[B! security] yharaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yhara id:yhara

securityã«é–¢ã™ã‚‹yharaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

kusuwada on Twitter: "æœ€è¿‘ "The Lord of the SQLI" ã¨ã„ã†ã‚µã‚¤ãƒˆã§SQL injectionã®å•é¡Œè§£ã„ã¦ã‚‹ã€‚å…¨49å•ã€‚ã¾ã åŠåˆ†ãã‚‰ã„ãªã‚“ã ã‘ã©ã€ã¨ã¦ã‚‚ã‚ˆã„ã€‚å•é¡ŒãŒã‚·ãƒ³ãƒ—ãƒ«ã§ã‚ã‹ã‚Šã‚„ã™ã„ã—ã€ã ã‚“ã ã‚“ãƒ¬ãƒ™ãƒ«ã‚¢ãƒƒãƒ— or æ‰‹æ³•ãŒå¤‰ã‚ã£ã¦â€¦ https://t.co/FZLzoxJISz"
æœ€è¿‘ "The Lord of the SQLI" ã¨ã„ã†ã‚µã‚¤ãƒˆã§SQL injectionã®å•é¡Œè§£ã„ã¦ã‚‹ã€‚å…¨49å•ã€‚ã¾ã åŠåˆ†ãã‚‰ã„ãªã‚“ã ã‘ã©ã€ã¨ã¦ã‚‚ã‚ˆã„ã€‚å•é¡ŒãŒã‚·ãƒ³ãƒ—ãƒ«ã§ã‚ã‹ã‚Šã‚„ã™ã„ã—ã€ã ã‚“ã ã‚“ãƒ¬ãƒ™ãƒ«ã‚¢ãƒƒãƒ— or æ‰‹æ³•ãŒå¤‰ã‚ã£ã¦â€¦ https://t.co/FZLzoxJISz
yhara 2020/08/08
sql

security
ãƒªãƒ³ã‚¯
å¾³ä¸¸ æµ© on Twitter: "ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã‚’è¨±å®¹ã—ãªã„ç†ç”±ã¯ã€type=passwordãªå…¥åŠ›æ¬„ã§ã¯IMEãŒæœ‰åŠ¹ã«ãªã‚‰ãšãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã®å…¥åŠ›ãŒé›£ã—ã„ã€ä»®ã«IMEãŒæœ‰åŠ¹ã§ã‚‚å…¥åŠ›æ–‡å—åˆ—ãŒè¦‹ãˆã‚‹ã®ã§ã‚·ãƒ§ãƒ«ãƒ€ãƒ¼ãƒãƒƒã‚ãƒ³ã‚°ã•ã‚Œã‚„ã™ã„ã€ã“ã‚Œã‚‰ã«ã‚ˆã‚‹ãƒˆãƒ©ãƒ–â€¦ https://t.co/nCQNndhzRM"
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã‚’è¨±å®¹ã—ãªã„ç†ç”±ã¯ã€type=passwordãªå…¥åŠ›æ¬„ã§ã¯IMEãŒæœ‰åŠ¹ã«ãªã‚‰ãšãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã®å…¥åŠ›ãŒé›£ã—ã„ã€ä»®ã«IMEãŒæœ‰åŠ¹ã§ã‚‚å…¥åŠ›æ–‡å—åˆ—ãŒè¦‹ãˆã‚‹ã®ã§ã‚·ãƒ§ãƒ«ãƒ€ãƒ¼ãƒãƒƒã‚ãƒ³ã‚°ã•ã‚Œã‚„ã™ã„ã€ã“ã‚Œã‚‰ã«ã‚ˆã‚‹ãƒˆãƒ©ãƒ–â€¦ https://t.co/nCQNndhzRM
yhara 2018/08/28
security
ãƒªãƒ³ã‚¯
ã¯ã˜ã‚ã¦ã®ã«ã(2011-02-27)
_ XSSI ãã†ã„ãˆã° XSSI ã¨ã„ã†æ”»æ’ƒãŒã‚ã‚‹ã“ã¨ã‚’çŸ¥ã£ãŸã€‚ web ã‚µã‚¤ãƒˆã®ã‚ªãƒ¼ãƒŠãƒ¼ãŒã§ãã‚‹ç¨®é¡žã®æ”»æ’ƒã§ã€ cookie ã¤ããª JSON ã§ãªã‚“ã‹ã‚„ã£ã¦ã‚‹ã‚µã‚¤ãƒˆã ã¨ã€ ãã® JSON ã‚’å…¨ãé–¢ä¿‚ãªã„ web ã‚µã‚¤ãƒˆã‚’ <script> ã§ èªã¿è¾¼ã‚€ã“ã¨ã«ã‚ˆã£ã¦ãƒ‡ãƒ¼ã‚¿ã‚’ç›—ã‚ã‚‹ã€ã¨ã€‚ ã—ãã¿ã¨ã—ã¦ã¯ JSONP çš„ãªã®ã‚’é€†ã«æ”»æ’ƒã«ä½¿ãˆã‚‹ã£ã¦ã„ã† ã¾ãå½“ãŸã‚Šå‰ã®è©±ã§ã¯ã‚ã‚‹ã‘ã©ã€ãªã‚‹ã»ã©ãªã¨ã€‚ å¯¾ç–ã¨ã—ã¦ã¯ )]}' ã¿ãŸã„ãªæ–‡å—ã§ JSON ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’é–‹å§‹ã—ã¦ã€ è‡ªåˆ†ã® JS å†…ã§ã¯ã“ã‚Œã‚’èªã¿é£›ã°ã—ã¦ã‚„ã‚Œã°ã„ã„ã‚‰ã—ã„ã€‚ ä»–ã«ã¯ POST ã—ã‹å—ã‘ãªã„ã‚ˆã†ã«ã—ã¡ã‚ƒã†ã¨ã‹ã€ XSRF åŒæ§˜äºˆæƒ³ä¸èƒ½ãª ID ã¨ã‹ã‚’ URL ã«å«ã‚ã‚‹ã¨ã‹ã‚‚ã„ã„ã‚‰ã—ã„ã€‚ http://code.google.com/p/browsersec/wiki/Part2#Navigation_and_content
yhara 2011/07/26
XSSI

