[B! WAF] yuyamaguã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yuyamagu id:yuyamagu

WAFã«é–¢ã™ã‚‹yuyamaguã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ä¾‹ãˆã°ã€Strutsã‚’é¿ã‘ã‚‹
ã¯ã˜ã‚ã« ç†è€…ã¯10å¹´ä»¥ä¸Šã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã‚’ä¸»ãªæ¥å‹™ã¨ã™ã‚‹Javaãƒ—ãƒã‚°ãƒ©ãƒžã§ã‚ã£ãŸã«ã‚‚é–¢ã‚ã‚‰ãšã€Strutsã«ã¤ã„ã¦ã¯ã“ã‚Œã¾ã§ãšã£ã¨é£Ÿã‚ãšå«Œã„ã§ã—ãŸã€‚åˆæœŸã®Strutsã¯ã€ŒXMLã ã‚‰ã‘ã§åŠ¹çŽ‡ãŒæ‚ªãã†ã€ã¨ã„ã†ã‚¤ãƒ¡ãƒ¼ã‚¸ãŒå¼·ã‹ã£ãŸãŸã‚ã§ã™ã€‚æœ€è¿‘ã¯Ruby on Railsç‰ã®å½±éŸ¿ã‚’å—ã‘CoC(convention over configuration)ã‚’æŽ¡ã‚Šå…¥ã‚Œã€XMLåœ°ç„ã‚‚ã ã„ã¶è§£æ¶ˆã—ãŸã‚ˆã†ã§ã™ã€‚ Strutsã¯Javaã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚‰ã—ããªã„ç¨®é¡žï¼ˆä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç‰ï¼‰ã®è„†å¼±æ€§ã‚’é€£ç™ºã™ã‚‹ã“ã¨ã§ã‚‚çŸ¥ã‚‰ã‚Œã¦ãŠã‚Šã€æœ€è¿‘ã¯æˆ‘ã€…ã®æä¾›ã™ã‚‹SaaSåž‹WAFã‚µãƒ¼ãƒ“ã‚¹ã€Scutum(ã‚¹ã‚ãƒ¥ãƒ¼ã‚¿ãƒ )ã®ãŠå®¢æ§˜ã‹ã‚‰ã‚‚é »ç¹ã«Strutsã«ã¤ã„ã¦ã®å•ã„åˆã‚ã›ã‚’å—ã‘ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ã¾ãŸã€åŽ»å¹´è¦‹ã¤ã‹ã£ãŸä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã§ã¯ã€è„†å¼±æ€§ã®å…¬è¡¨å¾Œã™ãã«PoCãŒå‡ºå›žã‚Šå®Ÿéš›ã«æ”»æ’ƒãŒç™ºç”Ÿã™ã‚‹ãªã©ã€æ‚ªã„æ„å‘³ã§æ³¨ç›®
yuyamagu 2014/04/23
Struts

ã‚³ãƒ¼ãƒ‰

è„†å¼±æ€§

WAF
ãƒªãƒ³ã‚¯
MongoDBã¨ãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡
ã¯ã˜ã‚ã« WAFã€ŒScutumï¼ˆã‚¹ã‚ãƒ¥ãƒ¼ã‚¿ãƒ ï¼‰ã€ã§ã¯ã‚µãƒ¼ãƒ“ã‚¹é–‹å§‹æ™‚ã‚ˆã‚Šã€ãƒ‡ãƒ¼ã‚¿ã‚¹ãƒˆã‚¢ã¨ã—ã¦memcachedã¨pgpool II+PostgreSQLã‚’åˆ©ç”¨ã—ã¦ã„ã¾ã™ã€‚ã“ã‚Œã‚‰ã¯ã©ã‚Œã‚‚å®‰å®šã—ã¦å‹•ã„ã¦ãŠã‚Šæº€è¶³ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€æœ€è¿‘ã«ãªã£ã¦ã‚ˆã‚ŠæŸ”è»Ÿã«ãƒ‡ãƒ¼ã‚¿ã‚’å–ã£ã¦ã„ããŸã„ã¨ã„ã†ãƒ‹ãƒ¼ã‚ºãŒé«˜ããªã£ã¦ããŸãŸã‚ã€Mongo DBã®å°Žå…¥ã‚’è¡Œã„ã¾ã—ãŸã€‚ã¾ã å®Œå…¨ãªãƒªãƒ—ãƒ¬ãƒ¼ã‚¹ã¾ã§ã¯è‡³ã£ã¦ã„ã¾ã›ã‚“ãŒã€å…ƒã€…ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ã‚¹ã‚ãƒ¼ãƒžæ§‹é€ ãŒã‚·ãƒ³ãƒ—ãƒ«ã§ã‚ã‚‹ã“ã¨ã‚‚ã‚ã‚Šã€æ•°ãƒ¶æœˆä»¥å†…ã«ã¯pgpool II+PostgreSQLã®éƒ¨åˆ†ã‚’Mongo DBï¼ˆReplica Setsï¼‰ã§ç½®ãæ›ãˆã‚‹ã“ã¨ãŒã§ãã‚‹ã®ã§ã¯ãªã„ã‹ã¨æ€ã£ã¦ã„ã¾ã™ã€‚ Mongo DBã«ã¨ã£ã¦ã®ã€Œãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡ã€ Mongo DBã‚’å°Žå…¥ã™ã‚‹ã«ã‚ãŸã‚Šã€Linux(X86_64ï¼‰ä¸Šã§Mongo DBã‚’å‹•ä½œã•ã›ãŸã¨ãã®ãƒ¡ãƒ¢ãƒªã®æ¶ˆè²»ã«ã¤ã„ã¦ã€ç°¡å˜ã«ã§ã™ãŒèª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ã¾ãšå‚è€ƒã«ã—ãŸã®
yuyamagu 2011/07/05
PostgreSQL

