[B! web][waf] pero1ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

pero1 id:pero1

webã¨wafã«é–¢ã™ã‚‹pero1ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (25)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã„ã¾çŸ¥ã‚ŠãŸã„WAFç‰¹é›† ç¬¬4å›ž ç¾åœ¨ã®WAFã®èª²é¡Œ | ScanNetSecurity
pero1 2013/11/02
web

waf

security
ãƒªãƒ³ã‚¯
ã„ã¾çŸ¥ã‚ŠãŸã„WAFç‰¹é›† ç¬¬3å›ž ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒãƒ¼ã¨WAF | ScanNetSecurity
pero1 2013/11/02
web

waf

security
ãƒªãƒ³ã‚¯
ã„ã¾çŸ¥ã‚ŠãŸã„WAFç‰¹é›† ç¬¬2å›ž WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„…å¨å‹•å‘ | ScanNetSecurity
pero1 2013/11/02
waf

web

security
ãƒªãƒ³ã‚¯
ã„ã¾çŸ¥ã‚ŠãŸã„WAFç‰¹é›† ç¬¬1å›ž WAFã®æ´å² | ScanNetSecurity
pero1 2013/11/02
web

security

waf
ãƒªãƒ³ã‚¯
Google Code Archive - Long-term storage for Google Code Project Hosting.
Code Archive Skip to content Google About Google Privacy Terms
pero1 2012/01/15
waf

nginx

web
ãƒªãƒ³ã‚¯
ãƒ©ã‚¤ã‚¶ãƒ ãƒ¼ãƒ³(LizaMoon)æ”»æ’ƒã«å¯¾ã—ã¦ã‚‚WAFã¯æœ‰åŠ¹ - ockeghem's blog
ãƒ©ã‚¤ã‚¶ãƒ ãƒ¼ãƒ³æ”»æ’ƒã«å¯¾ã™ã‚‹è¡Œãå±Šã„ãŸè§£èª¬ã‚’èªã¿ã¾ã—ãŸã€‚ å¤§è¦æ¨¡ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã€ŒLizaMoonã€æ”»æ’ƒã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸã€‚ - piyolog ã“ã“ã§ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹å†…å®¹ã¯ç´ æ™´ã‚‰ã—ã„ã¨æ€ã†ã®ã§ã™ãŒã€ä¸€ç‚¹ã€WAFã«é–¢ã™ã‚‹ä»¥ä¸‹ã®è¨˜è¿°ãŒå¼•ã£ã‹ã‹ã‚Šã¾ã—ãŸã€‚ SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã§ã‚ã‚Œã°æ—¢çŸ¥ã®æ”»æ’ƒæ‰‹æ³•ã§ã‚ã‚ŠWAFã§é˜²ãã“ã¨ã¯å‡ºæ¥ã‚‹ã®ã§ã¯ã¨ã„ã†è€ƒãˆæ–¹ã‚‚ã‚ã‚Šã¾ã™ãŒã€ä¾‹ãˆã°ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆã‚¿ã‚¤ãƒ—ã®WAFã§ã“ã®æ•°å€¤ãƒªãƒ†ãƒ©ãƒ«åž‹ã‚’ã¤ãSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’é˜²ãã“ã¨ãŒå‡ºæ¥ã¾ã›ã‚“ã€‚HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã¨ã—ã¦å—ã‘ãŸæ–‡å—åˆ—ã ã‘ã§ã€æœ€çµ‚çš„ã«ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã«å¯¾ã—ã¦ç™ºè¡Œã•ã‚Œã‚‹SQLã§ãã®æ–‡å—åˆ—ãŒã©ã®ã‚ˆã†ãªæ‰±ã„ã«ãªã‚‹ã‹(æ•°å€¤ãƒªãƒ†ãƒ©ãƒ«ã«ãªã‚‹ã®ã‹ã©ã†ã‹)åˆ¤æ–ã™ã‚‹ã“ã¨ãŒå‡ºæ¥ãªã„ãŸã‚ã§ã™ã€‚ æœ¬å½“ã«ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆã‚¿ã‚¤ãƒ—ã®WAFã§é˜²ãã“ã¨ãŒã§ããªã„ã®ã§ã—ã‚‡ã†ã‹ã€‚IBMã®ãƒ¬ãƒãƒ¼ãƒˆã«ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹ä»¥ä¸‹ã®æ”»æ’ƒã§è€ƒãˆã¦ã¿ã¾ã™ã€‚ /target.asp
pero1 2011/04/10
security

