[B! security] sutara_lumpurã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sutara_lumpur id:sutara_lumpur

securityã«é–¢ã™ã‚‹sutara_lumpurã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (57)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒãƒƒã‚·ãƒ¥ã¨æš—å·ã¯é•ã†ãžï¼ PHPã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹é–¢è¥¿2017 / Hash or Encryption
PHPã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹é–¢è¥¿ 2017ã®ç™ºè¡¨è³‡æ–™ã§ã™
sutara_lumpur 2017/07/25
php

hash

security
ãƒªãƒ³ã‚¯
Google Chrome 62 ã¯ SSL ã§ä¿è·ã•ã‚Œã¦ã„ãªã„ãƒšãƒ¼ã‚¸ã®å…¥åŠ›ãƒ•ã‚©ãƒ¼ãƒ ã«å¯¾ã—ã¦ ã€Œå®‰å…¨ã§ãªã„ã€ ã¨è¦å‘Šã™ã‚‹
10æœˆã«æ£å¼ãƒªãƒªãƒ¼ã‚¹äºˆå®šã® Chrome 62 ã‚ˆã‚Šã€SSL ã§ä¿è·ã•ã‚Œã¦ã„ãªã„ãƒšãƒ¼ã‚¸ã«å…¥åŠ›ãƒ•ã‚©ãƒ¼ãƒ ãŒã‚ã‚‹å ´åˆã€ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã«è¦å‘ŠãŒè¡¨ç¤ºã•ã‚Œã‚‹ã‚ˆã†ã«ãªã‚‹ã¨ã®ã“ã¨ã€‚ç‰¹ã«ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆãƒ¢ãƒ¼ãƒ‰ã®å ´åˆã¯ãƒšãƒ¼ã‚¸èªã¿è¾¼ã¿æ™‚ç‚¹ã§è¦å‘ŠãŒè¡¨ç¤ºã•ã‚Œã‚‹äºˆå®šã§ã™ã€‚ SSLï¼ˆTLSï¼‰ ã§ä¿è·ã•ã‚Œã¦ã„ãªã„ãƒšãƒ¼ã‚¸ã§ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã—ã‚ˆã†ã¨ã—ãŸéš›ã«ã€ãƒ–ãƒ©ã‚¦ã‚¶ãŒ ã€Œãã‚Œã¯å®‰å…¨ã§ã¯ãªã„ã§ã™ã‚ˆã€ ã¨è¦å‘Šã™ã‚‹æ©Ÿèƒ½ã¯ã€Google Chromeã€Firefox å…±ã«å®Ÿè£…ã•ã‚Œã¦ã„ã¦ã€ã“ã® Blog ã§ã‚‚éŽåŽ»ã«å–ã‚Šä¸Šã’ã¦ã„ã¾ã™ã€‚ Chrome 56 ãŒæ£å¼ãƒªãƒªãƒ¼ã‚¹ã€SSL ã§ä¿è·ã•ã‚Œã¦ã„ãªã„ãƒšãƒ¼ã‚¸ã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å…¥åŠ›æ¬„ãŒã‚ã‚‹ã¨ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã§è¦å‘Šã™ã‚‹ Firefox 46 ä»¥é™ã¯ HTTP æŽ¥ç¶šæ™‚ã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å…¥åŠ›æ¬„ãŒã‚ã‚‹ã¨ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã§è¦å‘Šã™ã‚‹ Google ã¯ã“ã®ä»•çµ„ã¿ã‚’ã‚ˆã‚Šå¼·åŒ–ã™ã‚‹ã“ã¨ã‚’ä»¥å‰ã‹ã‚‰ææ¡ˆã—ã¦ã„ã¾ã™ãŒã€å…ˆæ—¥ã€ã€ŒGoogle O
sutara_lumpur 2017/04/30
ãŠå•ã„åˆã‚ã›ãƒ•ã‚©ãƒ¼ãƒ ã ã‘ã˜ã‚ƒãªãæ¤œç´¢ãƒœãƒƒã‚¯ã‚¹ã§ã‚‚è¦å‘Šã•ã‚Œã‚‹ãªã‚‰ã€å®Œå…¨httpsåŒ–ã®å¼·åˆ¶åŠ›ã¨ãªã‚‹ãªã€‚

ssl

security
ãƒªãƒ³ã‚¯
https://nodesecurity.io/advisories/jquery_xss
sutara_lumpur 2017/04/25
XSSè„†å¼±æ€§ã®ãŸã‚ã€jQuery3.xç³»ã‚’ä½¿ã£ãŸã»ã†ãŒã„ã„ã€‚

