[B! tips][security] shin-uemonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

shin-uemon id:shin-uemon

tipsã¨securityã«é–¢ã™ã‚‹shin-uemonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Firefoxã‹ã‚‰sshã®ãƒ€ã‚¤ãƒŠãƒŸãƒƒã‚¯è»¢é€ã‚’ä½¿ã£ã¦éžå…¬é–‹ã‚µãƒ¼ãƒã¸ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ - å°„æ’ƒã—ã¤ã¤å‰è»¢ æ”¹
sshã«ã¯ãƒ€ã‚¤ãƒŠãƒŸãƒƒã‚¯è»¢é€ã¨ã„ã†æ©Ÿèƒ½ãŒã‚ã‚‹ã€‚ã“ã®æ©Ÿèƒ½ã‚’ä½¿ã†ã¨ã€sshã¯ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å´ã«ã¯SOCKSãƒ—ãƒã‚¯ã‚·ã¨ã—ã¦æŒ¯ã‚‹èˆžã†ãŒã€ãã“ã‹ã‚‰sshã®æŽ¥ç¶šå…ˆã¾ã§ã¯æš—å·åŒ–ã•ã‚ŒãŸçŠ¶æ…‹ã§é€šä¿¡ãŒè¡Œã‚ã‚Œã‚‹ã€‚ ã“ã‚Œã ã‘ã ã¨é€šå¸¸ã®ãƒˆãƒ³ãƒãƒªãƒ³ã‚°ã¨ã©ã†é•ã†ã®ã‹ã‚ˆãã‚ã‹ã‚‰ãªã„ã‹ã‚‚ã—ã‚Œãªã„ãŒã€ãƒ€ã‚¤ãƒŠãƒŸãƒƒã‚¯è»¢é€ã®å ´åˆã¯è»¢é€ãƒãƒ¼ãƒˆã‚’æŒ‡å®šã™ã‚‹å¿…è¦ãŒãªã„ã€‚ã“ã“ãŒãƒ€ã‚¤ãƒŠãƒŸãƒƒã‚¯ã¨è¡¨ç¾ã•ã‚Œã‚‹æ‰€ä»¥ã ã‚ã†ã€‚ ä¾‹ãˆã°ã€ã‚ªãƒ•ã‚£ã‚¹Aã«ã‚ã‚‹é–‹ç™ºã‚µãƒ¼ãƒdev1ã«ã‚ªãƒ•ã‚£ã‚¹å¤–ã‹ã‚‰ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã„ã¨ã™ã‚‹ã€‚ã—ã‹ã—ã€dev1ã¯ã‚ªãƒ•ã‚£ã‚¹å¤–ã«ã¯å…¬é–‹ã•ã‚Œã¦ãŠã‚‰ãšã€è¸ã¿å°ã‚µãƒ¼ãƒladd1ã‚’çµŒç”±ã—ã¦ã—ã‹ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã—ã‹ãªã„ã€‚ladd1ã¯sshã®ã¿ãŒå‹•ã„ã¦ãŠã‚Šã€ã“ã‚Œã¾ã§ã¯sshã®ãƒˆãƒ³ãƒãƒªãƒ³ã‚°æ©Ÿèƒ½ã‚’ä½¿ã£ã¦ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ããŸã®ã ãŒã€ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ãƒ‡ãƒãƒƒã‚°ã™ã‚‹éš›ã¯ã„ã¡ã„ã¡ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒãƒ¼ãƒˆæ¯Žã«ãƒˆãƒ³ãƒãƒ«ã‚’æŽ˜ã‚‹ã®ãŒé¢å€’ãã•ã„ã€‚ã‚ªãƒ•ã‚£ã‚¹ã«é™ã‚‰ãšãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼ã¸
shin-uemon 2009/06/21
security

