[B! php][ec] slay-tã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

slay-t id:slay-t

phpã¨ecã«é–¢ã™ã‚‹slay-tã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ECã‚µã‚¤ãƒˆã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸæ”»æ’ƒ - JPCERT/CC Eyes
æ”»æ’ƒè€…ã¯ã€ã¯ã˜ã‚ã«æ¨™çš„ã®ECã‚µã‚¤ãƒˆã®æ³¨æ–‡ãƒ•ã‚©ãƒ¼ãƒ ã«å¯¾ã—ã€ä¸æ£ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å«ã‚“ã æ–‡å—åˆ—ã‚’å…¥åŠ›ã—ã€è³¼å…¥å‡¦ç†ã‚’è¡Œã„ã¾ã™ï¼ˆå›³1ã®â‘ ï¼‰ã€‚ãã®çµæžœã€ECã‚µã‚¤ãƒˆã®è³¼å…¥å‡¦ç†ã®éƒ¨åˆ†ã«XSSã®è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹å ´åˆã€ECã‚µã‚¤ãƒˆã®ç®¡ç†ç”»é¢ã‚’é–²è¦§ã—ãŸç®¡ç†è€…ã¯ä¸æ£ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã€ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«æƒ…å ±ã®çªƒå–ã‚„ã€ECã‚µã‚¤ãƒˆã¸ã®ç°¡ç´ WebShellã®è¨ç½®ãªã©ãŒè¡Œã‚ã‚Œã¾ã™ï¼ˆå›³1ã®â‘¡ï½žâ‘£ï¼‰ã€‚ãã®å¾Œã€æ”»æ’ƒè€…ã«ã‚ˆã£ã¦ECã‚µã‚¤ãƒˆã«WebShellã‚„ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®æƒ…å ±çªƒå–ã‚’è¡Œã†JavaScriptãªã©ãŒè¨ç½®ã•ã‚Œã¾ã™ã€‚è¨ç½®ã•ã‚ŒãŸâ€œæƒ…å ±çªƒå–JavaScriptâ€ã«ã‚ˆã£ã¦ECã‚µã‚¤ãƒˆã‚’åˆ©ç”¨ã™ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ç‰ã‚’çªƒå–ã•ã‚Œã€â€œæƒ…å ±ä¿å˜ãƒ•ã‚¡ã‚¤ãƒ«â€ã¨ã—ã¦ECã‚µã‚¤ãƒˆå†…ã«ä¿å˜ã•ã‚Œã¾ã™ï¼ˆå›³1ã®â‘¤ï¼‰ã€‚æ”»æ’ƒè€…ã¯å®šæœŸçš„ãªWebShellã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’è¡Œã†ã“ã¨ã§ã“ã‚Œã‚‰ã®æƒ…å ±ã‚’çªƒå–ã—ã¦ã„ãŸã¨æŽ¨æ¸¬ã•ã‚Œã¾ã™ï¼ˆå›³1ã®â‘¥ï¼‰ã€‚ ãªãŠã€æ”»æ’ƒè€…ã¯ã€ä¸€é€£ã®æ”»æ’ƒã®
slay-t 2021/07/06
ec

ãƒ–ãƒã‚°

ã‚³ãƒ¼ãƒ‰

javascript

gender

security

dev

php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ALB + Cognitoèªè¨¼ã§ä»˜ä¸Žã•ã‚Œã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼æƒ…å ±ã‚’EC2ã‚µã‚¤ãƒ‰ã‹ã‚‰çœºã‚ã¦ã¿ã‚‹ | DevelopersIO
ALBã¯Cognitoã¨çµ„ã¿åˆã‚ã›ã‚‹ã“ã¨ã§ã€ç°¡å˜ã«Webã‚µãƒ¼ãƒãƒ¼ã®èªè¨¼æ©Ÿèƒ½ã‚’å®Ÿç¾ã§ãã¾ã™ã€‚è¶…ä¾¿åˆ©ã€‚ ALBã¨Cognitoã‚’çµ„ã¿åˆã‚ã›ãŸèªè¨¼ã«ã¤ã„ã¦ã¯ã€å¼Šç¤¾ãƒ–ãƒã‚°ã§è§£èª¬ã—ã¦ã„ã‚‹ã®ã§ã“ã¡ã‚‰ã‚’å¾¡è¦§ãã ã•ã„ã€‚ ã‚¤ãƒ³ãƒ•ãƒ©ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒä¸€åˆ‡ã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã‹ãšã«Webã‚µãƒ¼ãƒãƒ¼ã«èªè¨¼æ©Ÿèƒ½ã‚’å®Ÿè£…ã—ãŸè©± ï½œ DevelopersIO æœ¬ãƒ–ãƒã‚°ã§ã¯ã€ã“ã“ã‹ã‚‰ã‚‚ã†ä¸€æ©è¸ã¿è¾¼ã‚“ã§ã€ALBãŒèªè¨¼å¾ŒEC2ã«ä½•ã‚’æ¸¡ã—ã¦ã„ã‚‹ã®ã‹ï¼Ÿï¼ˆEC2ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼æƒ…å ±ã‚’ã©ã†å—ã‘ã¨ã£ã¦ã„ã‚‹ã®ã‹ï¼Ÿï¼‰ã‚’çœºã‚ã¦ã¿ã¾ã™ã€‚ æ§‹æˆå›³ ã“ã‚“ãªæ„Ÿã˜ã®ã‚·ãƒ³ãƒ—ãƒ«ãªæ§‹æˆã‚’ä½œã‚Šã¾ã™ã€‚ALBã¸ã®ã‚¢ã‚¯ã‚»ã‚¹æ™‚ã«ã€Cognitoã¨é€£æºã—ã¦èªè¨¼ã‚’è¡Œã„ã¾ã™ã€‚Cognitoã§ãƒã‚°ã‚¤ãƒ³ã§ããŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã ã‘ãŒEC2ä¸Šã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ãã¾ã™ã€‚ ALB + Cognitoèªè¨¼ã®ãŠã•ã‚‰ã„ ALB + Cognitoã®èªè¨¼ãŒã©ã†ã„ã£ãŸãƒ•ãƒãƒ¼ã§å‹•ã„ã¦ã„ã‚‹ã‹ã€ã“ã“ã§ä¸€åº¦ãŠã•ã‚‰ã„ã—ã¾ã—ã‚‡ã†ã€‚
slay-t 2019/10/17
ec

php

docker

aws
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (9)

phpã¨ecã«é–¢ã™ã‚‹slay-tã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (9)

phpã¨ecã«é–¢ã™ã‚‹slay-tã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

ECã‚µã‚¤ãƒˆã®ã‚¯ãƒ­ã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸæ”»æ’ƒ - JPCERT/CC Eyes

ALB + Cognitoèªè¨¼ã§ä»˜ä¸Žã•ã‚Œã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼æƒ…å ±ã‚’EC2ã‚µã‚¤ãƒ‰ã‹ã‚‰çœºã‚ã¦ã¿ã‚‹ | DevelopersIO

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (9)

phpã¨ecã«é–¢ã™ã‚‹slay-tã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

ECã‚µã‚¤ãƒˆã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸæ”»æ’ƒ - JPCERT/CC Eyes

ALB + Cognitoèªè¨¼ã§ä»˜ä¸Žã•ã‚Œã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼æƒ…å ±ã‚’EC2ã‚µã‚¤ãƒ‰ã‹ã‚‰çœºã‚ã¦ã¿ã‚‹ | DevelopersIO

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