½æ±‚ã™ã‚‹è«–å®¢ã¨ã—ã¦ã‚‚çŸ¥ã‚‰ã‚Œã¦ã„ã‚‹ã€‚ç†è€…ã‚‚ä»¥å‰ã€ã“ã®é€£è¼‰ã®ã€Œä»Šå¤œã‚ã‹ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã€ã®å›žï¼ˆ2006å¹´11æœˆ
pero1 2010/06/27
security

sql

injection
ãƒªãƒ³ã‚¯
æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼šæƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼šè„†å¼±æ€§å¯¾ç– :ã€Œå®‰å…¨ãªSQLã®å‘¼ã³å‡ºã—æ–¹ã€ã‚’å…¬é–‹
IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ã€ç†äº‹é•·ï¼šè¥¿åž£ æµ©å¸ï¼‰ã¯ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ç‹™ã£ãŸSQL(*1)ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒ(*2)ãŒç¶™ç¶šã—ã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³(*3)ã®å®‰å…¨ãªå®Ÿè£…æ–¹æ³•ã‚’è§£èª¬ã—ãŸè³‡æ–™ã€Œå®‰å…¨ãªSQLã®å‘¼ã³å‡ºã—æ–¹ã€ã‚’2010å¹´3æœˆ18æ—¥ï¼ˆæœ¨ï¼‰ã‹ã‚‰IPAã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã§å…¬é–‹ã—ã¾ã—ãŸã€‚ URLï¼šhttp://www.ipa.go.jp/security/vuln/websecurity.html è¿‘å¹´ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ç‹™ã£ãŸæ”»æ’ƒãŒç¶™ç¶šã—ã¦ã„ã¾ã™ã€‚æ”»æ’ƒã®å®Ÿä¾‹ã¨ã—ã¦ã€IPAãŒç„¡å„Ÿã§å…¬é–‹ã—ã¦ã„ã‚‹ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ¤œå‡ºãƒ„ãƒ¼ãƒ«iLogScanner(*4)ã€ã§ã€ã€Œè„†å¼±æ€§å¯¾ç–æƒ…å ±ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹JVN iPedia(*5)ã€ã®ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚’è§£æžã—ãŸäº‹ä¾‹ã‚’å›³1ã«ç¤ºã—ã¾ã™ã€‚ å›³1ã‚’è¦‹ã‚‹ã¨ã€2008å¹´é ƒã‹ã‚‰æ€¥å¢—ã—ã¦ã„ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒãŒå…¨ä½“ã®45%ã€ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ•ã‚¡ã‚¤
pero1 2010/03/21
IPA

sql

injection
ãƒªãƒ³ã‚¯
SQLã®æš—é»™ã®åž‹å¤‰æ›ã¯ãƒ¯ãƒŠãŒã„ã£ã±ã„
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ã€‚å…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2009å¹´9æœˆ24æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€SQLã«ãŠã„ã¦ã€Œæš—é»™ã®åž‹å¤‰æ›ã€ã‚’ä½¿ã†ã¹ãã§ãªã„ç†ç”±ã¨ã—ã¦ã€å…·ä½“çš„ãªã€Œãƒ¯ãƒŠã€ã‚’ã„ãã¤ã‹ç´¹ä»‹ã—ã¾ã™ã€‚Â æ•°å€¤é …ç›®ã«å¯¾ã™ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã®ã¾ã¨ã‚ã«ã¦èª¬æ˜Žã—ãŸã‚ˆã†ã«ã€RDBã®æ•°å€¤åž‹ã®åˆ—ã«å¯¾ã—ã¦SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚’ã™ã‚‹æ–¹æ³•ã¨ã—ã¦ã€ä»¥ä¸‹ã®ä¸‰ç¨®é¡žãŒçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ ãƒã‚¤ãƒ³ãƒ‰æ©Ÿæ§‹ã‚’ç”¨ã„ã‚‹ ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã®æ•°å€¤ã¨ã—ã¦ã®å¦¥å½“æ€§ç¢ºèªã‚’è¡Œã† ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’æ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«ã¨ã—ã¦ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ ã“ã®ã†ã¡ã€æ–¹æ³•3ã‚’ä½¿ã†ã¹ãã§ãªã„èª¬æ˜Žã®è£œè¶³ã§ã™ã€‚å…·ä½“çš„ã«ã¯ã€æ–¹æ³•3ã«ã¯ã€ã€Œæš—é»™ã®åž‹å¤‰æ›ã€ãŒç™ºç”Ÿã—ã¾ã™ãŒã€ãã‚ŒãŒæ€ã‚
pero1 2009/09/27
security