network

tips
ãƒªãƒ³ã‚¯
ï¼ ITç·¨é›†è€…ãŒé¸ã¶2008å¹´å¿…èªè¨˜äº‹ï¼šã€ŒSecurityï¼†Trustã€ç·¨ ï¼ ï¼ IT
2008/12/24 ï¼ ITã«ã¯1å¹´é–“ã«å¤šæ•°ã®æŠ€è¡“è§£èª¬ã€å‹•å‘è§£èª¬ã®è¨˜äº‹ãŒæŽ²è¼‰ã•ã‚Œã¾ã™ã€‚é‡è¦ãªãŒã‚‰è¦‹è½ã¨ã•ã‚Œã¦ã—ã¾ã£ãŸè¨˜äº‹ã‚‚ã‚ã‚Šã¾ã™ã—ã€ã„ã¾ã‚ã‚‰ãŸã‚ã¦èªã‚€ã¨åˆ¥ã®è¦‹æ–¹ãŒã§ãã‚‹è¨˜äº‹ã‚‚ã‚ã‚Šã¾ã™ã€‚ãã“ã§å¹´æœ«å¹´å§‹ä¼ç”»ã¨ã—ã¦ã€ï¼ ITã®å„ãƒ•ã‚©ãƒ¼ãƒ©ãƒ ç·¨é›†è€…ãŒæŽ¨è–¦ã™ã‚‹ã€Œ2008å¹´å¿…èªè¨˜äº‹ã€ã‚’ç´¹ä»‹ï¼ æœ€åˆã¯Securityï¼†Trustãƒ•ã‚©ãƒ¼ãƒ©ãƒ ã§ã™ã€‚ Securityï¼†Trustãƒ•ã‚©ãƒ¼ãƒ©ãƒ ãŒãŠå‹§ã‚ã™ã‚‹2008å¹´ã®å¿…èªè¨˜äº‹ã€ã¾ãšã¯ã€ŒDNSã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã€é–¢ä¿‚ã®è¨˜äº‹ã§ã™ã€‚ï¼ ITãƒ‹ãƒ¥ãƒ¼ã‚¹ã®é–¢é€£è¨˜äº‹ã€ŒDNSã‚¢ã‚¿ãƒƒã‚¯ã€æŠ€è¡“è€…ãŒã¾ãšã™ã¹ã3ã¤ã®å¯¾ç–ã€ã¯ã€Œ2008å¹´7æœˆã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¸–ç•Œã‚’æ ¹å¹¹ã‹ã‚‰æºã‚‹ãŒã™å¤§ããªå•é¡ŒãŒå…¬é–‹ã•ã‚ŒãŸã€ã¨ã®æ›¸ãå‡ºã—ã§ã€DNSã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°æ”»æ’ƒã®æ·±åˆ»ã•ã‚’è¡¨ç¾ã—ã¦ã„ã¾ã™ã€‚ æŠ€è¡“çš„ãªè§£èª¬ã¯Securityï¼†Trustãƒ•ã‚©ãƒ¼ãƒ©ãƒ ã®ã€ŒDNSã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã®å½±éŸ¿ã¨å¯¾ç– å‰ç·¨ã€ã¨åŒã€Œå¾Œ
shin-uemon 2008/12/26
security

ã‚ã¨ã§èªã‚€

tips
ãƒªãƒ³ã‚¯
è‘‰ã£ã±æ—¥è¨˜ - ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã® HKCRï¿¥MIMEï¿¥Databaseï¿¥charset ä»¥ä¸‹ã«å®šç¾©ã•ã‚Œã¦ã„ã¾ã™ã€‚
UTF-7ã‚’åˆ©ç”¨ã—ãŸXSSã¯ã€charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã«ç™ºç”Ÿã™ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€å°‘ãªãã¨ã‚‚ Internet Explorer ã«ãŠã„ã¦ã¯ã€ã“ã‚Œã¯å¤§ããªé–“é•ã„ã§ã™ã€‚æ£ã—ãã¯ã€Internet Explorer ãŒèªè˜ã§ãã‚‹ charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã§ã‚ã‚Šã€charsetãŒä»˜åŠ ã•ã‚Œã¦ã„ã¦ã‚‚ã€IEãŒèªè˜ã§ããªã„æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã§ã‚ã‚‹å ´åˆã«ã¯XSSãŒç™ºç”Ÿã—ã¾ã™ã€‚ ä¾‹ãˆã°ã€æ¬¡ã®ã‚ˆã†ãª HTML ã¯(HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§ charset ãŒæ˜Žç¤ºã•ã‚Œã¦ã„ãªã„å ´åˆ)IEãŒæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã‚’æ£ã—ãèªè˜ã§ããªã„ãŸã‚ã€ãã®å†…å®¹ã‹ã‚‰UTF-7ã¨è§£é‡ˆã•ã‚Œã‚‹ãŸã‚ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ä½œã—ã¾ã™ã€‚"utf8"ã¨ã„ã†è¡¨è¨˜ã¯UTF-8ã®æ…£ç”¨çš„ãªè¡¨ç¾ã§ã¯ã‚ã‚Šã¾ã™ãŒã€ãƒã‚¤ãƒ•ãƒ³ãŒæŠœã‘ã¦ãŠã‚Šæ£ã—ã„è¡¨è¨˜ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ <html> <head> <meta http-equiv="Co
shin-uemon 2007/07/28
security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