security
ãƒªãƒ³ã‚¯
target="_blank" ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯(ãƒ‡ãƒ¢å‹•ç”»ã‚ã‚Š)
HTMLã‚’å‹‰å¼·ã™ã‚‹éš›ã«æœ€åˆã«è¦šãˆã‚‹ã‚‚ã®ã®1ã¤ã«aè¦ç´ (ã‚¿ã‚°)ãŒã‚ã‚Šã¾ã™ã€‚HTMLã®ã‚¢ã‚¤ãƒ‡ãƒ³ãƒ†ã‚£ãƒ†ã‚£ã¨è¨€ã£ã¦ã‚‚éŽè¨€ã§ã¯ãªã„ã€ãƒã‚¤ãƒ‘ãƒ¼ãƒªãƒ³ã‚¯ã‚’å®Ÿç¾ã™ã‚‹å¤§äº‹ãªè¦ç´ ã§ã™ã€‚ hrefå±žæ€§ã«è¨å®šã•ã‚ŒãŸãƒªãƒ³ã‚¯å…ˆã®URLã‚’ã©ã®ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ç‰ã«è¡¨ç¤ºã™ã‚‹ã‹ã‚’æ±ºã‚ã‚‹targetå±žæ€§ã¨ã„ã†ã‚‚ã®ãŒã‚ã‚Šã¾ã™ã€‚ä»»æ„ã®å€¤ã‚’è¨å®šã—ã¦ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã«åå‰ã‚’ä»˜ã‘ã‚‹äº‹ã§ã€è¤‡æ•°ã®aè¦ç´ ã‹ã‚‰åŒã˜ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã¸ãƒªãƒ³ã‚¯å…ˆURLã‚’è¡¨ç¤ºã™ã‚‹äº‹ã‚‚ã§ãã¾ã™ã—ã€å¸¸ã«æ–°ã—ã„ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’é–‹ã_blankã®ã‚ˆã†ãªã€ã‚ã‚‰ã‹ã˜ã‚æŒ™å‹•ãŒè¨å®šã•ã‚Œã¦ã„ã‚‹å€¤ã‚‚ã‚ã‚Šã¾ã™ã€‚ target="_blank" ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ ãƒªãƒ³ã‚¯ã®é–‹ãæ–¹ã‚’æ±ºå®šã™ã‚‹targetè¦ç´ ã§ã™ãŒã€ã“ã®æŒ™å‹•ã‚’åˆ©ç”¨ã—ã¦ãƒªãƒ³ã‚¯å…ˆã‹ã‚‰ãƒªãƒ³ã‚¯å…ƒã®ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’æ“ä½œã§ãã‚‹ã¨ã„ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ Target="_blank" - the most underestimated vulner
sutara_lumpur 2017/03/17
ã•ã£ããå¯¾ç–ã—ã¾ã™ m(_ _)m

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
reCAPTCHA: Easy on Humans, Hard on Bots
reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website. Meanwhile, legitimate users will be able to login, make purchases, view pages, or create accounts and fake users will be blocked.
sutara_lumpur 2016/08/26
ãƒœãƒƒãƒˆã§ã¯ãªã„ã“ã¨ã‚’ãƒã‚§ãƒƒã‚¯ãƒœãƒƒã‚¯ã‚¹ã§ç¢ºèªã™ã‚‹ã€‚

