[B! security] uemuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

uemu id:uemu

securityã«é–¢ã™ã‚‹uemuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚¹ãƒ‘ãƒ ã‚ˆã‘ã«ã‚‚ä½¿ãˆã‚‹ã€Œmod_securityã€
Apacheã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ã™ã‚‹ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã§ã€Œmod_securityã€ã¨ã„ã†ã®ãŒã‚ã‚‹ãã†ã§ã€‚ã„ã‚ã‚†ã‚‹Web Application Firewall (WAF)ã¨ã„ã†ã‚‚ã®ã«åˆ†é¡žã•ã‚Œã‚‹ä»•çµ„ã¿ãªã®ã§ã™ãŒã€éžå¸¸ã«æ©Ÿèƒ½ãŒå¼·åŠ›ã€‚ãƒ˜ãƒƒãƒ€ã€GETã€POSTã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’å«ã‚€INã¨OUTã®å…¨ãƒªã‚¯ã‚¨ã‚¹ãƒˆï¼ˆHTTPSå«ã‚€ï¼‰ã«å¯¾ã—ã¦ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°å¯èƒ½ã€‚é€šå¸¸ã§ã¯è¨˜éŒ²ã•ã‚Œãªã„POSTã®ãƒã‚°ã‚‚è¨˜éŒ²å¯èƒ½ã€‚ ã§ã€ã“ã®æ©Ÿèƒ½ã‚’ä½¿ãˆã°ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚¹ãƒ‘ãƒ ã‚‚ã‚µãƒ¼ãƒå´ã§å§‹æœ«ã§ãã‚‹ã®ã§ã€PHPãªã©ãŒå‹•ã„ã¦åˆ¤å®šã™ã‚‹å‰ã«å‡¦ç†ã§ãã€ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚¹ãƒ‘ãƒ ã«ã‚ˆã‚‹è² è·ãŒè»½ããªã‚‹ã¨ã„ã†ã‚ã‘ã€‚ è¨å®šã®è©³ç´°ãªã©ã¯ä»¥ä¸‹ã®é€šã‚Šã€‚mod_securityç”¨ã®ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆã‚‚ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã§ãã‚‹ã®ã§è¨å®šã‚‚ç°¡å˜ã§ã™ã€‚ å…¬å¼ã‚µã‚¤ãƒˆã¯ä»¥ä¸‹ã€‚ ModSecurity (mod_security) - Open Source Web Application Firewal
uemu 2006/07/14
å°Žå…¥ã—ãŸã„ã‹ã‚‚

apache

security
ãƒªãƒ³ã‚¯
ã‚ãƒ³ã‚°ã‚½ãƒ•ãƒˆ
å…¨ä¸–ç•Œã§1å„„ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’èª‡ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚½ãƒ•ãƒˆã‚’ã¯ã˜ã‚ã€ä½¿ã„ã‚„ã™ã•ã¨ã‚³ã‚¹ãƒˆãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ã«å„ªã‚ŒãŸç·åˆã‚ªãƒ•ã‚£ã‚¹ã‚½ãƒ•ãƒˆã‚’æä¾›ã—ã¦ã„ã¾ã™ã€‚ äº‹æ¥è©³ç´°
uemu 2006/01/28
ãƒ•ãƒªãƒ¼ã®ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã€€ã©ã†ã‹ãª

security

tool

windows
ãƒªãƒ³ã‚¯
Bridge Word
This shop will be powered by Are you the store owner? Log in here
uemu 2005/12/01
ãµã‚€ãµã‚€ã€€å‚è€ƒã¾ã§ã«