was

waf

web
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ã¯ã˜ã‚ã« ä¼æ¥æƒ…å ±ã‚·ã‚¹ãƒ†ãƒ ã®å¤šãã¯ã€ï¼ˆ1ï¼‰Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ã‚µãƒ¼ãƒãƒ¼ï¼ˆç”»é¢ã‚„æ¥å‹™ãƒã‚¸ãƒƒã‚¯ã‚’æ‹…å½“ã™ã‚‹ï¼‰ã¨ï¼ˆ2ï¼‰ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãƒ»ã‚µãƒ¼ãƒãƒ¼ï¼ˆãƒ‡ãƒ¼ã‚¿ã‚’æ ¼ç´ã™ã‚‹ï¼‰ã§æ§‹ç¯‰ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã‚Œã‚‰ã®ã‚µãƒ¼ãƒãƒ¼ãƒ»ã‚½ãƒ•ãƒˆã«å¯¾ã™ã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã‚„æ“ä½œãƒŸã‚¹ã‚’é˜²ãã“ã¨ãŒã€ä¼æ¥ã®ãƒ‡ãƒ¼ã‚¿ã‚’å®ˆã‚‹ã†ãˆã§é‡è¦ã§ã™ã€‚ æœ¬é€£è¼‰ã§ã¯ã€2å›žã«ã‚ãŸã‚Šã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ã‚µãƒ¼ãƒãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆç¬¬1å›žï¼‰ã¨ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãƒ»ã‚µãƒ¼ãƒãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆç¬¬2å›žï¼‰ã‚’è§£èª¬ã—ã¾ã™ã€‚ Webã‚µã‚¤ãƒˆã«ãŠã‘ã‚‹è„†å¼±æ€§ã®ç¾çŠ¶ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ã‚µãƒ¼ãƒãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’è€ƒãˆã‚‹å‰æã¨ã—ã¦ã€ è„†å¼±æ€§ã®ç¾çŠ¶ è„…å¨ï¼ˆæ”»æ’ƒï¼‰ã®ç¾çŠ¶ ã‚’çŸ¥ã£ã¦ãŠãå¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚è„†å¼±æ€§ã¨è„…å¨ã®ä¸¡æ–¹ãŒæƒã†ã¨ã€ä¼æ¥ã®ãƒ‡ãƒ¼ã‚¿ã¯å®‰å…¨ã§ã¯ãªããªã‚Šã¾ã™ã€‚ ã¾ãšã¯ã€è„†å¼±æ€§ã®ç¾çŠ¶ã‹ã‚‰èª¬æ˜Žã—ã¾ã™ã€‚ IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ã§ã¯ã€çµŒæ¸ˆç”£æ¥çœã®å‘Šç¤ºã«åŸºã¥ãã€ã‚½ãƒ•ãƒˆã‚¦
pero1 2010/11/22
waf

web

security
ãƒªãƒ³ã‚¯
http://tokumaru.org/d/20080722.html
pero1 2009/07/18
security

waf

web
ãƒªãƒ³ã‚¯
WordPress.com
The address xiom.wordpress.com cannot be registered. Sorry, that site is reserved! But you can sign up and choose another one.
pero1 2009/05/22
waf