security
ãƒªãƒ³ã‚¯
Let's Encrypt ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã®å–å¾—ã¨è‡ªå‹•æ›´æ–°è¨å®šãƒ¡ãƒ¢
ç”¨é€”ã«ã‚‚ã‚ˆã‚Šã¾ã™ãŒã€é€šä¿¡ã®æš—å·åŒ–ã‚’ç›®çš„ã¨ã™ã‚‹ã®ã§ã‚ã‚Œã°ã€ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼åž‹ã§ååˆ†ã§ã™ã€‚ä¾‹ãˆã° HTTP/2 ã§WEBã‚µãƒ¼ãƒã‚’å‹•ã‹ã™ã«ã¯ã€äº‹å®Ÿä¸ŠSSL/TLSãŒå¿…é ˆã«ãªã‚Šã¾ã™ã®ã§ã€ãã†ã„ã£ãŸç”¨é€”ã§ã‚‚æ™®åŠã—ãã†ã§ã™ãã€‚ Let's Encrypt ã®è¨¼æ˜Žæ›¸å–å¾—æ–¹æ³• Let's Encrypt ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚½ãƒ•ãƒˆ(ã‚³ãƒžãƒ³ãƒ‰)ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ã€è¨¼æ˜Žæ›¸å–å¾—ç”¨ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’æ‰“ã¤ã ã‘ã§ã™ã€‚ å†’é ã«ã‚‚æ›¸ãã¾ã—ãŸãŒã€Let's Encrypt ã§ã®è¨¼æ˜Žæ›¸å–å¾—ã®æ‰‹ç¶šãã¯ã€ä»–ã®èªè¨¼å±€ã®ã‚‚ã®ã¨å¤§ããç•°ãªã‚Šã¾ã™ã€‚Let's Encrypt ã®ã‚µã‚¤ãƒˆã«è¡Œã£ã¦ã€ŒCSRã‚’é€ä¿¡ã™ã‚‹ç”³è«‹ãƒ•ã‚©ãƒ¼ãƒ ã¯ã©ã“ã ã‚ã†ï¼Ÿã€ã¨æŽ¢ã—ãŸã®ã¯ã€ç§ã ã‘ã§ã¯ãªã„ã¯ãšã§ã™(^^;) å‚è€ƒã¾ã§ã«ã€ä¸€èˆ¬çš„ãªãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼åž‹ã®è¨¼æ˜Žæ›¸ç™ºè¡Œã®æµã‚Œã¯ã€ä»¥ä¸‹ã®é€šã‚Šã§ã™ã€‚ (1) ç§˜å¯†éµã‚’ä½œæˆ (2) ç§˜å¯†éµã‚’å…ƒã«ã€CSRï¼ˆè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹ãŸã‚ã®ç½²åè¦æ±‚ï¼‰ã‚’ç”Ÿæˆ (3)
sutara_lumpur 2016/07/12
ssl

security

web
ãƒªãƒ³ã‚¯
Let's Encrypt
A nonprofit Certificate Authority providing TLS certificates to 450 million websites. Read all about our nonprofit work this year in our 2023 Annual Report. From our blog Jul 23, 2024 Intent to End OCSP Service Moving to a more privacy-respecting and efficient method of checking certificate revocation. Read more Jun 24, 2024 More Memory Safety for Letâ€™s Encrypt: Deploying ntpd-rs NTP is critical t
sutara_lumpur 2016/07/12
ssl

https

Web

security
ãƒªãƒ³ã‚¯
SRI ã‚’ãƒ“ãƒ«ãƒ‰ãƒ—ãƒã‚»ã‚¹ã¸çµ„ã¿ã“ã‚‚ã†
ã“ã®è¨˜äº‹ã¯ â€œHow to implement SRI in your build processâ€ ã®æŠ„è¨³ã§ã™ã€‚ é¡§å®¢ã‹ã‚‰ã€ŒãŠãŸãã®ã‚µã‚¤ãƒˆãŒãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚’é…å¸ƒã—ã¦ã„ã‚‹ã€ã¨ã®é€£çµ¡ãŒã‚ã£ãŸå ´åˆã‚’æƒ³åƒã—ã¦ã¿ã¦ãã ã•ã„ã€‚å¿ƒè‡“ã¯æ¢ã¾ã‚Šã€å†·æ±—ã‚’ã‹ãã€Tweet ãŒæº¢ã‚Œå§‹ã‚ã‚‹ã§ã—ã‚‡ã†ã€‚ ã€Œã‚ã‚Œï¼ŸãŠã‹ã—ã„ãžã€ ã‚·ã‚¹ãƒ†ãƒ ã¯æ±šæŸ“ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚ å®Ÿéš›ã«ãƒãƒƒã‚ãƒ³ã‚°ã•ã‚ŒãŸã®ã¯Web ã‚µã‚¤ãƒˆã§åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’é…å¸ƒã—ã¦ã„ã‚‹ CDN ã®ãƒ—ãƒãƒã‚¤ãƒ€ã§ã€ãã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒžãƒ«ã‚¦ã‚§ã‚¢åŒ–ã—ã¦ã„ãŸã®ã§ã—ãŸã€‚ãã“ã§é¡§å®¢ã«äº‹å®Ÿã‚’å ±å‘Šã—ã¾ã—ãŸãŒã€å½¼ã‚‰ã¯æ°—ã«ã—ã¾ã›ã‚“ã€‚è£½å“ã®å®‰å…¨æ€§ã¨ã€é¡§å®¢ã‹ã‚‰ã®ä¿¡é ¼ã¯å¤±ã‚ã‚Œã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã“ã‚ŒãŒ 2 å¹´å‰ã«èµ·ããŸã¨ã—ãŸã‚‰ã€ ã€Œæ°—ã®æ¯’ãªã“ã¨ã ã£ãŸãã€ ã¨è¨€ã£ãŸã§ã—ã‚‡ã†ã€‚ã—ã‹ã—ä»Šãªã‚‰ã“ã†è¨€ã†ã§ã—ã‚‡ã†ï¼š ã€ŒSRI ã‚’ä½¿ã†ã¹ãã ã€ Subresource Integrity (SRI) ã¯æ¯”è¼ƒçš„æ–°ã—ã„
sutara_lumpur 2016/06/22
web