openid

security

web2.0
ãƒªãƒ³ã‚¯
CNET Japan Blog - è¿‘è—¤æ·³ä¹Ÿã®æ–°ãƒãƒƒãƒˆã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£è«–ï¼šä¸å…·åˆã¨ä¿¡é ¼æ€§
2003å¹´1æœˆã€å›½å†…ã§ã¯åˆæœŸã®ãƒ–ãƒã‚°ã‚µãƒ¼ãƒ“ã‚¹ã¨ã—ã¦ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ãƒ™ãƒ¼ã‚¿ç‰ˆã‚’é–‹å§‹ã—ã¾ã—ãŸã€‚ãã‚Œã¾ã§ã®ãƒ–ãƒã‚°ã‚„ã‚¦ã‚§ãƒ–æ—¥è¨˜ã«ã¯ç„¡ã„ã‚ãƒ¼ãƒ¯ãƒ¼ãƒ‰æ©Ÿèƒ½ãªã©ã‚’å‚™ãˆãŸã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã¯ã€ç„¡æ–™ã§åˆ©ç”¨ã§ãã‚‹ã“ã¨ã‚‚ã‚ã‚Šå½“åˆã‹ã‚‰åˆ©ç”¨ç”³ã—è¾¼ã¿ãŒå¤šãã€100åã®ãƒ™ãƒ¼ã‚¿ãƒ†ã‚¹ã‚¿ãƒ¼æž ã¯ã™ãã«åŸ‹ã¾ã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ åˆæœŸã®ãƒ™ãƒ¼ã‚¿ãƒ†ã‚¹ãƒˆæ®µéšŽã§ã¯ã€ã‚·ã‚¹ãƒ†ãƒ ã«ã¯ã¾ã ãƒã‚°ã‚„è„†å¼±æ€§ãŒå«ã¾ã‚Œã¦ã„ã¾ã—ãŸã€‚æœ¬æ¥å‹•ä½œã™ã‚‹ã¯ãšã®æ©Ÿèƒ½ãŒã†ã¾ãå‹•ä½œã—ãªã„ã€ã¨ã„ã†ä¸å…·åˆã«åŠ ãˆã€ãƒã‚°ã‚¤ãƒ³ä¸ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®Cookieã‚’æŠœãå–ã‚‹ã“ã¨ã®ã§ãã‚‹XSSï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼‰è„†å¼±æ€§ãŒä¸€éƒ¨ã«å˜åœ¨ã—ã¦ã„ã¾ã—ãŸã€‚ XSSè„†å¼±æ€§ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒHTMLã‚„CSSã‚’è¨˜è¿°å¯èƒ½ãªã‚µãƒ¼ãƒ“ã‚¹ã«ã¤ã„ã¦ã¾ã‚ã‚‹å•é¡Œã§ã€ã—ã£ã‹ã‚Šã¨ã—ãŸå¯¾ç–ã‚’è¡Œã‚ãªã„ã¨æ‚ªæ„ã®ã‚ã‚‹JavaScriptã‚’å‹•ä½œã—ã¦ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ã®ã£ã¨ã‚Šè¡Œç‚ºãªã©ãŒå¯èƒ½ã«ãªã£ã¦ã—ã¾ã„ã¾ã™ã€‚ æ£ç›´ãªã¨ã“ã‚ã€å½“æ™‚ã®ç¤¾å†…ã§ã¯XSSè„†å¼±æ€§
uemu 2005/09/09
ãƒ¡ãƒ¢

hatena

security
ãƒªãƒ³ã‚¯
SQL Injection Attacks by Example
A customer asked that we check out his intranet site, which was used by the company's employees and customers. This was part of a larger security review, and though we'd not actually used SQL injection to penetrate a network before, we were pretty familiar with the general concepts. We were completely successful in this engagement, and wanted to recount the steps taken as an illustration. "SQL Inj
uemu 2005/06/04
SQLã€€Injectionã®ä¾‹ãŒã„ã‚ã„ã‚

database

security
ãƒªãƒ³ã‚¯
swatchã¨ipfwã§sshã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã‚’è‡ªå‹•æ‹’å¦ã™ã‚‹æ–¹æ³•
ã¯ã˜ã‚ã« sshã®ãƒãƒ¼ãƒˆã‚’é–‹ã„ã¦ã„ã‚‹ã¨ã€ä¸–ç•Œä¸ã‹ã‚‰rootãƒã‚°ã‚¤ãƒ³ã‚„ã‚ã‚ŠãŒã¡ãªã‚¢ã‚«ã‚¦ãƒ³ãƒˆï¼ˆguestã¨ã‹ï¼‰ã§ã®ãƒã‚°ã‚¤ãƒ³ã‚’è©¦ã™ã‚¢ã‚¯ã‚»ã‚¹ãŒã‚„ã£ã¦ãã¾ã™ã€‚ é€šå¸¸ã¯sshã§rootãƒã‚°ã‚¤ãƒ³ãªã©è¨±å¯ã—ã¦ã„ãªã„ã®ã§ï¼ˆã—ã¦ã¾ã›ã‚“ã‚ˆãï¼Ÿï¼‰ã€è¢«å®³ãŒãªã„ã¯ãšãªã®ã§ã™ãŒã€ç«‹ã¦ç¶šã‘ã«ä½•åº¦ã‚‚ã‚¢ã‚¯ã‚»ã‚¹ã•ã‚Œã‚‹ã¨æ°—æŒã¡æ‚ªã„ã“ã¨ã¯ç¢ºã‹ãªã®ã§ã€ãã®ã‚ˆã†ãªæŽ¥ç¶šå…ƒã‚’è‡ªå‹•çš„ã«ã‚¢ã‚¯ã‚»ã‚¹æ‹’å¦ã—ã¦ã—ã¾ãŠã†ã¨ã„ã†ã®ãŒç›®çš„ã§ã™ã€‚ OSã¯FreeBSD 5.4Rã‚’å‰æã¨ã—ã¾ã™ã€‚ swatchã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ï¼†èµ·å‹• swatch 3.1.1ã‚’portã‚ˆã‚Šã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¾ã™ã€‚ï¼ˆè©³ç´°çœç•¥ï¼‰ /etc/rc.confã«ä»¥ä¸‹ã‚’è¿½åŠ ã—ã¾ã™ã€‚ swatch_enable="YES" swatch_rules="1" swatch_1_flags="--tail-file=/var/log/auth.log --awk-field-syntax --co
uemu 2005/06/04
ãªã‚‹ã»ã©