sql

db
ãƒªãƒ³ã‚¯
ã€ŒUnicodeã«ã‚ˆã‚‹XSSã¨SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½æ€§ã€ãƒ—ãƒ¬ã‚¼ãƒ³è³‡æ–™ - ockeghem's blog
ã ã„ã¶é–“ãŒã‚ã„ã¦ã—ã¾ã„ã¾ã—ãŸãŒã€æœ¬å¹´1æœˆ31æ—¥ã«é–‹å‚¬ã•ã‚ŒãŸã€ç¬¬04å›žã¾ã£ã¡ã‚ƒï¼”ï¼”ï¼•å‹‰å¼·ä¼šç›®è¦šã¾ã—å‹‰å¼·ä¼šã«ãŠã‘ã‚‹ãƒ©ã‚¤ãƒˆãƒ‹ãƒ³ã‚°ãƒˆãƒ¼ã‚¯ã®è³‡æ–™ã‚’å…¬é–‹ã—ã¾ã™ã€‚ Unicodeã«ã‚ˆã‚‹XSSã¨SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½æ€§View more presentations from ockeghem.
pero1 2009/09/20
unicode

security

sql

injection

xss
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’æ ¹çµ¶ï¼ã‚»ã‚ãƒ¥ã‚¢é–‹ç™ºã®æ¥µæ„
ä»¥ä¸‹ã®ãƒšãƒ¼ã‚¸ã§ãƒã‚°ã‚¤ãƒ³ã‚’ãŠé¡˜ã„ã—ã¾ã™ã€‚ [SSL(Secure Sockets Layer)ãƒ—ãƒãƒˆã‚³ãƒ«ã§å…¥åŠ›ã„ãŸã ã„ãŸå†…å®¹ã‚’ä¿è·ã„ãŸã—ã¾ã™] â– ç™»éŒ²ã•ã‚Œã¦ã„ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ãŠå¿˜ã‚Œã®æ–¹ã¯ï¼Œã€Œæ—¥çµŒBPãƒ‘ã‚¹ãƒãƒ¼ãƒˆã€ã®ã€Œãƒ¦ãƒ¼ã‚¶ãƒ¼IDãƒ»ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ãŠå•ã„åˆã‚ã›ã€ãƒšãƒ¼ã‚¸ã§ã”ç¢ºèªã„ãŸã ã‘ã¾ã™ã€‚ â– ITpro-Newsï¼ŒITpro-Reportãªã©ã®ãƒ¡ãƒ¼ãƒ«é…ä¿¡ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã®æ–¹ã‚‚ï¼Œ Webä¸Šã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ã”è¦§ã„ãŸã ããŸã‚ã«ã¯ï¼Œæ”¹ã‚ã¦ç™»éŒ²ã‚’ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
pero1 2009/09/18
security