web

security
ãƒªãƒ³ã‚¯
ã‚¢ã‚«ãƒžã‚¤ãŒâ€œã‚¯ãƒ©ã‚¦ãƒ‰ãƒ™ãƒ¼ã‚¹ã®WAFâ€ã‚’å®Ÿç¾ã€PCIDSSæº–æ‹ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã¨ã—ã¦æä¾›
ã‚¢ã‚«ãƒžã‚¤æ ªå¼ä¼šç¤¾ã¯5æœˆ20æ—¥ã€ã‚¯ãƒ©ã‚¦ãƒ‰ãƒ™ãƒ¼ã‚¹ã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ï¼ˆä»¥ä¸‹ã€WAFãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ï¼‰ã‚’ç™ºè¡¨ã—ãŸã€‚ã‚¢ã‚«ãƒžã‚¤ã®ã‚µãƒ¼ãƒãƒ¼ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã€ŒEdgePlatformã€ä¸Šã«å®Ÿè£…ã•ã‚Œã‚‹WAFã§ã€æ”»æ’ƒãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãŒãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼ã«å±Šãå‰ã«é˜²å¾¡ã§ãã‚‹ã®ãŒç‰¹é•·ã€‚ã“ã‚Œã‚’åˆ©ç”¨ã—ã¦ã€ã‚¯ãƒ©ã‚¦ãƒ‰ä¸Šã§å®‰å…¨ãªã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆç”¨ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚’æä¾›ã™ã‚‹ã€ŒPCIDSSå®Œå…¨æº–æ‹ ã‚µãƒ¼ãƒ“ã‚¹ã€ã‚‚ã€åŒæ—¥ã‹ã‚‰ã‚¹ã‚¿ãƒ¼ãƒˆã™ã‚‹ã€‚ WAFãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¯ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ãªã©ã®HTTPæ”»æ’ƒã‹ã‚‰ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é˜²ããŸã‚ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã€‚ä¸–ç•Œä¸ã®ã‚¢ã‚«ãƒžã‚¤ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ä¸Šã«4ä¸‡å°åˆ†æ•£ã•ã‚ŒãŸã‚µãƒ¼ãƒãƒ¼ç¾¤ãƒ»EdgePlatformä¸Šã«å®Ÿè£…ã•ã‚Œã‚‹ã€‚ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼å´ã«å°‚ç”¨ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ã‚’è¨ç½®ã—ãªãã¦æ¸ˆã‚€ã»ã‹ã€ä¿å®ˆãƒ»é‹ç”¨ã‚‚ã‚¢ã‚«ãƒžã‚¤ãŒè¡Œã†ãŸã‚ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯WAFã®é‹ç”¨ã‚³ã‚¹ãƒˆã‚’å‰Šæ¸›ã§ãã‚‹ã€‚
pero1 2009/05/21
waf

security

web
ãƒªãƒ³ã‚¯
WAF Virtual Patching Challenge - Securing WebGoat with ModSecurity
WAF Virtual Patching Challenge: Securing WebGoat with ModSecurity Ryan Barnett Breach Security (www.breach.com) rbarnet [email protected] Revision 1 (January 20, 2009) Abstract In this paper, we present the technical details behind a virtual patch, which is a critical protection function provided by web application firewalls (WAFs). A virtual patch is a powerful, agile mitigation strategy to quickly hel
pero1 2009/02/21
waf

web

security
ãƒªãƒ³ã‚¯
ASPãƒ»SaaSãƒŠãƒ“
ã€ŒASPãƒ»SaaSãƒŠãƒ“ã€ã¯ã‚µãƒ¼ãƒ“ã‚¹ã®æä¾›ã‚’çµ‚äº†ã—ã¦ãŠã‚Šã¾ã™ã€‚ å¤šãã®ãŠå®¢æ§˜ã«ã”æ„›é¡§ã‚’è³œã‚Šã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚ ãªãŠã€ã”ä¸æ˜Žãªç‚¹ã‚„ã”è³ªå•ãªã©ãŒã”ã–ã„ã¾ã—ãŸã‚‰ä¸‹è¨˜ã‚ˆã‚ŠãŠå•ã„åˆã‚ã›ãã ã•ã„ã€‚ â‡’ å•ã„åˆã‚ã›ï¼ˆhttps://www.bplats.co.jp/form/ï¼‰
pero1 2008/03/01
waf

was

web

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªãƒ–ãƒã‚° | ç„¡æ–™ãƒ–ãƒã‚°ã‚’ä½œæˆã—ã‚ˆã†
ã•ã•ã‚„ã‹ãªãŠæ£æœˆé£¾ã‚Š ãŠæ£æœˆé£¾ã‚Šã«è‘‰ç‰¡ä¸¹ã®å¯„ã›æ¤ãˆã€‚é–¢è¥¿ã¯è‰²ã€…ãªè‘‰ç‰¡ä¸¹ãŒæƒã£ã¦ã„ã¦é¸ã¶ã®ã‚‚æ¥½ã—ã„ ã‚ãƒ³ã‚»ãƒ³ã‚« ãƒ–ãƒãƒ³ã‚ºãƒ“ãƒ¥ãƒ¼ãƒ†ã‚£ãƒ¼ ã“ã®å¾Œã€é–€æ‰‰ã®ãã°ã«é£¾ã‚Šã¾ã—ãŸã€‚è¯ã‚„ã‹ã«ãªã‚Šã¾ã—ãŸã ãã—ã¦ã—ã‚ç¸„ä½œã‚Šã€‚ æ¾ã€æ°´å¼•ãã€ã—ã‚ç¸„ã«åºã®å—å¤©ã‚’åŠ ãˆã¾ã—ãŸ ã‚ã‚ã˜çµã³ã‹ã‚‰ã€å›ºãçµã°ã‚ŒãŸâ€¦
pero1 2008/03/01
waf

