[B! security] tom__boã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tom__bo id:tom__bo

securityã«é–¢ã™ã‚‹tom__boã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚·ã‚¹ãƒ†ãƒ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«å¯¾ã™ã‚‹æ”»æ’ƒã®æ´å²ã¨å‚¾å‘ - é«˜åº¦æ¨™çš„åž‹æ”»æ’ƒã‚„å›½å®¶ã«æ”¯æ´ã•ã‚ŒãŸæ”»æ’ƒã®ä»•çµ„ã¿ - - ã‚‹ãã™ã®æ—¥è¨˜ ~ Out_Of_Range ~
A History of system-level offensive security researches: How is your system compromised by nation state hacking, APT attack ã¯ã˜ã‚ã« ä¼æ¥ã‚„å€‹äººã«å¯¾ã™ã‚‹ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã®é »åº¦ã¯å¹´ã€…å¢—åŠ ã®ä¸€é€”ã‚’è¾¿ã£ã¦ã„ã‚‹ãŒã€ã“ã‚Œã‚‰ã¯skiddyã«ã‚ˆã‚‹æ‚ªæˆ¯ç¨‹åº¦ã®ç‰©ã‹ã‚‰ã€ä¼æ¥ã‚’æ¨™çš„ã¨ã—ãŸé«˜åº¦ãªæ¨™çš„åž‹æ”»æ’ƒã€ã‚ã‚‹ã„ã¯æ”¿åºœã«ã‚ˆã‚‹è«œå ±æ´»å‹•ã«è‡³ã‚‹ã¾ã§å¤šå²ã«ã‚ãŸã£ã¦ã„ã‚‹ã€‚ ç‰¹ã«å¤§è¦æ¨¡ãªçµ„ç¹”ã‚„æ”¿åºœã«ã‚ˆã‚‹ç¶¿å¯†ã«ç·´ã‚‰ã‚ŒãŸã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã¯ã€ç¢ºå®Ÿã«ç›®çš„ã‚’æžœãŸã™ãŸã‚ã«é«˜åº¦ãªæ‰‹æ®µãŒè¬›ã˜ã‚‰ã‚Œã‚‹äº‹ãŒå¤šã„ã€‚ æœ¬è¨˜äº‹ã§ã¯é«˜åº¦æ¨™çš„åž‹æ”»æ’ƒã‚„æ”¿åºœã«ã‚ˆã‚‹è«œå ±æ´»å‹•ã§ç”¨ã„ã‚‰ã‚Œã‚‹æ‰‹æ³•ã®ä¸€ã¤ã¨ã—ã¦ã€"ã‚·ã‚¹ãƒ†ãƒ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«å¯¾ã™ã‚‹æ”»æ’ƒ"ã«ã¤ã„ã¦ç´¹ä»‹ã™ã‚‹ã€‚ ã“ã‚Œã¯ã‚ªãƒšãƒ¬ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã‚·ã‚¹ãƒ†ãƒ (OS) ã‚„ä»®æƒ³ãƒžã‚·ãƒ³ã€ãƒ•ã‚¡ãƒ¼ãƒ ã‚¦ã‚§ã‚¢ã¨ã„ã£ãŸåŸºç›¤ã‚·ã‚¹ãƒ†ãƒ ã‚’
tom__bo 2018/06/21
security
ãƒªãƒ³ã‚¯
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ä½“é¨“ãƒ„ãƒ¼ãƒ«ã€ŽSQLI-LABSã€ã§éŠã¶ - ã¾ã£ãŸã‚ŠæŠ€è¡“ãƒ–ãƒã‚°