sql

injection
ãƒªãƒ³ã‚¯
SQLã®ãƒã‚¤ãƒ³ãƒ‰æ©Ÿæ§‹ã¯ã€Œã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã•ã‚ŒãŸå€¤ã€ã‚’ã¯ã‚è¾¼ã‚€ã®ã‹ - ockeghem's blog
ä»¥å‰ã“ã®ãƒ–ãƒã‚°ã§ã‚‚å–ã‚Šä¸Šã’ãŸã“ã¨ã®ã‚ã‚‹ç¥žæˆ¸ãƒ‡ã‚¸ã‚¿ãƒ«ãƒ»ãƒ©ãƒœã®è¿‘è—¤ä¼¸æ˜Žæ°ãŒThink ITä¸Šã§ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¤§å…¨ã€ã¨ã„ã†é€£è¼‰ã‚’åŸ·ç†ã—ã¦ãŠã‚‰ã‚Œã‚‹ã€‚ãã®ç¬¬ä¸‰å›žã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯¾ç–ã€ã‚’èªã‚“ã§ä»¥ä¸‹ã®éƒ¨åˆ†ãŒå¼•ã£ã‹ã‹ã£ãŸã€‚ ãƒã‚¤ãƒ³ãƒ‰æ©Ÿæ§‹ã¨ã¯ã€ã‚ã‚‰ã‹ã˜ã‚SQLæ–‡ã®ã²ãªåž‹ã‚’ç”¨æ„ã—ã€å¾Œã‹ã‚‰å¤‰å‹•å€‹æ‰€ï¼ˆãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ï¼‰ã«å®Ÿéš›ã®å€¤ï¼ˆãƒã‚¤ãƒ³ãƒ‰å€¤ï¼‰ã‚’å‰²ã‚Šå½“ã¦ã¦SQLæ–‡ã‚’ç”Ÿæˆã™ã‚‹ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®æ©Ÿèƒ½ã ã€‚ãƒã‚¤ãƒ³ãƒ‰å€¤ã¯ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã—ãŸå¾Œã«ãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ã«ã¯ã‚è¾¼ã‚€ã®ã§ã€æ‚ªæ„ã‚ã‚‹SQLæ–‡ãŒæŒ¿å…¥ã•ã‚Œã¦ã‚‚ã€ãã®å®Ÿè¡Œã‚’é˜»æ¢ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ï¼ˆå›³1-2ï¼‰ã€‚ http://thinkit.jp/article/847/1/ ãŸã—ã‹ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã‚’ä½¿ã£ã¦ãƒã‚¤ãƒ³ãƒ‰æ©Ÿæ§‹ã‚’å®Ÿè£…ã™ã‚‹å ´åˆã‚‚ã‚ã‚‹ã€‚Javaã¨MySQLã®çµ„ã¿åˆã‚ã›ã§Unicodeã®U+00A5ã‚’ç”¨ã„ãŸSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½æ€§ | å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰æ´¾ç”Ÿã—ã¦ã€MyS
pero1 2009/08/07
sql

injection

security
ãƒªãƒ³ã‚¯
è‡ªä½œæ¤œæŸ»ãƒ„ãƒ¼ãƒ« - SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ç·¨ - 2009-05-31 - T.Teradaã®æ—¥è¨˜
å‰å›žã®æ—¥è¨˜ã‹ã‚‰ã ã„ã¶æ—¥ã«ã¡ãŒç©ºã„ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ ä»Šæ—¥ã¯ã€è‡ªä½œæ¤œæŸ»ãƒ„ãƒ¼ãƒ«ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ç”¨ã‚·ã‚°ãƒãƒãƒ£ã«ã¤ã„ã¦æ›¸ãã¾ã™ã€‚ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®æ¤œæŸ»ã‚·ã‚°ãƒãƒãƒ£ã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®5ç¨®é¡žã‚’ç”¨æ„ã—ã¦ã„ã¾ã™ã€‚ A. SQLã‚¨ãƒ©ãƒ¼æ¤œå‡º+ç°¡æ˜“ãªBlind B. Blind æ•°å€¤åž‹ãƒ»ã‚«ãƒ©ãƒ åç‰ C. Blind æ–‡å—åˆ—åž‹ D. æ›´æ–°ç³»ã‚¯ã‚¨ãƒª E. æ–‡å—ã‚³ãƒ¼ãƒ‰ç³» SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¯ã€ã‹ãªã‚Šã®é »åº¦ã§è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚Œã‚‹ã“ã¨ã€ã¾ãŸä¸€èˆ¬çš„ã«å±é™ºåº¦ã®é«˜ã„è„†å¼±æ€§ã§ã‚ã‚‹ã“ã¨ã‹ã‚‰ã€ã‚·ã‚°ãƒãƒãƒ£ã®ç¨®é¡žã‚’å¤šãã—ã¦ã„ã¾ã™ã€‚ ãã‚Œãžã‚Œã®ã‚·ã‚°ãƒãƒãƒ£ã«ã¤ã„ã¦ã€ä»¥ä¸‹ã§é †ç•ªã«è¦‹ã¦ã„ãã¾ã™ã€‚ A. SQLã‚¨ãƒ©ãƒ¼æ¤œå‡º+ç°¡æ˜“ãªBlind æœ€åˆã«è©¦ã™ã®ã¯ãƒ™ãƒ¼ã‚·ãƒƒã‚¯ãªãƒ‘ã‚¿ãƒ¼ãƒ³ã§ã™ã€‚ ã‚¤:ã€å…ƒã®å€¤ã€‘'"\'"\ â€¦ SQLã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ ãƒ:ã€å…ƒã®å€¤ã€‘''""\\ â€¦ SQLã‚¨ãƒ©ãƒ¼ã«ãªã‚‰ãªã„ ãƒ:ã€å…ƒã®å€¤ã€‘'"\'"\ â€¦ SQLã‚¨ãƒ©ãƒ¼ã«ãª
pero1 2009/06/02
security