tips
ãƒªãƒ³ã‚¯
Unicodeã§æ‹¡å¼µåã‚’å½è£…ã•ã‚ŒãŸå®Ÿè¡Œãƒ•ã‚¡ã‚¤ãƒ«ã®é˜²å¾¡æ–¹æ³• - è‘‰ã£ã±æ—¥è¨˜
ã€Œãã‚Œ Unicode ã§ã€ãªã©ã§ç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹ã€Unicode ã® U+202E (RIGHT-TO-LEFT OVERRIDE; RLO)ã‚’ä½¿ã£ã¦æ‹¡å¼µåã‚’å½è£…ã•ã‚ŒãŸ exe ãƒ•ã‚¡ã‚¤ãƒ«ã®å®Ÿè¡Œã‚’æŠ‘æ¢ã™ã‚‹æ–¹æ³•ã‚’æ€ã„ã¤ã„ãŸã€‚ ãƒ¡ãƒ¢å¸³ã‚’é–‹ã„ã¦ã€"**"ã¨å…¥åŠ›ã™ã‚‹(å‰å¾Œã®å¼•ç”¨ç¬¦ã¯ä¸è¦)ã€‚ "*"ã¨"*"ã®é–“ã«ã‚ãƒ£ãƒ¬ãƒƒãƒˆ(ã‚«ãƒ¼ã‚½ãƒ«)ã‚’ç§»å‹•ã•ã›ã‚‹ å³ã‚¯ãƒªãƒƒã‚¯ã§ã€ŒUnicode åˆ¶å¾¡æ–‡å—ã®æŒ¿å…¥ã€ã‹ã‚‰ã€ŒRLO Start to right-to-left overrideã€ã€ŒRLO Start of right-to-left overrideã€ã‚’é¸æŠž Ctrl-A ã§å…¨ã¦é¸æŠžã€Ctrl-C ã§ã‚¯ãƒªãƒƒãƒ—ãƒœãƒ¼ãƒ‰ã«ã‚³ãƒ”ãƒ¼ã€‚ ãƒãƒ¼ã‚«ãƒ«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ã‚’é–‹ã ç”»é¢å·¦å´ã®ã€Œè¿½åŠ ã®è¦å‰‡ã€ã‚’å³ã‚¯ãƒªãƒƒã‚¯ ã€Œæ–°ã—ã„ãƒ‘ã‚¹ã®è¦å‰‡ã€ã‚’é¸æŠž ã€Œãƒ‘ã‚¹ã€æ¬„ã§ Ctrl-V ã‚’ã—ã¦ã€ãƒ¡ãƒ¢å¸³ã®å†…å®¹ã‚’è²¼ã‚Šä»˜ã‘ã‚‹ã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¬ãƒ™ãƒ«ãŒã€Œ
shin-uemon 2007/04/23
security

tips

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
SQL Injection Cheat Sheet
Examples; (MS) means : MySQL and SQL Server etc. (M*S) means : Only in some versions of MySQL or special conditions see related note and SQL Server Table Of Contents About SQL Injection Cheat Sheet Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks Line Comments SQL Injection Attack Samples Inline Comments Classical Inline Comment SQL Injection Attack Samples MySQL Vers
shin-uemon 2007/03/21
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹