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

SRI
ãƒªãƒ³ã‚¯
èªè¨¼ãƒ—ãƒãƒˆã‚³ãƒ«ã€ŒMS-CHAP v2ã€ã®è„†å¼±æ€§ã«ç›¸æ¬¡ãŽæ³¨æ„å–šèµ· ï¼ ï¼ IT
2012/08/23 PPTPã§ã®VPNæŽ¥ç¶šãªã©ã«åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆã®èªè¨¼ãƒ—ãƒãƒˆã‚³ãƒ«ã€ŒMS-CHAP v2ã€ã«ã€æƒ…å ±æ¼ãˆã„ã«ã¤ãªãŒã‚‹æã‚ŒãŒã‚ã‚‹è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã€‚æ—¥æœ¬ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãŒã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã‚’å…¬é–‹ã—ãŸã»ã‹ã€JPCERTã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆJPCERT/CCï¼‰ãªã©ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿé–¢ãŒæ³¨æ„ã‚’å‘¼ã³æŽ›ã‘ã¦ã„ã‚‹ã€‚ ã“ã®å•é¡Œã¯ã€MS-CHAP v2ã‚’å˜ä½“ã§åˆ©ç”¨ã—ã¦ã€PPTPãƒ™ãƒ¼ã‚¹ã®VPNæŽ¥ç¶šã‚’è¡Œã£ã¦ã„ã‚‹å ´åˆã«ç”Ÿã˜ã‚‹ã€‚æ‚ªæ„ã‚ã‚‹ç¬¬ä¸‰è€…ãŒä¸é–“è€…æ”»æ’ƒã‚„ç„¡ç·šé€šä¿¡ã‚’ç›—è´ã™ã‚‹ã“ã¨ã§èªè¨¼ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’å–å¾—ã—ã€èªè¨¼ã«é–¢ã™ã‚‹æƒ…å ±ï¼ˆãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ï¼‰ã‚’çªƒå–ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ã“ã†ã—ã¦ç›—ã¾ã‚ŒãŸèªè¨¼æƒ…å ±ãŒæ‚ªç”¨ã•ã‚Œã‚Œã°ã€ãªã‚Šã™ã¾ã—ã‚„ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã¤ãªãŒã‚‹æã‚Œã‚‚ã‚ã‚‹ã€‚ã™ã§ã«ã€ã“ã®æ”»æ’ƒã‚’è¡Œã†ãŸã‚ã®ãƒ„ãƒ¼ãƒ«ã‚‚å…¬é–‹æ¸ˆã¿ã ã€‚ æ—¥æœ¬ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆã¯ã“ã®çŠ¶æ³ã‚’å—ã‘ã€8æœˆ21æ—¥ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã‚’å…¬é–‹ã—ãŸã€‚ä¸Šè¨˜ã«è©²å½“ã™ã‚‹ç’°
sutara_lumpur 2015/11/02
security

