[B! proxy] tecklã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

teckl id:teckl

proxyã«é–¢ã™ã‚‹tecklã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OWASP Zed Attack Proxy (ZAP)ã¨ã¯ï¼Ÿ
Software WebSecurity OWASP Zed Attack Proxy (ZAP)ã¨ã¯ï¼Ÿâ€»å½“ã‚µã‚¤ãƒˆã«ã¯ãƒ—ãƒãƒ¢ãƒ¼ã‚·ãƒ§ãƒ³ãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ æ¦‚è¦OWASP Zed Attack Proxy (ZAP)ã®å…¬å¼ã‚µã‚¤ãƒˆã«ã‚ˆã‚‹ã¨ä»¥ä¸‹ã®ã‚ˆã†ã«èª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™(ç¿»è¨³ã—ã¦ã¿ã¾ã—ãŸ)ã€‚ The Zed Attack Proxy (ZAP)ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’è¦‹ä»˜ã‘ã‚‹ãŸã‚ã®ç°¡å˜ã«ä½¿ãˆã‚‹çµ±åˆãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ãƒˆãƒ„ãƒ¼ãƒ«ã§ã™ã€‚å¹…åºƒã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®çµŒé¨“ã‚’æŒã£ãŸäººã€…ã«ä½¿ã£ã¦è²°ãˆã‚‹ã‚ˆã†ã«ãƒ‡ã‚¶ã‚¤ãƒ³ã•ã‚Œã¦ãŠã‚Šã€ã¾ãŸãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ãƒˆã‚’ã—ãŸã“ã¨ãŒãªã„é–‹ç™ºè€…ã‚„æ©Ÿèƒ½ãƒ†ã‚¹ã‚¿ãƒ¼ã«ã¨ã£ã¦ã‚‚ç†æƒ³çš„ãªã‚‚ã®ã«ãªã£ã¦ã„ã¾ã™ã€‚ ZAPã¯æ‰‹å‹•ã§è„†å¼±æ€§ã‚’è¦‹ä»˜ã‘ã‚‹ã“ã¨ãŒã§ãã‚‹ãƒ„ãƒ¼ãƒ«ç¾¤ã¯ã‚‚ã¡ã‚ã‚“ã®ã“ã¨ã€è‡ªå‹•ã‚¹ã‚ãƒ£ãƒŠãƒ¼ã‚‚æä¾›ã—ã¾ã™ã€‚ OWASP Zed Attack Proxy Project åŸºæœ¬çš„ãªæƒ…å ±OWASP ã®
teckl 2015/01/15
æ€¥ã„ã§ã„ãŸã®ã§æ—¥æœ¬èªžã§ã™ã”ã„åˆ†ã‹ã‚Šã‚„ã™ã„ã€‚ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™

owasp

proxy

security
ãƒªãƒ³ã‚¯
Proxy War
7. é€šå¸¸ã®Webã‚µãƒ¼ãƒã¨ã®é€šä¿¡ <html> <body> æ°å:vultest<BR> ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹:vulte [email protected]<BR> æ€§åˆ¥:ç”·<BR> <form action=â€œregisterâ€ method=â€œPOSTâ€> ï¼ˆä»¥ä¸‹ç•¥ï¼‰ </html> POST /confirm.php HTTP/1.1 Host: example.jp ï¼ˆä»¥ä¸‹ç•¥ï¼‰ name=vultest&mail=vultest%40example.jp&gender=1 HTTP Response HTTP Request 8. å€¤ã‚’å¤‰æ›´ã—ãŸå ´åˆã®å¿œç”çµæžœã‚’ç¢ºèª POST /confirm.php HTTP/1.1 Host: example.jp ï¼ˆä»¥ä¸‹ç•¥ï¼‰ name=vultest&mail=vultest%40example.jpâ€>xss&gender=1 <html> <body>
teckl 2015/01/15
ã“ã‚Œã¯è‰¯ã„ã¾ã¨ã‚ã€‚Fiddler, BurpSuite, OWASP ZAPã®ç‰¹å¾´ã«ã¤ã„ã¦