sql
ãƒªãƒ³ã‚¯
PostgreSQLã‚»ãƒŸãƒŠãƒ¼2009æ˜¥ã€œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ•…ã®ã‚±ãƒ¼ã‚¹ã‚¹ã‚¿ãƒ‡ã‚£ã€œ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
å…¬é–‹: 2009å¹´5æœˆ10æ—¥21æ™‚10åˆ†é ƒ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«memo (www.st.ryukoku.ac.jp)ã‚ˆã‚Šã€ã€ŒPostgreSQLã‚»ãƒŸãƒŠãƒ¼2009æ˜¥ã€œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ•…ã®ã‚±ãƒ¼ã‚¹ã‚¹ã‚¿ãƒ‡ã‚£ã€œ (www.ipa.go.jp)ã€(PDF)ã€‚ è‰¯ã„è³‡æ–™ã ã¨æ€ã„ã¾ã™ãŒã€ã¡ã‚‡ã£ã¨æ€ã£ãŸã¨ã“ã‚ã‚’ãƒ¡ãƒ¢ã€‚ p10.ã€Œã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ã‚µã‚¤ãƒˆã®è£å´ã€â€¦â€¦ãªã‚“ã§HTMLã®æ§‹é€ ãŒ? ã“ã“ã§è¨€ã†ã€Œè£å´ã€ã£ã¦ãã†ã„ã†æ„å‘³ã§ã¯ãªã„ã¨æ€ã†ã®ã§ã™ãŒã€é©åˆ‡ãªç”»åƒãŒãªã‹ã£ãŸã®ã§ã—ã‚‡ã†ã‹â€¦â€¦ã€‚ â€»ã©ã†ã§ã‚‚è‰¯ã„ã§ã™ãŒã€ã“ã†ã„ã†æ§‹é€ ã ã¨ã€ãŠçŸ¥ã‚‰ã›ã®æ–‡è¨€ãŒå¢—ãˆãŸã¨ãã‚„æ–‡å—ã‚µã‚¤ã‚ºæ‹¡å¤§æ™‚ã«ã€ã‚·ãƒ³ãƒœãƒ«ãƒžãƒ¼ã‚¯ã¨ãƒã‚´ã‚¿ã‚¤ãƒ—(ãªã®ã‹?)ãŒæ³£ãåˆ¥ã‚Œã«ãªã‚Šãã†ãªæ°—ãŒã—ã¾ã™ãã€‚ã„ã‚„ã€ãã“ã¯ã¤ã£ã“ã‚€ã¨ã“ã‚ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€‚
pero1 2009/05/20
security