pptp

VPN
ãƒªãƒ³ã‚¯
MS-CHAPv2ãƒ—ãƒãƒˆã‚³ãƒ«ã®ç ´ç¶» | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒ©ãƒƒã‚¯
2012å¹´8æœˆ31æ—¥ æ”¹è¨‚ æœ¬ä»¶ã«ã¤ãã¾ã—ã¦ã¯ã€7æœˆ29æ—¥ã”ã‚ã«å•é¡ŒãŒå…¬è¡¨ã•ã‚Œã¦ã‹ã‚‰8æœˆ20æ—¥å‰å¾Œã¾ã§ã€ãƒ¡ãƒ¼ã‚«ãƒ¼ã‚„å…¬çš„æ©Ÿé–¢ç‰ã‹ã‚‰ã®è©³ç´°ãªæƒ…å ±æä¾›ãŒã‚ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚å¼Šç¤¾ã¨ã—ã¦ã¯ã€æ—©æœŸã®å‘ŠçŸ¥ã‚’å„ªå…ˆã—ã€ã¾ãšã¯æ˜Žã‚‰ã‹ã«ãªã£ã¦ã„ã‚‹æƒ…å ±ã‚’å ±å‘Šã•ã›ã¦ã„ãŸã ã„ãŸãŸã‚ã€åˆç‰ˆã®ãƒªãƒªãƒ¼ã‚¹æ™‚ã«ã¯è„†å¼±æ€§ã®å½±éŸ¿ç¯„å›²ã«ã¤ã„ã¦éŽå¤§ãªè©•ä¾¡ã¨ãªã‚‹è¨˜è¿°ã¨ãªã£ã¦ãŠã‚Šã¾ã—ãŸã€‚ ä¸€éƒ¨ã®ãŠå®¢æ§˜ã€ãŠã‚ˆã³é–¢ä¿‚è€…ã®æ–¹ã€…ã‚ˆã‚Šã”æŒ‡æ‘˜ã‚’ã„ãŸã ãã€ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã—ãŸã“ã¨ã‚’ãŠè©«ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ãƒ¡ãƒ¼ã‚«ãƒ¼ã‹ã‚‰ã®ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã‚„è¿½åŠ æƒ…å ±ã‚’ã‚‚ã¨ã«è¨˜è¼‰å†…å®¹ã‚’è¦‹ç›´ã—ã¾ã—ãŸãŸã‚ã€ä»¥ä¸‹ã®é€šã‚Šæ”¹è¨‚ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ æš—å·åŒ–é€šä¿¡ï¼ˆVPNï¼‰ã‚„ç„¡ç·šLANï¼ˆWPA2ï¼‰ã®èªè¨¼ã¨ã—ã¦ã€ä¸€èˆ¬ä¼æ¥ã§åºƒãä½¿ã‚ã‚Œã¦ã„ã‚‹MS-CHAPv2ï¼ˆMicrosoft CHAP version 2ï¼‰ã¨ã„ã†ãƒ—ãƒãƒˆã‚³ãƒ«ã«ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒå®Œå…¨ã«è§£èªã•ã‚Œã¦ã—ã¾ã†ã¨ã„ã†è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚Œã€å…¬è¡¨ã•ã‚Œã¾ã—ãŸã€‚ ãã®
sutara_lumpur 2015/11/02
VPN

