[B! è„†å¼±æ€§] yuyamaguã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yuyamagu id:yuyamagu

è„†å¼±æ€§ã«é–¢ã™ã‚‹yuyamaguã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ã®å†…è£½åŒ–ã«å‘ã‘ã¦ã€€ç¬¬ä¸€å›žã€œWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ã®å®ŸåŠ›ã‚’å¼•ãå‡ºã™ã‚³ãƒ„ã€œ
æŠ€è¡“éƒ¨ã®æ´¥é‡Žç”°ã§ã™ã€‚ æ˜¨ä»Šã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å¯¾ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ã®å†…è£½åŒ–ã®å‹•ããŒæ´»ç™ºã«ãªã£ã¦ã„ã¾ã™ã€‚ æœ¬æ—¥ã‚ˆã‚Šã€å½“ç¤¾ã®ãŠä»•äº‹ãŒæ¸›ã‚‰ãªã„ç¨‹åº¦ã«ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ã®å†…è£½åŒ–ã«å½¹ç«‹ã¤æƒ…å ±ã‚’ã–ã£ãã°ã‚‰ã‚“ã«ä¸å®šæœŸç™ºä¿¡ã—ã¦è¡Œãäºˆå®šã§ã™ã€‚ ç¬¬ä¸€å›žç›®ã¯ã€å†…è£½åŒ–ã®éš›ã«å¤šãåˆ©ç”¨ã•ã‚Œã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ï¼ˆä»¥ä¸‹ã€è„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ï¼‰ã®å®ŸåŠ›ã‚’ã€ã•ã‚‰ã«å¼•ãå‡ºã™ãŸã‚ã®ã‚³ãƒ„ã«ã¤ã„ã¦ãŠè©±ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ãªãŠã€æœ¬ç¨¿ã§ã¯ç‰¹å®šã®è£½å“ã«é–¢ã™ã‚‹ã”æ¡ˆå†…ã¯ã—ã¦ã„ã¾ã›ã‚“ã€‚ å…·ä½“çš„ãªè¨å®šæ‰‹é †ã‚„æ–¹æ³•ãªã©ã«ã¤ã„ã¦ã¯ã€è„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ã®ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã‚’ã”ç¢ºèªãã ã•ã„ã€‚ ã¯ã˜ã‚ã« ã¾ãšã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹ä»£è¡¨çš„ãªè„†å¼±æ€§ã‚’ã€ ä¸€èˆ¬çš„ãªè„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ã«ã‚ˆã‚‹æ¤œå‡ºã®å¾—æ‰‹ä¸å¾—æ‰‹ã§åˆ†é¡žã—ã¦ã¿ã¾ã—ãŸã€‚ æ¯”è¼ƒçš„å¾—æ„ãªåˆ†é‡Ž XSSï¼ˆåå°„åž‹ï¼‰ ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ä¸Šã®å•é¡Œ ã‚±ãƒ¼ã‚¹ã«ã‚ˆã£ã¦ã¯å¾—æ„ãªåˆ†é‡Ž XSSï¼ˆæ ¼ç´åž‹ã€DOMãƒ™ãƒ¼ã‚¹ï¼‰
yuyamagu 2016/12/21
è„†å¼±æ€§

Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³

web
ãƒªãƒ³ã‚¯
AWS Inspector ã§è„†å¼±æ€§è¨ºæ–ã€‚Jenkins ã§è‡ªå‹•å®Ÿè¡Œã—ã€çµæžœã‚’ Slack ã«é€šçŸ¥ã™ã‚‹ã€‚ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
yuyamagu 2016/09/20
Jenkins