security
ãƒªãƒ³ã‚¯
ãã¾ãã‚Œæ—¥è¨˜: sudo ã®GUIãƒ€ã‚¤ã‚¢ãƒã‚°ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çš„ã«å¤§ä¸ˆå¤«ãªã®ã‹?
Ubuntuã‚„Mac OSXã‚’ä½¿ã£ã¦ã„ã‚‹ã¨ã€æ¨©é™ã®é«˜ã„ã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å®Ÿè¡Œã—ã‚ˆã†ã¨ã—ãŸã¨ãã«ã€ãƒ¦ãƒ¼ã‚¶ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’è¦æ±‚ã™ã‚‹ãƒ€ã‚¤ã‚¢ãƒã‚°ãŒèµ·å‹•ã—ã¾ã™ã€‚æ¯Žå›žãƒã‚¤ãƒã‚¤ã¨æ€ã„ã¤ã¤å…¥åŠ›ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€ãµã¨è€ƒãˆã‚‹ã¨ã“ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¢ãƒ‡ãƒ«ã¨ã„ã†ã‹ãƒ¦ãƒ¼ã‚¶ãƒ“ãƒªãƒ†ã‚£ãƒ¼çš„ã«å¤§ä¸ˆå¤«ãªã®ã‹ã©ã†ã‹ã¨æ€ã†ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ä¾‹ãˆã°ã€ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ©ãƒ¼ã§ãƒ€ãƒŸãƒ¼ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ€ã‚¤ã‚¢ãƒã‚°ã‚’è¡¨ç¤ºã•ã›ã‚Œã°ãƒžãƒ«ã‚¦ã‚§ã‚¢ä½œè€…ã¯ãƒ¦ãƒ¼ã‚¶ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å–ã‚Šæ”¾é¡Œã ã—ã€OSã®ãƒ•ã‚¡ã‚¤ãƒ«ä¿å˜ãƒ€ã‚¤ã‚¢ãƒã‚°ã‚’ã‚¯ãƒ©ãƒƒã‚¯ã—ã¦ã€é©å½“ãªãƒ•ã‚¡ã‚¤ãƒ«ä¿å˜ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã§åŒãƒ€ã‚¤ã‚¢ãƒã‚°ã‚’å‡ºã›ã°ã€ç„¡çŸ¥ãªãƒ¦ãƒ¼ã‚¶ã¯ãƒ›ã‚¤ãƒ›ã‚¤ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã—ã¦ã—ã¾ã†ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚Webã‚µã‚¤ãƒˆã®ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã¨å…¨ãåŒã˜è©±ã§ã™ã€‚ ã“ã®ãƒ€ã‚¤ã‚¢ãƒã‚°ã¯ãã‚‚ãã‚‚ CUIãƒ—ãƒã‚°ãƒ©ãƒ sudo ã®ãƒ©ãƒƒãƒ‘ãƒ¼ã«ã™ãŽã¾ã›ã‚“ã€‚ã—ã‹ã—ã€è©±ã¯ãã‚“ãªã«å˜ç´”ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚CUIã®å ´åˆã¯ã€ã»ã¨ã‚“ã©ã®æ“ä½œãŒã€Œèƒ½å‹•çš„ã€ãªãŸã‚ã«ã€su
yhara 2009/09/28
security