pptp

security
ãƒªãƒ³ã‚¯
yohgaki's blog - ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«JavaScriptã‚’éš ã™
(Last Updated On: 2014å¹´12æœˆ5æ—¥)å‰å›žã®ã‚¨ãƒ³ãƒˆãƒªã§ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚“ã§æ”»æ’ƒã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦è¨˜è¼‰ã—ã¾ã—ãŸãŒã€æœ€è¿‘ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚€äº‹ä¾‹ãŒè©±é¡Œã«ãªã£ãŸãŸã‚ã‹ ha.ckersã«JavaScriptã‚’ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã«éš ã™æ–¹æ³•ãŒç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ http://ha.ckers.org/blog/20070623/hiding-js-in-valid-images/ <script src="http://cracked.example.com/cracked.gif"> ãªã©ã¨XSSæ”»æ’ƒã‚’æ‹¡å¼µã™ã‚‹æ‰‹æ®µã«åˆ©ç”¨å¯èƒ½ã§ã™ã€‚ã‚µãƒ³ãƒ—ãƒ«ã¨ã—ã¦Flickerã«JavaScriptã‚’åŸ‹ã‚è¾¼ã‚“ã ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚¢ãƒƒãƒ—ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã®ã‚¤ãƒ¡ãƒ¼ã‚¸ãƒ•ã‚¡ã‚¤ãƒ«ã¯ä¸Šæ‰‹ãç´°å·¥ã—ã¦ã„ã‚‹ã®ã§ç”»åƒã¨ã—ã¦ã‚‚è¡¨ç¤ºã•ã‚Œã€JavaScriptã‚‚å®Ÿè¡Œã§ãã¾ã™ã€‚ Flicke
sutara_lumpur 2015/09/09
security
ãƒªãƒ³ã‚¯
ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼åˆ¶åº¦é–‹å§‹ã‚’é–“è¿‘ã«æŽ§ãˆã¦ãƒˆãƒ³ãƒ‡ãƒ¢æ¡ˆä»¶ã‚‚æº–å‚™ãŒé€²ã‚“ã§ã„ã‚‹ã‚ˆã†ã§ã™(å±±æœ¬ä¸€éƒŽ) - å€‹äºº - Yahoo!ãƒ‹ãƒ¥ãƒ¼ã‚¹
sutara_lumpur 2015/06/19
security
ãƒªãƒ³ã‚¯
Time-based SQL Injectionã¯æ„å¤–ã«å®Ÿç”¨çš„ã ã£ãŸ
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€Time-based SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã™ãªã‚ã¡æ™‚é–“å·®ã‚’åˆ©ç”¨ã—ãŸSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒæ„å¤–ã«å®Ÿç”¨çš„ã ã£ãŸã¨ã„ã†å ±å‘Šã‚’ã—ã¾ã™ã€‚ãƒ‡ãƒ¢æ˜ åƒã‚ã‚Šã§ã™ã€‚ ã¯ã˜ã‚ã« Time-based SQL Injectionã¨ã„ã†æ”»æ’ƒãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ãƒ–ãƒ©ã‚¤ãƒ³ãƒ‰SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®ä¸€ç¨®ã§ã€ã‚ã‚‹æ¡ä»¶ã®å ´åˆã«ä¸€å®šæ™‚é–“ï¼ˆä¾‹ãˆã°5ç§’ï¼‰ã‚¹ãƒªãƒ¼ãƒ—ã—ã€ãã†ã§ãªã„æ™‚ã¨ã®å¿œç”æ™‚é–“ã®å·®ã§æƒ…å ±ã‚’ç›—ã‚‚ã†ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚1å›žã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã§1ãƒ“ãƒƒãƒˆã®æƒ…å ±ãŒå¾—ã‚‰ã‚Œã‚‹ã®ã§ã€ãã‚Œã‚’ç©ã¿é‡ãã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€ã„ãã‚‰ã§ã‚‚æƒ…å ±ã‚’ç›—ã‚ã‚‹ã¯ãšã§ã™â€¦ç†è«–çš„ã«ã¯ã€‚ ã—ã‹ã—ã€ã€Œç†å±ˆã¯ãã†ã§ã‚‚ã€æ™‚é–“ãŒæŽ›ã‹ã‚Šã™ãŽã‚‹ã‚ˆãã€ã¨ã„ã†ã“ã¨ã§ã€æ·±ãã¯è¿½ã£ã‹ã‘ã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®æ¤œæŸ»ã«ã¯æœ‰åŠ¹ã§ã‚‚ã€æ‚ªç”¨ã¨ã—ã¦ã®å®Ÿç”¨æ€§ã¯ã‚ã¾ã‚Šãªã„ã¨è€ƒãˆã¦ã„ãŸã®ã§ã™ã€‚ ãã£ã‹ã‘ ãã£ã‹ã‘ã¯ã€ä»¥ä¸‹ã®Yahoo!çŸ¥æµè¢‹ã«ä»¥ä¸‹ã®è³ªå•ã§ã™ã€‚ SQL
sutara_lumpur 2015/04/17
security
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ï¼ã‚‚ã£ã¨å¼·ãã‚ãƒŸã‚’å®ˆã‚ŠãŸã„ï¼ ï¼š IPAæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
å‡ºå±•ä¸ã®ã€Œãƒžãƒ³ã‚¬ãƒã‚¹ã‚¿ãƒ¼ã€ã‚’ã‚¹ãƒ©ã‚¤ãƒ‰ã§ã”è¦§ã„ãŸã ã‘ã¾ã™ã€‚ å·¦å³ã®ã€Œï¼œï¼žã€ãƒžãƒ¼ã‚¯ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã”è¦§ãã ã•ã„ã€‚
sutara_lumpur 2015/04/03
é–¢ä¿‚ãªã„ã‘ã©ã€jQueryãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã®bxsliderä½¿ã£ã¦ã‚‹ã®ãã€‚ç§ã‚‚æ„›ç”¨ã—ã¦ã¾ã™ (*Â´âˆ€ï½€*)