ipa

sql

injection
ãƒªãƒ³ã‚¯
MySQL+Java ã§ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ãƒ—ãƒªãƒšã‚¢ãƒ¼ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã‚’ä½¿ã†ã¹ãã§ã€Œãªã„ã€ç†ç”± - kazuhoã®ãƒ¡ãƒ¢ç½®ãå ´
useServerPrepStmtsã®ã“ã“ã®èª¬æ˜Žã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆãŒtrueã«ãªã£ã¦ã„ã‚‹ãŒã€ã“ã‚Œã¯ä¸Šè¿°ã®é€šã‚Šå˜˜ã§ã‚ã‚‹ã€‚ (ä¸ç•¥) ãã—ã¦ãªãœfalseã«ã•ã‚ŒãŸã‹ã¨ã„ã†ã“ã¨ã®èƒŒæ™¯ã‚’å¯Ÿã™ã‚‹ã¨ã€trueã«ã™ã‚‹ã“ã¨ã®å¼Šå®³ã‚‚ã‚ã‚Šãã†ã§ã€æ‰‹æ”¾ã—ã§ã“ã‚Œã‚’trueã«ã™ã‚‹ã“ã¨ã‚’å‹§ã‚ã‚‹ã“ã¨ãŒå°‘ã—ã¯ã°ã‹ã‚‰ã‚Œã‚‹ã€‚ http://www.geminium.com/chiba_blog/2008/12/23/33/ è‡ªåˆ†ã¯ Java ä½¿ã£ã¦ãªã„ã§ã™ãŒã€MySQL ã®ä¸ã®äººãŒä½¿ã†ãªã£ã¦è¨€ã£ã¦ã¾ã™ *1ã€‚ãã®ç†ç”±ã¯ãƒ¡ãƒ¢ãƒªãƒªãƒ¼ã‚¯ã®ã‚ˆã†ãªç—‡çŠ¶ãŒå‡ºã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‹ã‚‰ã€‚ So why are prepared statements a probl em? Because users do not clean up/close unused prepared statements. Multiply the number of prep
pero1 2009/01/11
security

mysql

sql

injection
ãƒªãƒ³ã‚¯
Connector/J 5.1ã¨Server Side Prepared Statement - mir the developer
ã“ã“æ•°æ—¥ã€ŒMySQL + Connector/J(JDBCãƒ‰ãƒ©ã‚¤ãƒ) + ãƒ—ãƒªãƒšã‚¢ãƒ¼ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã€ã®è©±é¡ŒãŒã¡ã‚‰ã»ã‚‰å‡ºã¦ã„ã¾ã™ã€‚æ£ç¢ºã«æŠŠæ¡ã¯ã—ã¦ã„ãªã„ã§ã™ãŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–â†’PreparedStatementã¨ã„ã†æµã‚Œã§ããŸè©±ã®ã‚ˆã†ã§ã™ã€‚ å¾³ä¸¸æµ©ã®æ—¥è¨˜ - Javaã¨MySQLã®çµ„ã¿åˆã‚ã›ã§Unicodeã®U+00A5ã‚’ç”¨ã„ãŸSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½æ€§ ã¸ã¼ã¸ã¼CTOæ—¥è¨˜ - useServerPrepStmtsã‚’ä½¿ã†ã®ãŒæ ¹æœ¬è§£æ±ºã ã¨ã¯ãŠã‚‚ã†ã€‚ã‘ã©â€¦ï¼Ÿ id:kazuhookuã®ãƒ¡ãƒ¢ç½®ãå ´ - MySQL+Java ã§ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ãƒ—ãƒªãƒšã‚¢ãƒ¼ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã‚’ä½¿ã†ã¹ãã§ã€Œãªã„ã€ç†ç”± è‡ªåˆ†ã¯å…ƒConnector/Jé–‹ç™ºãƒ¡ãƒ³ãƒ(â€»ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ³ç”Ÿã¨ã—ã¦)ã§ã‚‚ã‚ã‚Šã¨ã¦ã‚‚æ°—ã«ãªã‚‹è©±é¡Œãªã®ã§ã€Connector/Jã®ã‚½ãƒ¼ã‚¹è§£æžã‚‚å«ã‚ãŸèª¬æ˜Žã‚’ã“ã“ã§è¡Œã„ãŸã„ã¨æ€ã†ã€‚ ãƒ—ãƒªãƒšã‚¢ãƒ¼ãƒ‰ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆ
pero1 2009/01/10
security

mysql

sql

injection
ãƒªãƒ³ã‚¯
NameBright - Coming Soon
security-hacks.com is coming soon This domain is managed at
pero1 2008/06/29
security