amazon

https

security

AWS

Slack

è„†å¼±æ€§

EC2
ãƒªãƒ³ã‚¯
è¯éº—ãªã‚‹å› æ•°åˆ†è§£:FREAKæ”»æ’ƒã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã« ã¡ã‚‡ã†ã©ä»Šæœ OpenSSLã‚’ã¯ã˜ã‚ã¨ã—ãŸæ§˜ã€…ãªTLSå®Ÿè£…ã®è„†å¼±æ€§ã®è©³ç´°ãŒå…¬è¡¨ã•ã‚Œã¾ã—ãŸã€‚ ã“ã® Inriaã¨MSRã®ã‚°ãƒ«ãƒ¼ãƒ—ã¯ä»¥å‰ã‹ã‚‰TLSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã—ã¦éžå¸¸ã«ã‚¢ã‚¯ãƒ†ã‚£ãƒ–ã«èª¿æŸ»ãƒ»æ¤œè¨¼ã‚’ã—ã¦ã„ã‚‹ã‚°ãƒ«ãƒ¼ãƒ—ã§ã€ä»Šå›žã‚‚é©šãã®å†…å®¹ã§ã—ãŸã€‚ ã“ã®ã‚°ãƒ«ãƒ¼ãƒ—ã¯ã€TLSã®ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯æ™‚ã®çŠ¶æ…‹é·ç§»ã‚’åŽ³å¯†ã«ãƒã‚§ãƒƒã‚¯ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã‚’é–‹ç™ºã—ã€æ§˜ã€…ãªTLSå®Ÿè£…ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ãƒ»å ±å‘Šã‚’è¡Œã£ã¦ã„ãŸã‚ˆã†ã§ã™ã€‚ ç‰¹ã«FREAKã¨å‘¼ã°ã‚Œã‚‹OpenSSLã®è„†å¼±æ€§(CVE-2015-0204)ã«é–¢ã—ã¦ã¯ã€ã¡ã‚‡ã†ã©ä¿®æ£ç›´å¾Œã®1æœˆåˆã‚ã« Only allow ephemeral RSA keys in export ciphersuites ã§è¦‹ã¦ã„ã¾ã—ãŸãŒã€å…·ä½“çš„ã«ã©ã®ã‚ˆã†ã«æ”»æ’ƒã™ã‚‹ã®ã‹ã•ã£ã±ã‚Šã‚¤ãƒ¡ãƒ¼ã‚¸ã§ããšã€ã‚ã®ã‚°ãƒ«ãƒ¼ãƒ—ã ã‹ã‚‰ã¾ãŸè¶…çµ¶å¤‰æ…‹ãªæ‰‹æ³•ã ã‚ã†ãŒã€ã¾ããã‚Œã»ã©æ·±åˆ»ã˜ã‚ƒãªã„ã ã‚ã†ã¨è¦‹è¾¼ã‚“ã§ã„ã¾ã—ãŸã€‚ ä»Šå›ž
yuyamagu 2015/03/04
TLS