security

unix
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã®æ£ã—ã„å¯¾ç–æ–¹æ³•
â– ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã®æ£ã—ã„å¯¾ç–æ–¹æ³• ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªã€ãŒã«ã‚ã‹ã«æ³¨ç›®ã‚’é›†ã‚ã¦ã„ã‚‹ã€‚å¤ã ã‹ã‚‰å˜åœ¨ã—ãŸã“ã®å•é¡ŒãŒãªãœä»Šã¾ã§ã‚ã¾ã‚Šæ³¨ç›®ã•ã‚Œã¦ã“ãªã‹ã£ãŸã‹ã«ã¤ã„ã¦è€ƒ ãˆã¦ã„ã‚‹ã¨ã“ã‚ã ãŒã€å¼•è¶Šã—ã‚„ã‚‰è»¢å‹¤ã‚„ã‚‰ã§ã„ã¾ã²ã¨ã¤æ—¥è¨˜ã‚’æ›¸ãæ™‚é–“ãŒãªã„ã€‚ ã—ã‹ã—ã€ @ITã®è¨˜äº‹ãªã©ã®ã‚ˆã†ã«æ··ä¹±ã•ã›ã‚‹è§£èª¬ã‚‚æ•£è¦‹ã•ã‚Œã‚‹ã®ã§ã€ä¸€ç‚¹ã ã‘å¯¾ç– æ–¹æ³•ã«ã¤ã„ã¦æ›¸ã„ã¦ãŠãã¨ã™ã‚‹ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªâ€”â€”Cross-Site Request Forgeries (CSRF)ã‚’é˜²æ¢ã™ã‚‹ç°¡æ½”ã§è‡ªç„¶ãªè§£æ±ºç–ã¯ä»¥ä¸‹ã®ã¨ãŠã‚Šã§ã‚ã‚‹ã€‚ å‰æ ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ãªã„Webé–²è¦§è€…ã«å¯¾ã™ã‚‹CSRFæ”»æ’ƒï¼ˆæŽ²ç¤ºæ¿è’ã‚‰ã—ã‚„ã€ãƒ¦ãƒ¼ã‚¶ç™» éŒ²ã‚’ä»–äººã«ã•ã›ã‚‹ç‰ã€ã‚µã‚¤ãƒˆé‹å–¶è€…ã«å¯¾ã™ã‚‹æ¥å‹™å¦¨å®³è¡Œç‚ºï¼‰ã¯ã“ã“ã§ã¯å¯¾è±¡ã¨ ã—ãªã„ã€‚ ãƒã‚°ã‚¤ãƒ³æ©Ÿèƒ½ã‚’æŒã¤Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å ´åˆã€ä½•ã‚‰ã‹ã®æ–¹æ³•ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³ è¿½
uemu 2005/05/10
å®Ÿè£…æ™‚ã«ã¯ã“ã“ã‚’ã‚‚ã†ä¸€åº¦ã‚ˆã‚€