sql

injection

was

web
ãƒªãƒ³ã‚¯
SQLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«ãŠã‘ã‚‹ã€Œ\ã€ã®å–ã‚Šæ‰±ã„
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ã€‚å…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2008å¹´6æœˆ2æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š æ˜¨æ—¥ã®ã‚¨ãƒ³ãƒˆãƒª(å¾³ä¸¸æµ©ã®æ—¥è¨˜ - ãã‚ãã‚SQLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã«é–¢ã—ã¦ä¸€è¨€ã„ã£ã¨ãã‹ - SQLã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å†è€ƒ)ã¯æ€ã„ãŒã‘ãšå¤šãã®æ–¹ã«èªã‚“ã§ã„ãŸã ã„ãŸã€‚ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ãã®ä¸ã§é«˜æœ¨æµ©å…‰æ°ã‹ã‚‰ãƒ–ã‚¯ãƒžã‚³ãƒ¡ãƒ³ãƒˆã‚’é ‚æˆ´ã—ãŸã€‚ \ãŒescapeç”¨æ–‡å—ã®DBã§\ã®escapeãŒå¿…é ˆã«ãªã‚‹ç†ç”±ãŒæ˜Žç¢ºã«æ›¸ã‹ã‚Œã¦ãªã„ã€‚\'ãŒä¸Žãˆã‚‰ã‚ŒãŸã¨ã'ã ã‘escapeã™ã‚‹ã¨â€¦ã€‚è‡ªä½œescapeã¯å±ã†ã„ã€‚ã€Œå®‰å…¨ãªâ€¦ä½œã‚Šæ–¹ã€3ç‰ˆã§è¿½åŠ ã®ã€Œ3.å¤±æ•—ä¾‹ã€ã§ã¯DBã§ç”¨æ„ã•ã‚ŒãŸescapeæ©Ÿèƒ½ã—ã‹æŽ¨å¥¨ã—ã¦ã„ãªã„ ã“ã®ã†ã¡ã€ã¾ãšã€Œ\ã€ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒå¿…
pero1 2008/06/08
sql

waf

was
ãƒªãƒ³ã‚¯
Webã‚µã‚¤ãƒˆã«å¤šæ•°è¢«å®³ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒãŒçŒ›å¨ã‚’ãµã‚‹ã†
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã§å¤šæ•°ã®Webã‚µã‚¤ãƒˆã«ä¸æ£ã‚³ãƒ¼ãƒ‰ãŒä»•æŽ›ã‘ã‚‰ã‚Œã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’æ‚ªè³ªã‚µã‚¤ãƒˆã«èª˜å°Žã—ã¦ã„ã‚‹ã€‚ Webã‚µã‚¤ãƒˆã‚’ãƒãƒƒã‚ãƒ³ã‚°ã—ã¦ä¸æ£ã‚³ãƒ¼ãƒ‰ã‚’ä»•æŽ›ã‘ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒãŒåºƒç¯„ã«åºƒãŒã£ã¦ã„ã‚‹ã¨ã—ã¦ã€ç±³US-CERTã‚„SANS Internet Storm CenterãŒæ³¨æ„ã‚’å‘¼ã³ã‹ã‘ã¦ã„ã‚‹ã€‚ US-CERTã«ã‚ˆã‚‹ã¨ã€æ”»æ’ƒã¯ã‚ã‚‰ã‚†ã‚‹åˆ†é‡Žã®Webã‚µã‚¤ãƒˆã«åŠã‚“ã§ã„ã‚‹ã€‚ãƒãƒƒã‚ãƒ³ã‚°ã•ã‚ŒãŸã‚µã‚¤ãƒˆã«ã¯æ‚ªè³ªãªJavaScriptãƒ•ã‚¡ã‚¤ãƒ«ã‚’å‚ç…§ã•ã›ã‚‹ã‚³ãƒ¼ãƒ‰ãŒåŸ‹ã‚è¾¼ã¾ã‚Œã€ä½•ã‚‚çŸ¥ã‚‰ãšã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ããŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’æ‚ªè³ªã‚µã‚¤ãƒˆã«èª˜å°Žã€‚ã“ã®ã‚µã‚¤ãƒˆã§ã¯ã€Internet Explorerï¼ˆIEï¼‰ã‚„RealPlayerãªã©ã•ã¾ã–ã¾ãªã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã™ã‚‹ä»•æŽ›ã‘ã«ãªã£ã¦ã„ã‚‹ã€‚ SANSã§èª¿ã¹ãŸã¨ã“ã‚ã€è„†å¼±æ€§ã®ã‚ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã‚’ä»•æŽ›ã‘ã‚‹è‡ªå‹•åŒ–ã‚¹ã‚¯
pero1 2008/01/12
security