was

web

security
ãƒªãƒ³ã‚¯
é€£è¼‰ï¼šJ2EEã®åŸºç¤Ž ç¬¬1å›žã€ŒJava Pet Storeã€ã§ã€J2EEã‚’ä½“é¨“ã™ã‚‹ï¼ˆ1ï¼‰
ã“ã®è¬›åº§ã¯ã€ã‚µãƒ¼ãƒãƒ»ã‚µã‚¤ãƒ‰ã§ã®Javaåˆ©ç”¨ã®ä»£è¡¨çš„ãªæ‰‹æ³•ã®1ã¤ã§ã‚ã‚‹J2EEã®åŸºç¤Žã‚’ã€ã§ãã‚‹ã ã‘åŸºæœ¬çš„ãªã¨ã“ã‚ã‹ã‚‰èª¬æ˜Žã™ã‚‹ã“ã¨ã‚’ç›®çš„ã¨ã—ã¦ã„ã¾ã™ã€‚ã“ã®ã€ŒJ2EEã®åˆç‰çš„ãªèª¬æ˜Žã€ã«ã¨ã£ã¦ã®ä¸€ç•ªã®å•é¡Œã¯ã€J2EEãŒéžå¸¸ã«å¤šãã®è¦ç´ æŠ€è¡“ã‹ã‚‰ãªã‚‹å·¨å¤§ãªã‚·ã‚¹ãƒ†ãƒ ã ã¨ã„ã†ã“ã¨ã§ã™ã€‚ä»¥ä¸‹ã«ã€J2EEã‚’æ§‹æˆã™ã‚‹åŸºæœ¬çš„ãªæŠ€è¡“ã®ä¸€è¦§ã‚’ç¤ºã—ã¾ã™ï¼ˆã“ã‚Œã‚‰ã®æŠ€è¡“ã«ãƒãƒ¼ã‚¸ãƒ§ãƒ³ç•ªå·ãŒä»˜ã„ã¦ã„ã‚‹ã®ã¯ã€J2EEè‡ªèº«ãŒå¤‰åŒ–ã‚’ç¶šã‘ã¦ã„ã‚‹ã“ã¨ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚ã“ã®ãƒªã‚¹ãƒˆã¯ã€ã“ã®åŽŸç¨¿ã‚’æ›¸ã„ã¦ã„ã‚‹2001å¹´3æœˆæ™‚ç‚¹ã§ã®J2EE j2sdkee-1.3betaã®æ§‹æˆã‚’åæ˜ ã—ã¦ã„ã¾ã™ï¼‰ã€‚
pero1 2007/09/20
web

was

waf

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
[Studying HTTP] HTTP Header Fields
ã“ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã¯è²©å£²ç”¨ã§ã™ï¼ studyinghttp.net ã¯ã€ã‚ãªãŸãŒãŠæŽ¢ã—ã®æƒ…å ±ã®å…¨ã¦ã®æœ€æ–°ã‹ã¤æœ€é©ãªã‚½ãƒ¼ã‚¹ã§ã™ã€‚ä¸€èˆ¬ãƒˆãƒ”ãƒƒã‚¯ã‹ã‚‰ã“ã“ã‹ã‚‰æ¤œç´¢ã§ãã‚‹å†…å®¹ã¯ã€studyinghttp.netãŒå…¨ã¦ã¨ãªã‚Šã¾ã™ã€‚ã‚ãªãŸãŒãŠæŽ¢ã—ã®å†…å®¹ãŒè¦‹ã¤ã‹ã‚‹ã“ã¨ã‚’é¡˜ã£ã¦ã„ã¾ã™ï¼
pero1 2007/08/23
waf

was

web

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Welcome | Sandhills Global | Gather, Process, Distribute
pero1 2007/07/24
was

web

waf

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
å®‰å…¨ãªWebã‚¢ãƒ—ãƒªé–‹ç™ºã®é‰„å‰‡ 2004
pero1 2006/11/21
web