OpenSSL

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

FREAK

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
NTPå¢—å¹…æ”»æ’ƒã§â€œå²ä¸Šæœ€å¤§è¦æ¨¡â€ã‚’ä¸Šå›žã‚‹DDoSæ”»æ’ƒç™ºç”Ÿ
ç±³å›½æ™‚é–“ã®2014å¹´2æœˆ10æ—¥ã€Network Time Protocolï¼ˆNTPï¼‰ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸå¤§è¦æ¨¡ãªDDoSæ”»æ’ƒãŒç¢ºèªã•ã‚ŒãŸã€‚ç±³å›½ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ã€CloudFlareã®CEOã‚’å‹™ã‚ã‚‹ãƒžã‚·ãƒ¥ãƒ¼ãƒ»ãƒ—ãƒªãƒ³ã‚¹æ°ã®ãƒ„ã‚¤ãƒ¼ãƒˆã«ã‚ˆã‚‹ã¨ã€2013å¹´3æœˆã«è¦³æ¸¬ã•ã‚ŒãŸâ€œå²ä¸Šæœ€å¤§è¦æ¨¡â€ã®DDoSæ”»æ’ƒã‚’ä¸Šå›žã‚Šã€ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãŒã»ã¼400Gbpsã«é”ã™ã‚‹è¦æ¨¡ã ã£ãŸã¨ã„ã†ã€‚ NTPã¯ã€ã‚·ã‚¹ãƒ†ãƒ ã®å†…éƒ¨æ™‚è¨ˆã‚’æ£ã—ã„æ™‚é–“ã«åŒæœŸã•ã›ã‚‹ãŸã‚ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’å½¢ä½œã‚‹ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ©Ÿå™¨ã‚„ã‚µãƒ¼ãƒãƒ¼ã€ãƒ‡ã‚¹ã‚¯ãƒˆãƒƒãƒ—ãƒžã‚·ãƒ³ãªã©ã§å¹…åºƒãä½¿ã‚ã‚Œã¦ã„ã‚‹ã€‚ ntpdãªã©NTPã®å®Ÿè£…ã®ä¸€éƒ¨ã«ã¯ã€NTPã‚µãƒ¼ãƒãƒ¼ã®å‹•ä½œãƒ¢ãƒ‹ã‚¿ãƒªãƒ³ã‚°ã®ãŸã‚ã«ã€Œmonlistã€æ©Ÿèƒ½ã‚’å‚™ãˆã¦ã„ã‚‹ã‚‚ã®ãŒã‚ã‚‹ã€‚ã“ã®æ©Ÿèƒ½ãŒã€Œæ”»æ’ƒè€…ã«ã¨ã£ã¦ç†æƒ³çš„ãªDDoSãƒ„ãƒ¼ãƒ«ã€ï¼ˆCloudFlareã®ãƒ–ãƒã‚°ï¼‰ã«ãªã£ã¦ã„ã‚‹ã¨ã„ã†ï¼ˆé–¢é€£è¨˜äº‹ï¼šå¢—å¹…æ”»æ’ƒã¯DNSã ã‘ã§ã¯ãªã„â€•â€•NT
yuyamagu 2015/01/27
security

NTP

DDoS

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Archived MSDN and TechNet Blogs
If you were looking for MSDN or Tech Net blogs, please know that MSDN and Tech Net blog sites have been retired, and blog content has been migrated and archived here. How to use this site Archived blogs are grouped alphabetically by the initial letter of the blog name. Select the initial letter from the TOC to see the full list of the blogs. You can also type the name of the blog or the title of the
yuyamagu 2015/01/25
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