ãƒã‚¿

security
ãƒªãƒ³ã‚¯
è¿·æƒ‘ãƒ¡ãƒ¼ãƒ«ã®é€±æŽ¨ç§» - BUNTENã®ãƒ˜ã‚¿ãƒ¬æ—¥è¨˜(ã¯ã¦ãªblogç‰ˆ)
æ—¥ç¥æ—¥ã¯è¿·æƒ‘ãƒ¡ãƒ¼ãƒ«ãŒç›®ç«‹ã£ã¦æ¸›ã‚‹ã‚ˆã†ãªæ°—ãŒã™ã‚‹ã®ã§ã€è¿·æƒ‘ãƒ¡ãƒ¼ãƒ«ã®è¸ã¿å°ã«ã•ã‚Œã¦ã„ã‚‹ã€ä¼‘æ—¥ã¯ã‚·ãƒ£ãƒƒãƒˆãƒ€ã‚¦ãƒ³ã•ã‚Œã‚‹æ¥å‹™ç”¨PCãŒå¤šã„ã‚“ã ã‚ã†ãªãã€‚(ã£ã¦ã©ã£ã‹ã«æ›¸ã„ãŸè¨˜æ†¶ã‚‚ã‚ã‚‹ãŒç„¡è¦–ã€‚)
sutara_lumpur 2015/03/24
ãªã‚‹ã»ã©ã€ãã†ã ã£ãŸã®ã‹ã€‚

security
ãƒªãƒ³ã‚¯
VirusTotal
sutara_lumpur 2015/03/08
#ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã“ã‚“ãªã‚µãƒ¼ãƒ“ã‚¹ãŒã‚ã£ãŸã¨ã¯ âˆ‘(Â°Ð´Â°)

security
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ã®æ¤œæŸ»å¯¾è±¡ã‚’ã©ã†çµžã‚Šè¾¼ã‚ã°ã‚ˆã„ã‹
ã‚½ãƒ‹ãƒ¼DNAã•ã‚“ã®ã€Žå…¥é–€ï¼åŸºç¤Žã‹ã‚‰ã‚ã‹ã‚‹ã€Œå¤±æ•—ã—ãªã„Webè¨ºæ–æ¥è€…ã®é¸ã³æ–¹ã€ã€ã¨ã„ã†ãƒ–ãƒã‚°è¨˜äº‹ã‚’èªã¿ã¾ã—ãŸã€‚ å…¨ä½“çš„ã«ç©å½“ãªå†…å®¹ã§ç•°è«–ã¯ãªã„ã®ã§ã™ãŒã€èˆˆå‘³æ·±ã„å†…å®¹ãªã®ã§ã€å±‹ä¸Šå±‹ã‚’æž¶ã™ã‚ˆã†ã§ã™ãŒå°‘ã—è¿½åŠ ã—ã¦è€ƒãˆã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ç§ãŒç‰¹ã«æ³¨ç›®ã—ãŸã®ã¯ä»¥ä¸‹ã®ç®‡æ‰€ã§ã™ã€‚ 2. æ¤œæŸ»å¯¾è±¡ã‚’é©åˆ‡ã«çµžã‚Œã‚‹ã‹ï¼Ÿ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’ãã¾ãªãå®Ÿæ–½ã§ãã‚Œã°å®‰å¿ƒã§ã™ãŒã€ãã‚Œã¯å¤§ããªè²»ç”¨ãŒã‹ã‹ã‚Šç¾å®Ÿçš„ã§ã¯ãªã„ã¨ã„ã†ã‚±ãƒ¼ã‚¹ã‚‚å¤šã„ã§ã—ã‚‡ã†ã€‚ãã®ãŸã‚ã€Webè¨ºæ–ã§ã¯æ¤œæŸ»å¯¾è±¡ã‚’é©åˆ‡ã«çµžã‚Šè¾¼ã‚€ã“ã¨ãŒå¿…è¦ã§ã™ã€‚ãƒã‚°ã‚¤ãƒ³ç”»é¢ã‚„èª²é‡‘æ©Ÿèƒ½ã€å€‹äººæƒ…å ±ç®¡ç†æ©Ÿèƒ½ãªã©ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ãŒç‰¹ã«æ±‚ã‚ã‚‰ã‚Œã‚‹æ©Ÿèƒ½ã‚’é‡ç‚¹çš„ã«æ¤œæŸ»ã™ã‚‹ã«ã¯ã€æ¤œæŸ»å¯¾è±¡ã‚’æ˜Žç¢ºã«ã™ã‚‹ã“ã¨ãŒé‡è¦ã«ãªã‚Šã¾ã™ã€‚ ä¸Šè¨˜ã®è€ƒãˆæ–¹ã¯ã€è„†å¼±æ€§è¨ºæ–ã®ç¾å ´ã§ã‚ˆãè¡Œã‚ã‚Œã¦ã„ã‚‹ã‚‚ã®ã§ã€ç†è€…ã‚‚ã“ã‚Œã«å¾“ã†ã“ã¨ã¯å¤šã„ã®ã§ã™ãŒã€æ¤œæŸ»å¯¾è±¡ã®é¸å®šã¯é‡è¦ãªã®ã§ã‚‚ã†å°‘ã—æŽ˜ã‚Šä¸‹ã’ã¦è€ƒãˆã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ è„†å¼±
sutara_lumpur 2015/03/03
security
ãƒªãƒ³ã‚¯
CSSã®éžè¡¨ç¤º(display:none)ã‚’ä½¿ã£ãŸåºƒå‘Šã®åˆ‡ã‚Šæ›¿ãˆã«ã¤ã„ã¦ - Google ã‚°ãƒ«ãƒ¼ãƒ—
sutara_lumpur 2015/02/21
chrome