security

waf

was
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - é§„ç›®ãªæŠ€è¡“æ–‡æ›¸ã®è¦‹åˆ†ã‘æ–¹ ãã®1
â– é§„ç›®ãªæŠ€è¡“æ–‡æ›¸ã®è¦‹åˆ†ã‘æ–¹ ãã®1 ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã®ãƒ›ãƒƒãƒ†ãƒ³ãƒˆãƒªã‚’è¦‹ã¦ã„ãŸã¨ã“ã‚ã€300ã‚’è¶…ãˆã‚‹ãƒ¦ãƒ¼ã‚¶ã«ç™»éŒ²ã•ã‚ŒãŸä»¥ä¸‹ã®è¨˜äº‹ãŒã‚ã£ãŸã€‚ ä»Šå¤œåˆ†ã‹ã‚‹SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–, ä¸Šé‡Žå®£, @IT, 2006å¹´11æœˆ2æ—¥ ã¾ãŸä¸Šé‡Žå®£ã‹ã€‚é¡”è¦‹çŸ¥ã‚Šãªã®ã§ã‚ºãƒãƒªã„ãã“ã¨ã«ã™ã‚‹ã€‚ ã—ã‹ã—ã€ãã®å¯¾ç–ã¯ã¾ã æœ¬å½“ã«ç†è§£ã•ã‚Œã¦ã„ãªã„ã‚ˆã†ã«æ€ãˆã‚‹ã€‚ ã¸ãˆã€‚ çµ‚ã‚ã‚Šã®æ–¹ã‚’è¦‹ã¦ã¿ã‚‹ã¨ã€ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å¯¾ç– å…¥åŠ›å€¤ã®SQLã®ç‰¹æ®Šæ–‡å—ã‚’é©åˆ‡ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ— å…¥åŠ›å€¤ï¼ãƒ—ãƒã‚°ãƒ©ãƒ ï¼ˆãƒ—ãƒã‚»ã‚¹ï¼‰ã«å¤–éƒ¨ã‹ã‚‰å…¥ã£ã¦ãã‚‹ã‚‚ã® ã‚·ãƒ•ãƒˆJISã®å ´åˆã«ã¯1ãƒã‚¤ãƒˆæ–‡å—ã‚’æ•´ç† SQLã®è¨˜è¿°ã‚’ãªãã™ãŸã‚ã«O/Rï¼ˆObject/Relationalï¼‰ãƒžãƒƒãƒ”ãƒ³ã‚°ã‚’æ´»ç”¨ æ”»æ’ƒè€…ã«å½¹ç«‹ã¤æƒ…å ±ã‚’ä¸Žãˆãªã„ãŸã‚ã«ã€ä¸è¦ãªã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ï¼ˆãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãŒå‡ºåŠ›ã™ã‚‹ã‚¨ãƒ©ãƒ¼ãªã©ï¼‰ã®è¡¨ç¤ºã‚’æŠ‘æ¢ å¯¾ç–ã«ã€Œæº–å‚™ã•ã‚ŒãŸæ–‡ã€(prepared statement)
pero1 2006/11/20
web

security

waf

was
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ãƒã‚°ã‚¤ãƒ³å‰Session Fixationã‚’ã©ã†ã™ã‚‹ã‹
â– ãƒã‚°ã‚¤ãƒ³å‰Session Fixationã‚’ã©ã†ã™ã‚‹ã‹ 21æ—¥ã®æ—¥è¨˜ã€ŒSession Fixationè„†å¼±æ€§ã®è²¬ä»»ä¸»ä½“ã¯Webã‚¢ãƒ—ãƒªã‹Webãƒ–ãƒ©ã‚¦ã‚¶ã‹ã€ã§ã€ãƒ–ãƒ©ã‚¦ã‚¶ãƒ™ãƒ³ãƒ€ã¯Cookie Monsterå•é¡Œã‚’ã©ã†ã™ã‚‹ã®ã ã‚ã†ã‹ã¨ã„ã†ã“ã¨ã«ã¤ã„ã¦æ›¸ã„ãŸãŒã€Firefox 2.0 ã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸã¨ã“ã‚ã€è§£æ±ºã—ã¦ã„ãªã‹ã£ãŸã€‚ã¾ãŸã€IE 7 ã‚‚è§£æ±ºã—ã¦ã„ãªã„ã€‚ ãã®ã‚ˆã†ãªçŠ¶æ³ã§ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³è¿½è·¡ãŒcookieã ã‘ã«ã‚ˆã£ã¦è¡Œã‚ã‚Œã¦ã„ã‚‹å ´åˆã§ã‚ã£ã¦ã‚‚ã€Session Fixationæ”»æ’ƒã«å¯¾ã—ã¦é…æ…®ã›ã–ã‚‹ã‚’å¾—ãªã„ã€‚ ã“ã‚Œã¾ã§ã€Session Fixationå¯¾ç–ã¨ã„ãˆã°ã€ãƒã‚°ã‚¤ãƒ³å¾Œã®çŠ¶æ…‹ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã•ã‚Œã‚‹ã“ã¨ã®é˜²æ¢ã®ã¿ãŒèªžã‚‰ã‚Œã‚‹ã“ã¨ãŒå¤šã‹ã£ãŸãŒã€ãƒã‚°ã‚¤ãƒ³å‰ã«ã¤ã„ã¦ã¯ã©ã†ã ã‚ã†ã‹ã€‚ ãŸã¨ãˆã°ã€ãƒã‚°ã‚¤ãƒ³å‰ã‹ã‚‰ä½¿ãˆã‚‹ã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ã‚«ãƒ¼ãƒˆã«å¯¾ã—ã¦Session Fixationæ”»æ’ƒãŒè¡Œã‚ã‚Œã‚‹ã¨
pero1 2006/11/20
web