proxy

security

owasp
ãƒªãƒ³ã‚¯
Apacheã§reverse proxyã™ã‚‹ã¨ãã«ã€å—ã‘ã®ãƒ‘ã‚¹ã«å¿œã˜ã¦ç•°ãªã‚‹ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆå€¤ã‚’è¨å®šã™ã‚‹æ–¹æ³• - ï¼ˆã²ï¼‰ãƒ¡ãƒ¢
Apacheã§reverse proxyã™ã‚‹ã¨ãã«ã€ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã¯åŒã˜ãªã‚“ã ã‘ã©å—ã‘ã‚‹ãƒ‘ã‚¹ã«å¿œã˜ã¦åˆ¥ãªã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆå€¤ã‚’è¨å®šã—ã‚ˆã†ã¨ã—ã¦ãƒãƒžã£ãŸã®ã§ãã®ãƒ¡ãƒ¢ã§ã™ã€‚ ä»¥ä¸‹ã€Apache 2.2.22 ã§ã®ãŠè©±ã§ã™ã€‚2.4ã§ã©ã†ãªã£ã¦ã‚‹ã‹ã€ã©ãªãŸã‹ã”å˜çŸ¥ã§ã—ãŸã‚‰æ•™ãˆã¦ãã ã•ã„ï¼žï¼œ ã¾ãšæ€ã„ã¤ãã®ã¯ã“ã‚“ãªè¨å®šã ã¨æ€ã„ã¾ã™ã€‚ ProxyTimeout 7 ProxyPass /3sec/ http://127.0.0.1:9999/ timeout=3 ProxyPass /5sec/ http://127.0.0.1:9999/ timeout=5ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ (127.0.0.1:9999) ã¯ã€ã“ã‚“ãªã®ã‚’å‹•ã‹ã—ã¦ãŠã‘ã°ååˆ†ã§ã™ã€‚ $ while true; do echo listen...; nc -l 9999; doneã“ã‚Œã§ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã§ã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ã¿ã‚‹ã¨â€¦ $ time curl h
teckl 2013/06/13
proxy

apache

timeout
ãƒªãƒ³ã‚¯
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’éŽæ¿€ã«åŠ é€Ÿã™ã‚‹ã‚¢ãƒ—ãƒªdolipoã®ç¨®æ˜Žã‹ã—âˆ’ ï¼ IT
Webãƒ–ãƒ©ã‚¦ã‚¸ãƒ³ã‚°ã§ã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’å‘ä¸Šã™ã‚‹ãƒ—ãƒã‚ã‚·ã‚½ãƒ•ãƒˆã€Œdolipoã€ã€‚ä½¿ã„æ–¹ã¨ã¨ã‚‚ã«ã€é«˜é€ŸåŒ–ã®ä»•çµ„ã¿ã‚’è§£èª¬ã™ã‚‹ å°‘ã—ã§ã‚‚ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚’é«˜é€ŸåŒ–ã—ãŸã„ãƒ¨ãƒ¼ãƒãƒƒãƒ‘åœã‹ã‚‰å¦ã¶ ã“ã‚“ã«ã¡ã¯ã€dolipoã‚’é–‹ç™ºã—ãŸdrikinã§ã™ã€‚dolipoã®ç€çœ¼ç‚¹ã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®æŠ€è¡“çš„ãªå´é¢ã ã‘ã§ãªãã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®é–‹ç™ºæ™‚ã«æ‚©ã‚€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯é€Ÿåº¦ã®å•é¡Œã«å¯¾ã—ã¦ã‚‚ã€é¢ç™½ã„ã‚¢ãƒ—ãƒãƒ¼ãƒã«ãªã£ã¦ã„ã¾ã™ã€‚ åƒ•ã®ã“ã®æŠ€è¡“ã¨ã®å‡ºåˆã„ã¯å¶ç„¶ã§ã—ãŸã€‚dolipoã®å…ƒã¨ãªã£ãŸPolipoã®ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ç™ºè¦‹ã—ãŸã¨ããã®åŠ¹æžœã«æ„Ÿå‹•ã—ã€ä½•ã¨ã‹ã“ã®ç´ æ™´ã‚‰ã—ã•ã‚’ã‚ˆã‚Šç°¡å˜ã«ã‚‚ã£ã¨å¤šãã®äººã«ä¼ãˆãŸã„ã¨æ€ã„dolipoã‚’ä½œã‚Šã¾ã—ãŸã€‚ æ—¥æœ¬ã§ã¯ã€å…‰ãƒ•ã‚¡ã‚¤ãƒãªã©ã®é«˜é€Ÿå›žç·šã®æ™®åŠåº¦ãŒé«˜ãã€ã‚µãƒ¼ãƒ“ã‚¹ã®å“è³ªã‚‚é«˜ã„ãŸã‚ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚µãƒ¼ãƒ“ã‚¹ã‚’é–‹ç™ºã™ã‚‹éš›ã«ã‚‚ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®ã‚¹ãƒ”ãƒ¼ãƒ‰è‡ªä½“ã¯ã»ã¨ã‚“ã©å•é¡Œã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã„ã‹ã«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚„
teckl 2008/08/20
ãŸã‚ã—ã¦ã¿ã‚‹

dolipo

proxy

mac

osx
ãƒªãƒ³ã‚¯
1