å›žé¿ç–ã¾ã¨ã‚

Internet Explorer

IE

ã‚¼ãƒãƒ‡ã‚¤
ãƒªãƒ³ã‚¯
IEã«è¦‹ã¤ã‹ã£ãŸã€Œã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã€ã€â€œã‚¿ã‚¤ãƒŸãƒ³ã‚°â€ã¨â€œèª¤è§£â€ã§é¨’ãŽæ‹¡å¤§
2014å¹´4æœˆæœ«ã€Internet Explorerï¼ˆIEï¼‰ã«æ–°ãŸãªè„†å¼±æ€§ï¼ˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®æ¬ é™¥ï¼‰ãŒè¦‹ã¤ã‹ã‚Šå¤§ããªè©±é¡Œã¨ãªã£ãŸã€‚ä¾‹ãˆã°ãƒ†ãƒ¬ãƒ“ã‚„ä¸€èˆ¬ç´™ã§å¤§ããå–ã‚Šä¸Šã’ã‚‰ã‚Œã€ä¸€éƒ¨ã®åœ°æ–¹è‡ªæ²»ä½“ã‚„ä¼æ¥ã§ã¯ã€IEã®åˆ©ç”¨ã‚„ãƒãƒƒãƒˆã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶é™ã—ãŸã¨ä¼ãˆã‚‰ã‚Œã¦ã„ã‚‹ã€‚ ã ãŒå®Ÿã¯ã€åŒæ§˜ã®è„†å¼±æ€§ã¯éŽåŽ»ã«ä½•åº¦ã‚‚è¦‹ã¤ã‹ã£ã¦ã„ã‚‹ã€‚ã§ã¯ãªãœã€ä»Šå›žã®è„†å¼±æ€§ãŒã“ã‚Œã»ã©è©±é¡Œã«ãªã£ãŸã®ã‹ã€‚ãã‚Œã¯ã€â€œã‚¿ã‚¤ãƒŸãƒ³ã‚°â€ã¨â€œèª¤è§£â€ãŒå¤§ããå½±éŸ¿ã—ãŸã¨è€ƒãˆã‚‰ã‚Œã‚‹ã€‚ ã€Œã‚¼ãƒãƒ‡ã‚¤æ”»æ’ƒã€ã§è„†å¼±æ€§ãŒç™ºè¦š ä»Šå›žã®è„†å¼±æ€§ã¯ã€IEã®ãƒ¡ãƒ¢ãƒªãƒ¼ç®¡ç†ã«é–¢ã™ã‚‹ã‚‚ã®ã ã€‚ç´°å·¥ãŒæ–½ã•ã‚ŒãŸWebã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã ã‘ã§ã€ã‚¦ã‚¤ãƒ«ã‚¹ï¼ˆãƒžãƒ«ã‚¦ã‚¨ã‚¢ï¼‰ã«æ„ŸæŸ“ã—ã€ãƒ‘ã‚½ã‚³ãƒ³ã‚’ä¹—ã£å–ã‚‰ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ã€‚ å®Ÿéš›ã€ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸæ”»æ’ƒãŒç¢ºèªã•ã‚ŒãŸã“ã¨ã§ã€è„†å¼±æ€§ã®å˜åœ¨ãŒç™ºè¦šã—ãŸã¨ã¿ã‚‰ã‚Œã‚‹ã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ï¼ˆãƒ‘ãƒƒãƒï¼‰ãŒæœªå…¬é–‹ã®è„†å¼±æ€§ï¼ˆã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ï¼‰ã‚’çªãæ”»æ’ƒã§ã€ã€Œã‚¼ãƒãƒ‡ã‚¤
yuyamagu 2015/01/25
IE

ã‚¼ãƒãƒ‡ã‚¤

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
BASHã®è„†å¼±æ€§ã§CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã‚¢ãƒ¬ã•ã›ã¦ã¿ã¾ã—ãŸ
ç’°å¢ƒå¤‰æ•°ã«ä»•è¾¼ã¾ã‚ŒãŸã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã—ã¾ã†BASHã®è„†å¼±æ€§ãŒ CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«å½±éŸ¿ã‚’ä¸Žãˆã‚‹ã‹è©¦ã—ã¦ã¿ãŸã‚‰çµæžœã¯æ‚²æƒ¨ãªæ„Ÿã˜ã« Tweet 2014å¹´9æœˆ25æ—¥ å¶‹ç”°å¤§è²´ ã“ã®è¨˜äº‹ã¯2014å¹´ã®ã‚‚ã®ã§ã™ æœã‹ã‚‰ Bash specially-crafted environment variables code injection attack ãªã‚‹ã‚‚ã®ã§é¨’ãŽã«ãªã£ã¦ã„ãŸã®ã§ã€ã•ã£ããæ‰‹å…ƒã® Apacheã§è©¦ã—ã¦ã¿ã¾ã—ãŸã€‚ /hoge.cgiã¨ã„ã†URIã§å®Ÿè¡Œã•ã‚Œã‚‹ã‚ˆã†ã«ã€ä¸€è¡Œã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºåŠ›ã™ã‚‹ã ã‘ã® CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨ç½®ã—ã¾ã™ã€‚ã„ã£ã‘ã‚“ã€ãªã‚“ã®å…¥åŠ›ã‚‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã‹ã‚‰å—ã‘ä»˜ã‘ã¦ã„ãªã„ãŸã‚å±é™ºã®ã‚ã‚Šã‚ˆã†ã‚‚ãªãè¦‹ãˆã¾ã™ã€‚ #!/bin/sh echo "Content-type: text/plain" echo echo "Hi! I'm an ordinary CGI script w
yuyamagu 2014/09/25
bash