ã¯ã˜ã‚ã« ç’°å¢ƒæ§‹ç¯‰ ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹è¨å®š ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãƒ»ãƒ†ãƒ¼ãƒ–ãƒ«åˆæœŸåŒ– å‹•ä½œç¢ºèª Less-1 (GET - Error based - Single quotes - String) Less-5 (GET - Double Injection - Single Quotes - String) Less-10 (GET - Blind - Time based - double quotes) level 1 â‡’ å¤±æ•— Less-11 (POST - Error Based - Single quotes - String) Less-18 (POST - Header Injection - Uagent field - Error based) Less-23 (GET - Error based - strip comments) Less-53 (GET - Blin
tom__bo 2018/05/06
sql

security

sqli
ãƒªãƒ³ã‚¯
CPUæ”»æ’ƒã®æ–°ãŸãªæ‰‹æ³•ã€ŒBranchScopeã€ã€Intelè£½CPUã§å®Ÿè¨¼
CPUæ”»æ’ƒã®æ–°ãŸãªæ‰‹æ³•ã€ŒBranchScopeã€ã€Intelè£½CPUã§å®Ÿè¨¼ï¼šã‚«ãƒ¼ãƒã‚®ãƒ¼ãƒ¡ãƒãƒ³å¤§å¦ãªã©ã®ç ”ç©¶ãƒãƒ¼ãƒ ãŒç™ºè¡¨ ç±³ã‚«ãƒ¼ãƒã‚®ãƒ¼ãƒ¡ãƒãƒ³å¤§å¦ãªã©ã®ç ”ç©¶ãƒãƒ¼ãƒ ãŒç™ºè¡¨ã—ãŸã€ŒBranchScopeã€ã§ã¯ã€1æœˆã«ç™ºè¦šã—ãŸã€ŒSpectreã€ã¨åŒæ§˜ã«ã€ã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«æ”»æ’ƒã‚’ä»•æŽ›ã‘ã¦ã‚»ãƒ³ã‚·ãƒ†ã‚£ãƒ–ãªãƒ‡ãƒ¼ã‚¿ã‚’æµå‡ºã•ã›ã‚‹ã€‚ ç±³ã‚«ãƒ¼ãƒã‚®ãƒ¼ãƒ¡ãƒãƒ³å¤§å¦ãªã©ã®ç ”ç©¶ãƒãƒ¼ãƒ ãŒã€Intelãªã©ã®CPUã®è„†å¼±æ€§ã‚’çªãæ–°ãŸãªæ”»æ’ƒæ‰‹æ³•ã€ŒBranchScopeã€ã«é–¢ã™ã‚‹è«–æ–‡ã‚’ç™ºè¡¨ã—ãŸã€‚1æœˆã«ç™ºè¦šã—ãŸã€ŒSpectreã€ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ã¨åŒæ§˜ã®ä»•çµ„ã¿ã§ã€Intelã®CPUã‚„ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿèƒ½ã®ã€ŒSoftware Guard Extensionsï¼ˆSGXï¼‰ã€ã«å¯¾ã—ã¦æ”»æ’ƒãŒé€šç”¨ã™ã‚‹ã“ã¨ã‚’å®Ÿè¨¼ã—ãŸã¨ã—ã¦ã„ã‚‹ã€‚ è«–æ–‡ã«ã‚ˆã‚‹ã¨ã€BranchScopeæ”»æ’ƒã§ã¯ã€ç¾ä»£ã®CPUãŒæ€§èƒ½å‘ä¸Šã®ãŸã‚ã«å®Ÿè£…ã—ã¦ã„ã‚‹åˆ†å²äºˆæ¸¬ãƒ¦ãƒ‹ãƒƒãƒˆï¼ˆBranch Predic