security
ãƒªãƒ³ã‚¯
in between daysã€€-ã€€mixiã«CSRFè„†å¼±æ€§ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ãƒˆãƒ©ãƒƒãƒ—
2005-04-20 mixiã«CSRFè„†å¼±æ€§ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ãƒˆãƒ©ãƒƒãƒ— mixi æ˜¨æ—¥æ›¸ã„ãŸã€Œã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ãƒˆãƒ©ãƒƒãƒ—ãŒãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ï¼ˆver 3.0ï¼‰ã—ãŸã‚‚ã‚ˆãŠã€‚ä»¥å‰ã®ã¯æ—¥è¨˜ã‚’æ›¸ãè¾¼ã‚€ãŸã‚ã®CGIã¸ã®å¼•æ•°ä»˜ãã®ãƒªãƒ³ã‚¯ãŒãã®ã¾ã¾è²¼ã£ã¦ã‚ã£ãŸã‚“ã ã‘ã©ã€ä»Šå›žã¯ã‚µã‚¤ãƒˆã‚’çµŒç”±ã•ã›ã‚‹ã‚ˆã†ã«ãªã£ã¦ã¦æ‰‹ãŒå‡ã£ã¦ã„ã‚‹ã‚‚ã‚ˆãŠã€‚mixiã®å¯¾ç–ã¨ã—ã¦ã¯ãƒªâ€¦ 2005-04-20 ãˆï¼Ÿã€Œã¯ã¾ã¡ã€ã¡ã‚ƒã‚“ãªã®ï¼Ÿ mixi ã¯ã¾ã¡ã¡ã‚ƒã‚“é–¢é€£ã§æ€ã£ãŸã“ã¨ - ãŠã‚Œã¯ãŠã¾ãˆã®ãƒ‘ãƒ‘ã˜ã‚ƒãªã„â€œI am MACHI-CHANGâ€ãªã®ã‹ã¨æ€ã£ã¦ãŸã£ã™ã€‚ã‚ã¨ã€Œã€æ—¥åˆŠã€‘mixiãƒ‹ãƒ¥ãƒ¼ã‚¹ã€ã¨ã„ã†ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã§â€œã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ã‚¦ã‚¤ãƒ«ã‚¹â€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã®ãƒˆãƒ”ãƒƒã‚¯ãŒç«‹ã£ã¦ã¦ã€ãã‚Œã¯ã¾ã‚ã¾ã ã„ã„ã‚“ã ã‘ã©ã€â€¦ 2005-04-20 ã¯ã¾ã¡ã¡ã‚ƒã‚“é–¢é€£ mixi æãŒã‚Šã•ã‚“çµŒç”±ã§ã‚„ã˜ã†ã¾Watchã‹ã‚‰ãŸãã•ã‚“äººãŒãã‚‹ã‚ˆã†æ€–ã„ã‚ˆã†ã¨ã‹éœ‡ãˆã¦
uemu 2005/04/26
ã»ã‰ã€€ã“ã‚Œã¯å±ãªã„

security

mixi
ãƒªãƒ³ã‚¯
On Off and Beyond: ã‚µãƒ¼ãƒãƒ»ç‹¬ç«‹ãƒ»æ ªå¼å¸‚å ´ãƒ¼ï¼‘
ã‚¢ãƒ¡ãƒªã‚«ã¯æ˜¨æ—¥ã‹ã‚‰å¤æ™‚é–“ã«ãªã£ãŸã€‚æ€¥ã«æ—¥ãŒé•·ããªã£ã¦ã€ï¼˜æ™‚ãã‚‰ã„ã¾ã§æ˜Žã‚‹ã„ã€‚ã“ã®é–“ãƒ©ã‚¸ã‚ªã§èžã„ãŸã®ã ãŒã€åˆã‚ã¦å¤æ™‚é–“ã‚’å°Žå…¥ã—ãŸã¨ãã€ã‚´ãƒ«ãƒ•ãƒœãƒ¼ãƒ«ã®å£²ä¸ŠãŒ30ï¼…å¢—ãˆãŸãã†ã ã€‚8æ™‚ã¨ã‹9æ™‚ã¾ã§æ˜Žã‚‹ã‘ã‚Œã°ã€ä»•äº‹ã®å¾Œã«ã‚´ãƒ«ãƒ•ã§ãã¾ã™ã®ã§ã€‚ ã‚‚ã¨ã„ã€‚ ã¡ã‚‡ã£ã¨å¤ã„ãŒã€Scientific Americanã€€2004å¹´12æœˆå·ã®Common Senseã¯ã€ã©ã†ã„ã†ã¨ãã«ã€å…¨ä½“ãŒã€ãã‚Œã‚’æ§‹æˆã™ã‚‹å€‹äººã‚ˆã‚Šå„ªã‚ŒãŸçŸ¥æµã‚’ç”Ÿã¿å‡ºã™ã‹ã€ã¨ã„ã†è©±ã€‚æ§‹æˆå“¡ãŒã€Œç‹¬ç«‹ã—ã€ã€ã€Œåˆ†æ•£ã—ã¦ã€ã€ã€Œãã‚Œãžã‚ŒãŒå‹æ‰‹ãªç†è§£ã®ä»•æ–¹ã‚’ã™ã‚‹ã€ã¨ã„ã†æ¡ä»¶ã‚’æº€ãŸã—ã¦ã„ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€ã¨ã€‚ è¨˜äº‹ã§ã¯å…¨ä½“ãŒå€‹ã‚ˆã‚Šå„ªã‚Œã¦ã„ã‚‹ä¾‹ã‚’ã„ãã¤ã‹ã‚ã’ã¦ã„ã‚‹ã€‚ ä¾‹1 In one experiment, participants were asked to estimate the number of jelly beans in a jar. The gro
uemu 2005/04/16
DNSæ›¸ãæ›ãˆã§ãã“ããŽã€ã€ã€ã€ã™ã’

security

news
ãƒªãƒ³ã‚¯
1