security

Shell

vulnerability

è„†å¼±æ€§

cgi

sh
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2014-3511)ã§TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®åŸºç¤Žã‚’å¦ã¶ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã«ã€ æ˜¨æ—¥ OpenSSLã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã€ï¼™ã¤ã®è„†å¼±æ€§ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã®æ•°æ—¥å‰ã«OpenSSLã®æ¬¡æœŸãƒªãƒªãƒ¼ã‚¹äºˆå‘ŠãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã¦ã„ã¾ã—ãŸãŒã€ã¡ã‚‡ã†ã© BlackHat é–‹å‚¬åˆæ—¥ã«ã‚ãŸã‚‹ã“ã¨ã‚‚ã‚ã‚Šã€ãªã‚“ã‹ã¾ãŸé‡å¤§ãªè„†å¼±æ€§ã®ä¿®æ£ãŒå…¥ã‚‹ã‚“ã˜ã‚ƒãªã„ã‹ã¨ãƒ‰ã‚ãƒ‰ã‚ã—ã¦ã„ã¾ã—ãŸã€‚è“‹ã‚’é–‹ã‘ã¦ã¿ã‚‹ã¨HeatBleedç¨‹ã®å¤§äº‹ã§ã¯ãªããƒ›ãƒƒãƒˆã²ã¨å®‰å¿ƒã§ã™ã€‚ æ˜¨æ—¥å…¬é–‹ã•ã‚ŒãŸOpenSSLã®ï¼™ã¤ã®è„†å¼±æ€§ã®ã†ã¡ã€TLS ãƒ—ãƒãƒˆã‚³ãƒ«ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰æ”»æ’ƒ (CVE-2014-3511)ã®ä¿®æ£ã‚’è¦‹ã¦ã„ãŸã¨ã“ã‚ã€ã“ã‚Œã¯TLSãƒ—ãƒãƒˆã‚³ãƒ«ã‚’å¦ã¶ã„ã„é¡Œæã«ãªã‚‹ãªãã¨ãµã¨æ€ã„ã¤ãã€è©¦ã—ã«ã“ã®Opensslã®è„†å¼±æ€§ã®è©³ç´°ã‚’TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®åŸºç¤Žã«åˆã‚ã›ã¦æ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ ã¡ã‚‡ã£ã¨é•·ã„ã§ã™ãŒã€TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®ä»•çµ„ã¿ï¼ˆã®ä¸€éƒ¨ï¼‰ã‚’çŸ¥ã‚ŠãŸã„æ–¹ã¯ãŠèªã¿ãã ã•ã„ã€‚ 2. OpenSSLã®è„†å¼±æ€§
yuyamagu 2014/08/09
OpenSSL

è„†å¼±æ€§

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚µãƒ¼ãƒ

SSL

TLS

ãƒ—ãƒãƒˆã‚³ãƒ«
ãƒªãƒ³ã‚¯
Rails SQL Injection Examplesã®ç´¹ä»‹
6. è„†å¼±æ€§ã®ã‚ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ Copyright Â© 2010-2014 HASH Consulting Corp. 6 @books = Book.where( "publish = '#{params[:publish]}' AND price >= #{params[:price]}") å±±ç”° ç¥¥å¯› (è‘—) Ruby on Rails 4 ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚° æŠ€è¡“è©•è«–ç¤¾ (2014/4/11) ã«è„†å¼±æ€§ã‚’åŠ ãˆã¾ã—ãŸw â€»å…ƒæœ¬ã«è„†å¼±æ€§ãŒã‚ã‚‹ã‚ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ 7. UNION SELECTã«ã‚ˆã‚Šå€‹äººæƒ…å ±ã‚’çªƒå– Copyright Â© 2010-2014 HASH Consulting Corp. 7 priceã«ä»¥ä¸‹ã‚’å…¥ã‚Œã‚‹ 1) UNION SELECT id,userid,passwd,null,mail,null,false,created_at,updated
yuyamagu 2014/06/11
sql