tom__bo 2018/03/28
cpu

security
ãƒªãƒ³ã‚¯
ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãªã‚‰è„†å¼±æ€§æƒ…å ±ã‚’èªã‚ã‚‹ã‚ˆã†ã«ãªã‚ã† | Tech Blog
ã“ã‚“ã«ã¡ã¯ã€ã‚¢ãƒ‰ãƒ†ã‚¯ã‚¹ã‚¿ã‚¸ã‚ªã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã‚’ã—ã¦ã„ã‚‹å²¡å´Žã§ã™ã€‚ çš†æ§˜ã€å¹´æœ«å¹´å§‹ã¯ã‚†ã£ãã‚Šã§ãã¾ã—ãŸã§ã—ã‚‡ã†ã‹ã€‚ç§ã¯å¹´å§‹ã«å…¬é–‹ã•ã‚ŒãŸã€ŒMeltdown and Spectreã€ã®ãŠé™°ã§å¹´å§‹æ—©ã€…ã€æƒ…å ±æ•´ç†ã«è¿½ã‚ã‚Œã¦ã¾ã—ãŸã€‚ ä»Šå›žã¯ã€å…ˆæ—¥ã€ŒMeltdown and Spectreã€ã®è„†å¼±æ€§ã®ã“ã¨ã‚‚ã‚ã‚Šã€è„†å¼±æ€§æƒ…å ±ã®è¦‹æ–¹ã¨è„†å¼±æ€§æƒ…å ±APIæ´»ç”¨ã«ã¤ã„ã¦ã€æ›¸ã‹ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ï¼‘ï¼Œè„†å¼±æ€§æƒ…å ±ã®è¦‹æ–¹ ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ–¹ã§ã‚ã‚Œã°ã€è„†å¼±æ€§æƒ…å ±ã‚’ç¢ºèªã™ã‚‹ä¸ã§CVEã‚„CVSSãªã©ã‚’ç›®ã«ã™ã‚‹ã“ã¨ãŒå¤šã„ã¨æ€ã„ã¾ã™ã€‚ãã‚Œãžã‚Œã©ã®ã‚ˆã†ãªæ„å‘³ã‚’æŒã¡ã€ã©ã®ã‚ˆã†ã«è¦‹ã‚‹ã®ã‹ã‚’çŸ¥ã£ã¦ãŠãã¾ã—ã‚‡ã†ã€‚ å…ˆæ—¥ã‚ã£ãŸã€ŒMeltdown and Spectreã€ã‚’ä¾‹ã«è¦‹ã¦ã„ãã¾ã—ã‚‡ã†ã€‚ https://meltdownattack.com/ https://spectreattack.com/ ã¾ãšã€ã“ã®ã‚ˆã†ãªè„†å¼±æ€§æƒ…å ±ãŒå…¬é–‹ã•ã‚Œ
tom__bo 2018/02/01
security
ãƒªãƒ³ã‚¯
ã€å›³è§£ã€‘CPUã®è„†å¼±æ€§[Spectre/Meltdown]ã¨æŠ•æ©Ÿçš„å®Ÿè¡Œã®ä»•çµ„ã¿ã€œåˆ†å²äºˆæ¸¬ã¨ã‚¢ã‚¦ãƒˆã‚ªãƒ–ã‚ªãƒ¼ãƒ€ãƒ¼å®Ÿè¡Œã€œ
Spectre/MeltDown ã®æ¦‚è¦ã¨å½±éŸ¿ç¯„å›²2018/1/3 ã«CPUã«é–¢ã™ã‚‹è„†å¼±æ€§ Spectre (ã‚¹ãƒšã‚¯ã‚¿ãƒ¼)/Meltdown (ãƒ¡ãƒ«ãƒˆãƒ€ã‚¦ãƒ³) ãŒ Google ã® "Project ZERO"ã«ã‚ˆã£ã¦å…¬é–‹ã•ã‚Œè©±é¡Œã«ãªã£ã¦ã„ã¾ã™ã€‚ç™ºè¦‹ã•ã‚ŒãŸè„†å¼±æ€§ã¯ 3 