security

waf

was
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯ä½•ã®ãŸã‚ã«ã‚ã‚‹ã®ã‹
â– ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯ä½•ã®ãŸã‚ã«ã‚ã‚‹ã®ã‹ å…ˆæœˆã€ã‚¸ãƒ£ãƒ‘ãƒ³ãƒãƒƒãƒˆéŠ€è¡Œã‹ã‚‰ã€ŒSecurIDã€ãŒé€ã‚‰ã‚Œã¦ããŸã€‚RSAã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç”Ÿæˆå™¨ï¼ˆä»¥ä¸‹ã€Œãƒˆãƒ¼ã‚¯ãƒ³ã€ï¼‰ã ã€‚ã‚¸ãƒ£ãƒ‘ãƒ³ãƒãƒƒãƒˆéŠ€è¡Œã¯å…¨å£åº§ã®åˆ©ç”¨è€…ã«å¯¾ã—ã¦ã“ã‚Œã‚’é…å¸ƒã—ã¦ã„ã‚‹ã€‚ å±Šã„ãŸéƒµä¾¿ç‰©ã«ã¯å›³1ã®æ¡ˆå†…çŠ¶ãŒå…¥ã£ã¦ã„ãŸã€‚ ã“ã“ã«æ›¸ã‹ã‚Œã¦ã„ã‚‹ã“ã¨ã¯äº‹å®Ÿã§ãªã„ã®ã§ã€ä¿¡ã˜ã¦ã¯ã„ã‘ãªã„ã€‚ 2. ãƒˆãƒ¼ã‚¯ãƒ³ã¯ã‚¹ãƒ‘ã‚¤ã‚¦ã‚§ã‚¢ã«ç›£è¦–ã•ã‚Œãªã„ã®ã§å®‰å…¨ã§ã™ã€‚ ãƒˆãƒ¼ã‚¯ãƒ³ã¯ãƒ‘ã‚½ã‚³ãƒ³ã€æºå¸¯é›»è©±ãªã©ã¨ä¸€åˆ‡ã®é€šä¿¡ã‚’è¡Œã„ã¾ã›ã‚“ã€‚ä¸‡ãŒä¸€ãƒ‘ã‚½ã‚³ãƒ³ã‚„æºå¸¯é›»è©±ãŒã‚¹ãƒ‘ã‚¤ã‚¦ã‚§ã‚¢ï¼ˆä¸æ£ãƒ—ãƒã‚°ãƒ©ãƒ ï¼‰ã«æ„ŸæŸ“ã—ã¦ã‚‚ã€ãƒˆãƒ¼ã‚¯ãƒ³ã«è¡¨ç¤ºã•ã‚ŒãŸãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒç›£è¦–ã•ã‚Œã‚‹ã“ã¨ãŒãªãå®‰å¿ƒã§ã™ã€‚ ã“ã‚Œã‚’èªã‚“ã ãƒ¦ãƒ¼ã‚¶ã¯ã€ã€Œä»Šå¾Œã¯ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ãŸ .exe ãƒ•ã‚¡ã‚¤ãƒ«ã‚’å®‰å¿ƒã—ã¦å®Ÿè¡Œã§ãã‚‹ã€ã¨æ€ã£ã¦ã—ã¾ã†ã‹ã‚‚ã—ã‚Œãªã„ãŒã€ãƒˆãƒã‚¤ã®æœ¨é¦¬ï¼ˆä¸æ£ãƒ—ãƒã‚°ãƒ©ãƒ ï¼‰ã‚’å®Ÿè¡Œã—ã¦ã—ã¾ã£ã¦ã¯ã€ãŸã¨ãˆã“ã®ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹
pero1 2006/11/20
web

security

waf

was

cookie
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