injection

rails

hash

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Nginxå°Žå…¥æ™‚ã€ã‚µã‚¯ãƒƒã¨å¯¾å¿œã—ã¦ãŠãã¨è‰¯ã„ã‹ã‚‚ã—ã‚Œãªã„ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
yuyamagu 2014/04/24
nginx

http

ã‚µãƒ¼ãƒ

è„†å¼±æ€§

ssl
ãƒªãƒ³ã‚¯
ä¾‹ãˆã°ã€Strutsã‚’é¿ã‘ã‚‹
ã¯ã˜ã‚ã« ç†è€…ã¯10å¹´ä»¥ä¸Šã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã‚’ä¸»ãªæ¥å‹™ã¨ã™ã‚‹Javaãƒ—ãƒã‚°ãƒ©ãƒžã§ã‚ã£ãŸã«ã‚‚é–¢ã‚ã‚‰ãšã€Strutsã«ã¤ã„ã¦ã¯ã“ã‚Œã¾ã§ãšã£ã¨é£Ÿã‚ãšå«Œã„ã§ã—ãŸã€‚åˆæœŸã®Strutsã¯ã€ŒXMLã ã‚‰ã‘ã§åŠ¹çŽ‡ãŒæ‚ªãã†ã€ã¨ã„ã†ã‚¤ãƒ¡ãƒ¼ã‚¸ãŒå¼·ã‹ã£ãŸãŸã‚ã§ã™ã€‚æœ€è¿‘ã¯Ruby on Railsç‰ã®å½±éŸ¿ã‚’å—ã‘CoC(convention over configuration)ã‚’æŽ¡ã‚Šå…¥ã‚Œã€XMLåœ°ç„ã‚‚ã ã„ã¶è§£æ¶ˆã—ãŸã‚ˆã†ã§ã™ã€‚ Strutsã¯Javaã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚‰ã—ããªã„ç¨®é¡žï¼ˆä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç‰ï¼‰ã®è„†å¼±æ€§ã‚’é€£ç™ºã™ã‚‹ã“ã¨ã§ã‚‚çŸ¥ã‚‰ã‚Œã¦ãŠã‚Šã€æœ€è¿‘ã¯æˆ‘ã€…ã®æä¾›ã™ã‚‹SaaSåž‹WAFã‚µãƒ¼ãƒ“ã‚¹ã€Scutum(ã‚¹ã‚ãƒ¥ãƒ¼ã‚¿ãƒ )ã®ãŠå®¢æ§˜ã‹ã‚‰ã‚‚é »ç¹ã«Strutsã«ã¤ã„ã¦ã®å•ã„åˆã‚ã›ã‚’å—ã‘ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ã¾ãŸã€åŽ»å¹´è¦‹ã¤ã‹ã£ãŸä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã§ã¯ã€è„†å¼±æ€§ã®å…¬è¡¨å¾Œã™ãã«PoCãŒå‡ºå›žã‚Šå®Ÿéš›ã«æ”»æ’ƒãŒç™ºç”Ÿã™ã‚‹ãªã©ã€æ‚ªã„æ„å‘³ã§æ³¨ç›®
yuyamagu 2014/04/23
Struts

ã‚³ãƒ¼ãƒ‰

è„†å¼±æ€§

WAF
ãƒªãƒ³ã‚¯
Androidãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ã‚¢ãªã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°
ã‚«ãƒ¼ãƒã‚®ãƒ¼ãƒ¡ãƒãƒ³å¤§å¦ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢å·¥å¦ç ”ç©¶æ‰€(Software Engineering Institute)ã«æ‰€å±žã™ã‚‹CERT Secure Codingãƒãƒ¼ãƒ ã¯å…ˆé ƒï¼Œå¯¾è±¡ã‚’Androidä¸Šã®Javaã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ç‰¹å®šã—ãŸã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚ ä»Šå›žã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯ï¼Œ2013å¹´ã«CERT Javaã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°æ¨™æº– (Secure Coding Standard for Java)ã‚’å…¬é–‹ã—ãŸå¾Œï¼Œæ›¸ç±"Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs"ã‚’è‘—ã—ãŸï¼ŒCERTã®ã“ã‚Œã¾ã§ã®æ´»å‹•ã®å»¶é•·ç·šä¸Šã«ã‚ã‚‹ã‚‚ã®ã ã€‚ãã®ãŸã‚ï¼Œæ–°ãŸãªAndroidç”¨ã®ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãƒ«ãƒ¼ãƒ«ã¨ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ä¸€éƒ¨ã¯ï¼Œæ—¢å˜ã®Javaã®ãƒ«ãƒ¼ãƒ«ã¨ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã‚’Androidãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã«å½“ã¦
yuyamagu 2014/04/23
android