performance

mongodb

ãƒ¡ãƒ¢ãƒªç®¡ç†

ã‚µãƒ¼ãƒ

WAF

memory
ãƒªãƒ³ã‚¯
,97äººä¼¦å½±é™¢Açº§æ¯›ç‰‡,å›½äº§Aâ…¤æ¿€æƒ…æ— ç ä¹…ä¹…ç”·ç”·å‰§,äºšæ´²ä¸æ–‡å—å¹•æ— ç æ—¥éŸ©
,97äººä¼¦å½±é™¢Açº§æ¯›ç‰‡,å›½äº§Aâ…¤æ¿€æƒ…æ— ç ä¹…ä¹…ç”·ç”·å‰§,äºšæ´²ä¸æ–‡å—å¹•æ— ç æ—¥éŸ©,ç²¾å“æ— ç AVä¸€åŒºäºŒåŒºä¸‰åŒºä¸å¡,ä¸æ–‡å—å¹•ä¹±è§†é¢‘åœ¨çº¿è§‚çœ‹,99ä¹…ä¹…å›½äº§ç»¼åˆç²¾å“æˆäººå½±é™¢,76å°‘å¦‡ç²¾å“å¯¼èˆª,å›½äº§AVæ— ç ä¸“åŒºäºšæ´²AV,å›½äº§æ—¥äº§äºšæ´²ç³»åˆ—æœ€æ–°,æ—¥æœ¬å…è´¹ä¸€åŒºäºŒåŒºä¸‰åŒºæ¿€æƒ…è§†é¢‘
yuyamagu 2008/11/06
security

WAF

PCIDSS
ãƒªãƒ³ã‚¯
mod rewriteã‚’ä½¿ç”¨ã—ãŸç°¡æ˜“WAF
(Last Updated On: 2018å¹´8æœˆ8æ—¥)http://www.0x000000.com/?i=567 ã«mod rewriteã‚’åˆ©ç”¨ã—ãŸç°¡æ˜“WAF(Web Application Firewall)ã®å®šç¾©ä¾‹ãŒæŽ²è¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚åŒã˜ã‚ˆã†ãªã‚¢ã‚¤ãƒ‡ã‚¢ã‚’ãŠæŒã¡ã®æ–¹ã€æ—¢ã«ä¼¼ãŸã‚ˆã†ãªè¨å®šã‚’ä½¿ã‚ã‚Œã¦ã„ã‚‹æ–¹ã‚‚å¤šã„ã¨ã¯æ€ã„ã¾ã™ã€‚ ç°¡å˜ãªWAFã§ã™ãŒã€å®Ÿç”¨æ€§ã‚‚é«˜ã„ã§ã™ã€‚ä¾‹ãˆã°ã€ãƒŒãƒ«æ–‡å—ã‚„HTMLç‰¹æ®Šæ–‡å—ã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¯æ§˜ã€…ãªæ”»æ’ƒã§åˆ©ç”¨ã•ã‚Œã¾ã™ã€‚ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§å¯¾å‡¦ãŒå¿˜ã‚Œã‚‰ã‚ŒãŒã¡ãªCOOOKIEã‚„REFERã€USER_AGENTç‰ã«ç‰¹æ®Šæ–‡å—ãŒå…¥ã£ã¦ã„ãŸå ´åˆã«ã‚¢ã‚¯ã‚»ã‚¹ã‚’æ‹’å¦ã™ã‚‹éƒ¨åˆ†ã ã‘ã‚‚ã§å°Žå…¥ã™ã‚‹ä¾¡å€¤ã¯ååˆ†ã«ã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ å…ƒãƒã‚¿ã®ã‚µã‚¤ãƒˆã¯è‹±èªžã§ã™ãŒã€è§£èª¬ä»˜ãã§ã™ã€‚ ã“ã‚Œã‚’å…¥ã‚Œã‚‹ã¨å•é¡Œã¨ãªã‚‹å ´åˆã‚‚ã‚ã‚‹ã®ã§ã€å†…å®¹ã‚’ç†è§£ã—ã¦ã‹ã‚‰åˆ©ç”¨ã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ RewriteEngine On Op
yuyamagu 2008/05/19
security