sql

was
ãƒªãƒ³ã‚¯
SQL Injectionãƒ„ãƒ¼ãƒ« - teraccâ€™s blog
ã“ã“ã®ã¨ã“ã‚ã€ã„ãã¤ã‹ã®SQL Injectionãƒ„ãƒ¼ãƒ«ã«ã¤ã„ã¦èª¿ã¹ã¦ã„ã¾ã—ãŸã€‚ä»Šæ—¥ã¯ãã®çµæžœã‚’æ—¥è¨˜ã«æ›¸ã„ã¦ã¿ã‚ˆã†ã¨æ€ã„ã¾ã™ã€‚ ã¯ã˜ã‚ã« SQL Injectionãƒ„ãƒ¼ãƒ«ã¨ã¯ SQL Injectionè„†å¼±æ€§ã®ç™ºè¦‹ã¨ã€ç™ºè¦‹ã—ãŸè„†å¼±æ€§ã‚’çªã„ã¦ã®DBå†…æƒ…å ±ã®å–å¾—ã‚’è¡Œãªã†ãŸã‚ã®ãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ ãŸã ã—ã€å¤šãã®ãƒ„ãƒ¼ãƒ«ã§ã¯ã€Œè„†å¼±æ€§ã®ç™ºè¦‹ã€ã¯ãŠã¾ã‘ã§ã€å¾Œè€…ã®DBå†…æƒ…å ±ã®å–å¾—ã«ä¸»çœ¼ã‚’ç½®ã„ã¦ã„ã¾ã™ã€‚ä¸€èˆ¬çš„ã«ã¯ã€æ±Žç”¨ã®Webè„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒŠãªã©ã§è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦ã€ãã®è„†å¼±æ€§ã«å¯¾ã—ã¦ã“ã®æ—¥è¨˜ã«æ›¸ã„ã¦ã„ã‚‹ã‚ˆã†ãªãƒ„ãƒ¼ãƒ«ã‚’ä½¿ã£ã¦æƒ…å ±ã‚’å–å¾—ã™ã‚‹ã¨ã„ã†ä½¿ã„æ–¹ã‚’ã™ã‚‹ã“ã¨ãŒå¤šã„ã§ã—ã‚‡ã†ã€‚ SQL Injectionãƒ„ãƒ¼ãƒ«ã¯ã€ã„ã‚ã‚†ã‚‹Hackingãƒ„ãƒ¼ãƒ«ã§ã™ã€‚è„†å¼±æ€§æ¤œæŸ»ã‚’è¡Œãªã†è€…ã‹ã€ã•ã‚‚ãªã‘ã‚Œã°Crackingã‚’è¡Œãªã†çŠ¯ç½ªè€…ãŒä½¿ã†ãã‚‰ã„ã§ã€ä¸€èˆ¬ã®Webé–‹ç™ºè€…ã‚„ãƒ¦ãƒ¼ã‚¶ã®äººãŒä½¿ã†å¿…è¦ã«è¿«ã‚‰ã‚Œã‚‹ã“ã¨ã¯ç„¡ã„ã§ã—ã‚‡ã†ã€‚ ãƒ„ãƒ¼ãƒ«ã®ä½¿ç”¨ã«éš›ã—ã¦
pero1 2007/12/06
sql

injection

security

ã¾ã¨ã‚

tool
ãƒªãƒ³ã‚¯
[LAC]ãƒ©ãƒƒã‚¯ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶æ‰€ãŒæä¾›ã™ã‚‹ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹å®‰å…¨ã‚¬ã‚¤ãƒ‰
æƒ…å ±ã‚’å®ˆã‚Šã€æœªæ¥ã‚’å‰µé€ ã™ã‚‹ãƒ‘ã‚¤ã‚ªãƒ‹ã‚¢ã¨ã—ã¦ã®ä¿¡é ¼ã¨è‡ªä¿¡ã§ã€ã‚‚ã£ã¨å…ˆã¸ æœ€é«˜å³°ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚µãƒ¼ãƒ“ã‚¹ã¨ã€ITãƒˆãƒ¼ã‚¿ãƒ«ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã‚’æä¾›ã—ã¾ã™ã€‚ ã‚‚ã£ã¨çŸ¥ã‚‹
pero1 2007/10/03
security

ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹

sql

was
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