security
ãƒªãƒ³ã‚¯
ä»Šæ—¥ã¯æ¯Žæœˆæ’ä¾‹ã€ŒWindows Updateã€ã®æ—¥ã€å…¨éƒ¨ã§9ä»¶
By ï½ï½…ï½’ï½ ä»Šæœˆã‚‚æ¯Žæœˆæ›´æ–°ã•ã‚Œã‚‹Windowsã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ›´æ–°ã‚„ãƒã‚°ä¿®æ£ãŒé…ä¿¡ã•ã‚Œã‚‹Windows Updateã®æ—¥ãŒã‚„ã£ã¦ãã¾ã—ãŸã€‚ä»Šæœˆã¯ã€Œç·Šæ€¥ã€ãŒ3ä»¶ã€ã€Œé‡è¦ã€ãŒ6ä»¶ã®åˆè¨ˆ9ä»¶ã¨ãªã£ã¦ã„ã¾ã™ã€‚æ—©ã‚ã«ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã—ã¦ãŠãã¾ã—ã‚‡ã†ã€‚ 2015 å¹´ 2 æœˆã®ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±ã®æ¦‚è¦ https://tech net.microsoft.com/ja-jp/library/security/ms15-Feb ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± MS15-009 - ç·Šæ€¥ Internet Explorer ç”¨ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ (3034682) æœ€å¤§æ·±åˆ»åº¦ãŠã‚ˆã³è„†å¼±æ€§ã®å½±éŸ¿ ç·Šæ€¥ ãƒªãƒ¢ãƒ¼ãƒˆã§ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹ å†èµ·å‹•ã®å¿…è¦æ€§ è¦å†èµ·å‹• å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ Microsoft Windowsã€Internet Explorer ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±
sutara_lumpur 2015/02/11
windows

security
ãƒªãƒ³ã‚¯
GHOSTè„†å¼±æ€§ã‚’ç”¨ã„ã¦PHPã‚’ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã§ãã‚‹ã“ã¨ã‚’ç¢ºèªã—ãŸ
GHOSTè„†å¼±æ€§ã«ã¤ã„ã¦ã€ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¨ã—ã¦EximãŒçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€PHPã«ã‚‚gethostbynameã¨ã„ã†é–¢æ•°ãŒã‚ã‚Šã€libcã®gethostbynameé–¢æ•°ã‚’ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿æœªãƒã‚§ãƒƒã‚¯ã®ã¾ã¾å‘¼ã‚“ã§ã„ã¾ã™ã€‚ãã“ã§ã€PHPã®gethostbynameã‚’ç”¨ã„ã‚‹ã“ã¨ã§PHPã‚’ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã§ãã‚‹å ´åˆãŒã‚ã‚‹ã®ã§ã¯ãªã„ã‹ã¨è€ƒãˆã¾ã—ãŸã€‚ è©¦è¡ŒéŒ¯èª¤çš„ã«èª¿ã¹ãŸçµæžœã€ä»¥ä¸‹ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã§PHPã‚’ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã§ãã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¦ã„ã¾ã™ã€‚CentOS6(32bit/64bitã¨ã‚‚)ã€Ubuntu12.04LTS(32bit/64bitã¨ã‚‚)ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã¨ã—ã¦å°Žå…¥ã—ãŸPHPã«ã¦ç¢ºèªã—ã¾ã—ãŸãŒã€phpallã§ç¢ºèªã—ãŸé™ã‚ŠPHP 4.0.2ä»¥é™ã®ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®PHPã§å†ç¾ã™ã‚‹ã‚ˆã†ã§ã™ã€‚ãªãœã‹PHP 4.0.0ã¨4.0.1ã§ã¯å†ç¾ã—ã¾ã›ã‚“ã§ã—ãŸã€‚ <?php gethostbyname(str_
sutara_lumpur 2015/02/10
php

security
ãƒªãƒ³ã‚¯
1 2 3 æ¬¡ã®ãƒšãƒ¼ã‚¸