webapp

WAF
ãƒªãƒ³ã‚¯
AQTRONiX
AQTRONiX WebKnight - Open Source Web Application Firewall (WAF) for IIS What is it? Features Download Install F.A.Q. What is it? AQTRONIX WebKnight is an application firewall for IIS and other web servers and is released under the GNU General Public License. More particularly it is an ISAPI filter that secures your web server by blocking certain requests. If an alert is triggered WebKnight will ta
yuyamagu 2007/06/14
IISç”¨ã®WAF ISAPIãƒ•ã‚£ãƒ«ã‚¿

WAF

webappsec
ãƒªãƒ³ã‚¯
ã€ŒWAFã€ã¯2006å¹´ã®ãƒãƒƒãƒˆã‚µãƒ¼ãƒ“ã‚¹é˜²å¾¡ãƒˆãƒ¬ãƒ³ãƒ‰ã‹ï¼Ÿ
ã€ŒWAFã€ã¯2006å¹´ã®ãƒãƒƒãƒˆã‚µãƒ¼ãƒ“ã‚¹é˜²å¾¡ãƒˆãƒ¬ãƒ³ãƒ‰ã‹ï¼Ÿï¼šã‚¹ãƒ‘ãƒ æ™‚ä»£ã®ã‚µãƒ‹ã‚¿ã‚¤ã‚ºé–‹ç™ºæ‰‹æ³•ï¼ˆ1/2 ãƒšãƒ¼ã‚¸ï¼‰ å¾“æ¥ã®ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã§ã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å®ˆã‚Šåˆ‡ã‚Œãªã„ã€‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®ã‚µãƒ¼ãƒ“ã‚¹ã«æ ¹ã–ã™ä¼æ¥ã§ã¯ã€ã‚µã‚¤ãƒˆç¨¼åƒçŽ‡ãŒä¿¡é ¼ã®ãƒãƒãƒ¡ãƒ¼ã‚¿ãƒ¼ã ã€‚Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½¿ã£ã¦ã„ã‚‹ãªã‚‰ã°ã€WAFã®å°Žå…¥ãŒå¿…é ˆã®ã‚‚ã®ã¨ãªã£ã¦ã„ã‚‹ã€‚ ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒ»ãƒ ãƒƒã‚¯ã€Œã‚¹ãƒ‘ãƒ æ™‚ä»£ã®ã‚µãƒ‹ã‚¿ã‚¤ã‚ºé–‹ç™ºæ‰‹æ³•ã€ã§ã¯ã€ã“ã‚Œã¾ã§æƒ…å ±æ¼ãˆã„ã«å¯¾ã™ã‚‹é˜²å¾¡ç–ã‚’ã•ã¾ã–ã¾ãªè¦³ç‚¹ã‹ã‚‰è§£èª¬ã—ã¦ããŸã€‚ ã€Œã‚µãƒ¼ãƒã®è¤‡é›‘ã•ãŒå¤‰ãˆãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€Œã‚µãƒ‹ã‚¿ã‚¤ã‚ºã€ã¨ã¯ã€ã§ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹ã‚µãƒ‹ã‚¿ã‚¤ã‚ºã®ä»•çµ„ã¿ã‚’è§£èª¬ã—ã€ã€Œå·§å¦™åŒ–ã™ã‚‹ãƒãƒƒãƒˆåœ°é›·åŽŸã®é¿ã‘æ–¹ã€ã¨ã€Œã‚ã®CGIãŒã‚¯ãƒ©ãƒƒã‚¯ã•ã‚Œã¦ã—ã¾ã£ãŸç†ç”±ã€ã§ã¯ã€Perlè¨€èªžã‚’ä¾‹ã«ã—ã¦é˜²å¾¡ç–ã®é‡è¦æ€§ã‚’ç¤ºã—ãŸã€‚ã„ãšã‚Œã‚‚ãŒã‚µãƒ¼ãƒ“ã‚¹æŒ‡å‘ã¨ãªã£ã¦ããŸWebã‚µã‚¤ãƒˆã§é‡è¦è¦–ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„é˜²å¾¡ãƒŽã‚¦ãƒã‚¦ã°ã‹ã‚Šã
yuyamagu 2006/05/11
WAF

security
ãƒªãƒ³ã‚¯
The Web Application Security Consortium / Web Application Firewall Evaluation Criteria
yuyamagu 2006/05/11
security

WAF
ãƒªãƒ³ã‚¯
1