security

db

database

tips
ãƒªãƒ³ã‚¯
mputã®æ—¥è¨˜ã€‚ - , rootã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æ½°ã•ãªã„ã»ã†ãŒã„ã„ã¨æ€ã†ä»¶
shin-uemon 2007/03/16
linux

tips

server

network

security

ã‚µãƒ¼ãƒãƒ¼
ãƒªãƒ³ã‚¯
æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãŒä¸€èˆ¬ç¤¾ä¼šã«æµ¸é€ã—ï¼Œæƒ…å ±ã‚’æ‰±ã†åˆ©ä¾¿æ€§ã¯å‘ä¸Šã—ã¦ãã¾ã—ãŸã€‚ã—ã‹ã—åˆ©ä¾¿æ€§ã®å‘ä¸Šã¯ï¼ŒåŒæ™‚ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ä½Žä¸‹ã‚‚æ‹›ãã¾ã—ãŸã€‚ã‚µãƒ¼ãƒ“ã‚¹ã®åˆ©ä¾¿æ€§ã‚’äº«å—ã™ã‚‹ã«ã¯ï¼Œè‡ªåˆ†ã®èº«ã¯è‡ªåˆ†ã§å®ˆã‚Šï¼Œä»–äººã«ã¯è¿·æƒ‘ã‚’ã‹ã‘ãªã„ã‚ˆã†ã«ã—ã¦ã„ã‹ãã°ãªã‚Šã¾ã›ã‚“ã€‚ ã“ã®é€£è¼‰ã‚³ãƒ©ãƒ ã§ã¯ï¼Œ â—æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹çŸ¥è˜ã‚’å¢—ã‚„ã—ãŸã„ â—ä½•ã‚’ã™ã‚Œã°ã©ã†ãªã‚‹ã®ã‹ã¯ã‚ã‹ã£ã¦ã„ã‚‹ã‘ã‚Œã©ï¼Œãã®èˆžå°è£ã‚’çŸ¥ã‚ŠãŸã„ â—æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®è³‡æ ¼è©¦é¨“ã‚’å—é¨“ã™ã‚‹ãŸã‚ã®åŸºç¤ŽçŸ¥è˜ã‚’å›ºã‚ãŸã„ ã¨ã„ã†æ–¹ã€…ã‚’å¯¾è±¡ã«ï¼ŒçŸ¥ã£ã¦ãŠããŸã„æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ¦‚å¿µï¼ŒæŠ€è¡“ï¼Œè¦ç´„ãªã©ã‚’è§£èª¬ã—ã¦ã„ãã¾ã™ã€‚ å¿™ã—ã„æ–¹ã¯ï¼Œå„å›žã®å†’é ã«ã‚ã‚‹ã€Œãƒã‚¤ãƒ³ãƒˆã€ã ã‘ã‚’èªã‚“ã§ã„ãŸã ã‘ã‚Œã°è©±ã®å¤§æž ã¯ç†è§£ã§ãã‚‹ã‚ˆã†ã«ã—ã¾ã—ãŸã€‚ãƒã‚¤ãƒ³ãƒˆéƒ¨åˆ†ã«ç›®ã‚’é€šã—ã¦èˆˆå‘³ãŒã‚ã„ã¦ããŸã‚Šï¼Œè‡ªåˆ†ã®å¼±ç‚¹ã ã¨æ„Ÿã˜ãŸã‚‰ï¼Œãã®ã‚ã¨ã«ç¶šãæœ¬æ–‡ã‚‚ãœã²èªã‚“ã§ã¿ã¦ä¸‹ã•ã„ã€‚ æ¯Žé€±æ°´æ›œæ—¥ã«1æœ¬ãšã¤è¨˜äº‹ã‚’æŽ²è¼‰ã—ã¦è¡Œãäºˆå®š
shin-uemon 2007/01/26
security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

tips

ã‚ã¨ã§èªã‚€

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
1