coding

java

ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°

è„†å¼±æ€§

programming

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

develop
ãƒªãƒ³ã‚¯
DeNA Engineering - DeNAã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒãƒ¼ã‚¿ãƒ«ã‚µã‚¤ãƒˆ
æŠ€è¡“ã‚’æ´»ã‹ã—ã€æ–°ã—ã„ä¾¡å€¤ã‚’å‰µé€ ã™ã‚‹ DeNAã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¯ã€æƒ³åƒã‚’è¶…ãˆã‚‹Delightã‚’å±Šã‘ã‚‹ãŸã‚ã«ä½•ãŒã§ãã‚‹ã‹ã‚’è€ƒãˆã€æŠ€è¡“åŠ›ã¨ç™ºæƒ³åŠ›ã§æ–°ã—ã„ä¾¡å€¤ã‚’ç”Ÿã¿å‡ºã—ã¦ã„ã¾ã™ã€‚ å¤šæ§˜ãªå°‚é–€æ€§ã‚’æŒã£ãŸã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒåˆ‡ç£‹ç¢ç£¨ã—ã€äº’ã„ã«åˆºæ¿€ã—åˆãˆã‚‹ç’°å¢ƒã‚„åˆ¶åº¦ãŒã•ã‚‰ãªã‚‹æˆé•·ã¸ã¨ã¤ãªã’ã¾ã™ã€‚
yuyamagu 2014/04/15
OpenSSL

è„†å¼±æ€§

Security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ssl
ãƒªãƒ³ã‚¯
OpenSSLã®ã€ŒHeartbleedã€è„†å¼±æ€§ã¯2å¹´å‰ã‹ã‚‰å˜åœ¨ã€ã€Œæœ€æ‚ªã®ã‚±ãƒ¼ã‚¹ã‚’æƒ³å®šã—ã¦å¯¾å‡¦ã‚’ã€ã¨å°‚é–€å®¶
OpenSSLã®ã€ŒHeartbleedã€è„†å¼±æ€§ã¯2å¹´å‰ã‹ã‚‰å˜åœ¨ã€ã€Œæœ€æ‚ªã®ã‚±ãƒ¼ã‚¹ã‚’æƒ³å®šã—ã¦å¯¾å‡¦ã‚’ã€ã¨å°‚é–€å®¶ï¼šãƒã‚§ãƒƒã‚¯æ–¹æ³•ã¾ã¨ã‚ ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®SSL/TLSå®Ÿè£…ã€ŒOpenSSLã€ã«è¦‹ã¤ã‹ã£ãŸæƒ…å ±æ¼ãˆã„ã«ã¤ãªãŒã‚‹è„†å¼±æ€§ã®å½±éŸ¿ãŒæ‹¡å¤§ã€‚å°‚é–€å®¶ã¯ã€Œæœ€æ‚ªã®ã‚±ãƒ¼ã‚¹ã€ã¤ã¾ã‚Šç§˜å¯†éµã®æ¼ãˆã„ã‚’æƒ³å®šã—ã¦å¯¾å‡¦ã™ã¹ãã€ã¨è¿°ã¹ã¦ã„ã‚‹ã€‚ ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®SSL/TLSå®Ÿè£…ã€ŒOpenSSLã€ã«è¦‹ã¤ã‹ã£ãŸæƒ…å ±æ¼ãˆã„ã«ã¤ãªãŒã‚‹è„†å¼±æ€§ã®å½±éŸ¿ãŒæ‹¡å¤§ã—ã¦ã„ã‚‹ã€‚OSã‚„ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ©Ÿå™¨ã®ä¸ã«ã¯ã€è„†å¼±æ€§ã®ã‚ã‚‹OpenSSLã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚‚ã®ãŒå¤šæ•°ã‚ã‚Šã€ãƒ™ãƒ³ãƒ€ãƒ¼å„ç¤¾ãŒç¢ºèªãƒ»å¯¾å¿œã‚’é€²ã‚ã¦ã„ã‚‹ã€‚å›½å†…ã§ã‚‚ã“ã®è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚µã‚¤ãƒˆãŒç¢ºèªã•ã‚Œã¦ãŠã‚Šã€ä¸ã«ã¯ä¸€æ™‚çš„ã«ã‚µãƒ¼ãƒ“ã‚¹ã‚’åœæ¢ã—ã€å¯¾å‡¦ã‚’å„ªå…ˆã—ãŸã‚µãƒ¼ãƒ“ã‚¹ã‚‚ã‚ã‚‹ã€‚ ã“ã®è„†å¼±æ€§ã¯ã€OpenSSL ãƒãƒ¼ã‚¸ãƒ§ãƒ³1.0.1ï¼1.0.2ç³»ã«å˜åœ¨ã™ã‚‹ã€‚Heartbeatæ‹¡å¼µã®å®Ÿè£…ã«è¦‹ã¤ã‹
yuyamagu 2014/04/11
è„†å¼±æ€§