sudo

gui
ãƒªãƒ³ã‚¯
"OpenID: Single Sign-On for the Internet" ã‚’èªã‚“ã (1) - æ—¥å‘å¤ç‰¹æ®Šå¿œæ´éƒ¨éšŠ
BlackHat USA (2007) ã§ Eugene Tsyrklevich ã•ã‚“ã¨ Vlad Tsyrklevich ã•ã‚“ãŒãƒ—ãƒ¬ã‚¼ãƒ³ã—ãŸè³‡æ–™ãŒã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã§è¦‹ã‚Œã¾ã™ã€‚ OpenID: Single Sign-On for the Internet (PDF) ã§æ—¢ã«æ—¥æœ¬èªžã§ã‚‚ç´¹ä»‹è¨˜äº‹ãŒã‚ã‚Šã¾ã™ã€‚ è‡ªåˆ†ã§ã‚‚èªã‚“ã§ã¿ãŸã®ã§ã€é€ä¸€è§£èª¬ã—ã¦ã¿ãŸã‚Šè€ƒãˆã‚’æ›¸ã„ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ å¹¾ã¤ã‹ã‚ã‚‹ã‚“ã§ä¸€å€‹ãšã¤ãƒ”ãƒƒã‚¯ã‚¢ãƒƒãƒ—ã—ã¦ã„ãã¾ã™ã€‚ Downloading an OpenID URL é€šå¸¸ RP ã§ã¯ OpenID ã‚’ä½¿ã£ãŸèªè¨¼ã‚’æä¾›ã™ã‚‹éš›ã«ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼å‘ã‘ã«ä½•ã‚‰ã‹ã®ãƒ•ã‚©ãƒ¼ãƒ ã‚’ç”¨æ„ã—ã¾ã™ã€‚ã“ã“ã¯æœ¬æ¥ã€ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ‰€æœ‰ã™ã‚‹ Claimed Identifier ã‚ã‚‹ã„ã¯ OP Identifier ã‚’å…¥åŠ›ã™ã‚‹ã¹ããƒ•ã‚©ãƒ¼ãƒ ã§ã™ãŒã€ãã†ã§ã¯ãªã„æ–‡å—åˆ—ã‚’å…¥åŠ›ã—ãŸéš›ã«å•é¡ŒãŒã‚ã‚‹ã‹ã‚‚ã‚ˆã¨è¨€ã†è©±ã§ã™ã€‚ ã¾ãã“ã‚Œã¯ãƒ‘
yhara 2008/06/17
openid

security
ãƒªãƒ³ã‚¯
ãã‚Œ Unicode ã§
UTF-7 ã‚’ä½¿ã£ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨˜è¿° +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-+AC8-SCRIPT+AD4- IE ã¯ã€æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒä¸æ˜Žã§ UTF-7 ã£ã½ã„æ–‡å—åˆ—ãŒã‚ã‚Œã°ã€è‡ªå‹•åˆ¤åˆ¥ã§ UTF-7 ã¨ãªã‚‹ã€‚
yhara 2006/12/13
security
ãƒªãƒ³ã‚¯
1