ã¤(Variant 1ï½ž3ã¨ãƒ©ãƒ™ãƒ«ã•ã‚Œã¦ã„ã¾ã™)ã§ã€ã†ã¡2ã¤ãŒ Spectreã€1ã¤ãŒ Meltdown ã«åˆ†é¡žã•ã‚Œã¾ã™ã€‚ 3 ã¤ã¨ã‚‚ CPU æ€§èƒ½å‘ä¸Šã®ãŸã‚ã®ã€ŒæŠ•æ©Ÿçš„å®Ÿè¡Œ (Speculative Execution)ã€ã¨ã„ã†ã‚³ãƒ³ã‚»ãƒ—ãƒˆã‚’å®Ÿè£…ã—ãŸä»•çµ„ã¿ (Branch Prediction/Out of Order Execution) ãŒåŽŸå› ã ã¨åˆ¤æ˜Žã—ã¦ã„ã¾ã™ã€‚é•·ã„æ™‚é–“ã€äºˆæ¸¬ã‚’èª¤ã‚‹ã‚ˆã†ã«æŠ•æ©Ÿå®Ÿè¡Œã‚’ã•ã›ã€ãã®é–“ã«ãƒŸã‚¹ãƒªãƒ¼ãƒ‰ã—ã€ä¿è·ã•ã‚ŒãŸãƒ¡ãƒ¢ãƒªé ˜åŸŸã®èªè¾¼ã‚„æ„å›³ã›ã¬ãƒ—ãƒã‚°ãƒ©ãƒ ã®å®Ÿè¡Œã‚’ã•ã›ã‚‹ã‚‚ã®ã§ã™ã€‚ ã„ãšã‚Œã®è„†å¼±æ€§ã‚‚ã‚µã‚¤ãƒ‰ãƒãƒ£
tom__bo 2018/01/20
cpu

security
ãƒªãƒ³ã‚¯
NetSPI SQL Injection Wiki
This wiki's mission is to be a one stop resource for fully identifying, exploiting, and escalating SQL injection vulnerabilities across various Database Management Systems (DBMS). This wiki assumes you have a basic understanding of SQL injection, please go here for an introduction if you are unfamiliar. Below is an outline of the wiki's structure, laid out in the order of a normal escalation path.
tom__bo 2017/12/22
database

Security
ãƒªãƒ³ã‚¯
Vulsã§è„†å¼±æ€§ã‚¹ã‚ãƒ£ãƒ³ã‚’è‡ªå‹•åŒ–ã—ã¦Slackã¨ãƒ¡ãƒ¼ãƒ«é€šçŸ¥ã•ã›ã€æœ¬ç•ªç’°å¢ƒã§å®Ÿç¨¼åƒã•ã›ã‚‹ãƒ¬ãƒ™ãƒ«ã«æŒã£ã¦ã„ã | ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚¹ã™ã ã¡ãã‚“
ã‚·ãƒ³ã‚¸ã§ã™ã€‚ã‚µãƒ¼ãƒãƒ¼ã®è„†å¼±æ€§ã‚’ã‚¹ã‚ãƒ£ãƒ³ã—ã¦ãã‚Œã‚‹ç„¡å„Ÿãƒ„ãƒ¼ãƒ«Vulsã¯ä½•ã‹ã¨ä¾¿åˆ©ãªã®ã¯ã„ã„ã®ã§ã™ãŒã€ã“ã‚Œã‚’æœ¬ç•ªç’°å¢ƒã§å®Ÿç¨¼åƒã•ã›ã¦PCIDSSã®ç›£æŸ»ã«ã¾ã§ä½¿ãˆã‚‹ãƒ¬ãƒ™ãƒ«ã¸æŒã£ã¦ã„ãã¨ã“ã‚ã¾ã§ã‚„ã£ã¦ã—ã¾ãˆã¨ã„ã†è©±ã§ã™ã€‚ å‰æã¨ã—ã¦ Vulsã¯ç„¡å„Ÿã§ãŠæ‰‹è»½ã«è„†å¼±æ€§è¨ºæ–å‡ºæ¥ã‚‹ãƒ„ãƒ¼ãƒ«ã¨ã—ã¦ã¯å„ªç§€ã ã¨æ€ã„ã¾ã™ãŒã€ã„ã‚ã‚†ã‚‹ã€Œè¨ºæ–å£«ã€ãŒè¡Œã†ã‚ˆã†ãªã‚«ã‚¹ã‚¿ãƒ ã‚„ãƒ•ãƒ«ã‚¹ã‚¯ãƒ©ãƒƒãƒã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¯¾ã—ã¦è¨ºæ–ã‚’è¡Œã†ã‚ã‘ã§ã¯ç„¡ã„ã§ã™ã—ã€ã‚ãã¾ã§CVEã¨ã—ã¦å…¬é–‹ã•ã‚Œã¦ã„ã‚‹è„†å¼±æ€§æƒ…å ±ã¨åˆè‡´ã™ã‚‹ã‹ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãã‚Œã‚‹ã ã‘ã®ãƒ„ãƒ¼ãƒ«ã§ã™ã‹ã‚‰ã€ã“ã‚Œã ã‘ã«é ¼ã£ã¦ã€Œå®Œç’§ã ã€ã€Œå®‰å…¨ã ã€ã¨ã‹ã„ã†å‹˜é•ã„ã¯ã—ãªã„æ–¹ãŒã‚ˆã„ã§ã™ã€‚ ã¨ã¯ã„ãˆã€ä¾‹ãˆã°PCI DSSç›£æŸ»ã«ãŠã„ã¦ã¯ã€å…¬é–‹ã•ã‚Œã¦ã„ã‚‹è„†å¼±æ€§æƒ…å ±ã¸ã®å¯¾å¿œå…·åˆã¯èžã‹ã‚Œã¾ã™ã—ã€CSIRTã§åŽé›†ã—ãŸæƒ…å ±ãŒã€ä¾‹ãˆã°ç¤¾å†…ã‚¤ãƒ³ãƒ•ãƒ©ã«é™ã£ã¦ã¿ãŸã¨ãã«ã©ã®ç¨‹åº¦å¯¾å¿œå‡ºæ¥ã¦ã„ã‚‹ã‹ã‚’åˆ¤æ–ã™ã‚‹æŒ‡æ¨™ã®ææ–™ã«ã¯ãªã‚Šã¾ã™ã‹
tom__bo 2017/09/07
security
ãƒªãƒ³ã‚¯
DNSã®ã‚¯ã‚¨ãƒªãƒã‚°ã€èª¿ã¹ã‚‹ã¨ããŒãã¾ã—ãŸ | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒ©ãƒƒã‚¯
DNSã®ã‚¯ã‚¨ãƒªãƒã‚°ã®èª¿æŸ»ãŒã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã‹ï¼Ÿèª¿ã¹ã‚‹ã¨ããŒãã¾ã—ãŸã€‚ å…ˆæ—¥ç§ãŒã€Œã‚ãªãŸã®çµ„ç¹”ã¯DNSã®ã‚¯ã‚¨ãƒªãƒã‚°ã‚’è¨˜éŒ²ã—ã¦ã„ã¾ã™ã‹ï¼Ÿã€ã¨ã„ã†è¨˜äº‹ã‚’æ›¸ãã¾ã—ãŸã€‚ãã®å¾Œã€DNSã®ã‚¯ã‚¨ãƒªãƒã‚°ã‚’è¨å®šã•ã‚ŒãŸã§ã—ã‚‡ã†ã‹ã€‚ç§ãŒèžã„ã¦ã„ã‚‹ç¯„å›²ã§ã¯ã¾ã ã¾ã ã»ã¨ã‚“ã©ã®çµ„ç¹”ã§è¨˜éŒ²ã•ã‚Œã‚‹ã‚ˆã†ãªä½“åˆ¶ã«ãªã£ã¦ã„ãªã„ã‚ˆã†ã§ã™ã€‚ ã‚ãªãŸã®çµ„ç¹”ã¯DNSã®ã‚¯ã‚¨ãƒªãƒã‚°ã‚’è¨˜éŒ²ã—ã¦ã„ã¾ã™ã‹ï¼Ÿ | ãƒ©ãƒƒã‚¯å…¬å¼ãƒ–ãƒã‚° | æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ é éš”æ“ä½œã‚¦ã‚¤ãƒ«ã‚¹ã®åˆ¶å¾¡ã«DNSãƒ—ãƒãƒˆã‚³ãƒ«ã‚’ä½¿ç”¨ã™ã‚‹äº‹æ¡ˆã¸ã®æ³¨æ„å–šèµ· | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± | æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ ã€Œããƒ¼ã„ãˆã°ã€è¨å®šã—ãŸã‘ã©ã€ãã®ã¾ã¾ã ã£ãŸãªã€ã¨ã„ã†æ–¹ã‚‚å¤šãã„ã‚‰ã£ã—ã‚ƒã‚‹ã§ã—ã‚‡ã†ã€‚ç§ã‚‚ã€Œã¨ã‚Šã‚ãˆãšä»Šã¯ãƒã‚°ã‚’å–ã£ã¦ãŠã„ã¦ãã ã•ã„ã€‚ã„ãšã‚Œã€èª¿ã¹ã‚‹ã¨ããŒãã¾ã™ã‹ã‚‰ã€ã¨è¨€ã£ã¦ã„ã¾ã—ãŸã€‚ãã®ã€Œèª¿ã¹ã‚‹ã¨ãã€ãŒãã¾ã—ãŸã€‚ PaloAltoç¤¾ã¨FireEyeç¤¾ãŒDNSã‚’ä½¿ç”¨ã™ã‚‹æ”»æ’ƒã‚ãƒ£ãƒ³ãƒšãƒ¼ãƒ³ã«ã¤
tom__bo 2016/05/31
Security

DNS
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: U+2028/2029ã¨DOM based XSS
ECMAScriptã®ä»•æ§˜ã§ã¯ã€0x0A/0x0Dä»¥å¤–ã«U+2028/2029ã®æ–‡å—ã‚‚æ”¹è¡Œã¨ã™ã‚‹ã“ã¨ãŒæ˜Žè¨˜ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã‚Œã¯ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã‚ˆã†ã«æ€ã„ã¾ã™ã€‚ ä»¥ä¸‹ã¯ã‚¢ãƒ©ãƒ¼ãƒˆã‚’å‡ºã—ã¾ã™ã€‚ <script> //[U+2028]alert(1) </script> çŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã ã‘ã§ãªãã€çŸ¥ã£ã¦ã„ãŸã¨ã—ã¦ã‚‚ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã§æ–‡å—åˆ—ã‚’å‡¦ç†ã™ã‚‹ã¨ãã«ã€U+2028/2029ã¾ã§è€ƒæ…®ã™ã‚‹é–‹ç™ºè€…ãŒã©ã‚Œã ã‘ã„ã‚‹ã®ã‹ã¨ã„ã†è©±ã§ã™ã€‚ å®Ÿéš›ã€U+2028/2029ã‚’æ”¾ã‚Šè¾¼ã‚€ã¨æ–‡å—åˆ—ãƒªãƒ†ãƒ©ãƒ«å†…ã«ãã®æ–‡å—ãŒç”Ÿã®ã¾ã¾é…ç½®ã•ã‚Œã€ã‚¨ãƒ©ãƒ¼ãŒå‡ºã‚‹ãƒšãƒ¼ã‚¸ã¯æœ¬å½“ã«ãŸãã•ã‚“ã‚ã‚Šã¾ã™ã€‚ã¾ã‚ã€ã‚¨ãƒ©ãƒ¼ãŒã§ã‚‹ã ã‘ãªã‚‰ã€å¤§æŠµã®å ´åˆå¤§ããªå•é¡Œã«ã¯ãªã‚Šã¾ã›ã‚“ã€‚ ã¨ã“ã‚ãŒã€U+2028/2029ã«ã‚ˆã£ã¦XSSãŒå¼•ãèµ·ã“ã•ã‚Œã¦ã—ã¾ã†å ´åˆã¨ã„ã†ã®ã‚’æœ€è¿‘å®Ÿéš›ã«è¦‹ã¾ã—ãŸã€‚ Googleã®ã‚µãƒ¼ãƒ“ã‚¹ã§è¦‹ã¤ã‘ãŸ2ã¤ã®ã‚±ãƒ¼ã‚¹ã‚’å–ã‚Šä¸Šã’ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ã‚±
tom__bo 2015/11/21
security
ãƒªãƒ³ã‚¯
1