OpenSSL

Security

ssl

Heartbleed

ä»•äº‹

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æƒ…å ±
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: jQuery Mobile 1.2 Betaæœªæº€ã¯èªã¿è¾¼ã‚“ã§ã„ã‚‹ã ã‘ã§XSSè„†å¼±æ€§ã‚’ä½œã‚Šã¾ã™
(2012/9/25 æœ€å¾Œã«é‡è¦ãªè¿½è¨˜ãŒã‚ã‚Šã¾ã™ã€‚ ) jQuery Mobile 1.2 BetaãŒã•ãã»ã©ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸã‚ˆã†ã§ã™ã€‚ ã‚¿ã‚¤ãƒˆãƒ«ã®é€šã‚Šã€ãã‚Œã«æº€ãŸãªã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®jQuery Mobileã«ã¯èªã¿è¾¼ã‚“ã§ã„ã‚‹ã ã‘ã§XSSè„†å¼±æ€§ã‚’ä½œã£ã¦ã—ã¾ã†å•é¡ŒãŒã‚ã‚Šã¾ã™ã€‚ãŠä½¿ã„ã®æ–¹ã¯ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’ãŠå‹§ã‚ã—ã¾ã™ã€‚ jQuery Mobile 1.2 Beta Released | jQuery Mobile http://jquerymobile.com/blog/2012/09/05/jquery-mobile-1-2-beta-released/ ä»¥å‰ã®è¨˜äº‹ã§è§¦ã‚ŒãŸã€ä¸€éƒ¨ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®location.hrefã®æŒ™å‹•ã«çµ¡ã‚€XSSãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»¥ä¸‹ã®ä»¶ã¨ã¯åˆ¥ã®ä¿®æ£ã§ã‚ã‚‹ã“ã¨ã«æ³¨æ„ã—ã¦ãã ã•ã„ã€‚ jQuery Mobileã®XSSã«ã¤ã„ã¦ã®è§£èª¬ - é‡‘åˆ©0ç„¡åˆ©æ¯ã‚ãƒ£ãƒƒã‚·ãƒ³ã‚° â€“ ã‚ãƒ£ãƒƒã‚·
yuyamagu 2012/09/06
jquery

mobile

xss

ãƒ–ãƒ©ã‚¦ã‚¶

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

jquery mobile

jquerymobile

è„†å¼±æ€§

location
ãƒªãƒ³ã‚¯
1