Upgrade to Pro — share decks privately, control downloads, hide ads and more …

0802徳丸.pdf

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for tanakata tanakata
August 02, 2017
0
50

 0802徳丸.pdf

Avatar for tanakata

tanakata

August 02, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
37
20171110
Avatar for tanakata tanakata
0
47
1013
Avatar for tanakata tanakata
0
50
徳丸0922
Avatar for tanakata tanakata
0
75
0901
Avatar for tanakata tanakata
0
42
2017/08/25
Avatar for tanakata tanakata
0
46
徳丸20170721.pdf
Avatar for tanakata tanakata
0
39

Featured

See All Featured
Visualization
Avatar for Eitan Lees eitanlees
150
17k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
220
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
31
9.9k
Beyond borders and beyond the search box: How to win the global "messy middle" with AI-driven SEO
Avatar for David Carrasco davidcarrasco
1
50
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
210
24k
Have SEOs Ruined the Internet? - User Awareness of SEO in 2025
Avatar for Akash Hashmi akashhashmi
0
270
SERP Conf. Vienna - Web Accessibility: Optimizing for Inclusivity and SEO
Avatar for Sara Fernández Carmona sarafernandez
1
1.3k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
432
66k
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
130
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
640
Dealing with People You Can't Stand - Big Design 2015
Avatar for Cassini Nazir cassininazir
367
27k
The Organizational Zoo: Understanding Human Behavior Agility Through Metaphoric Constructive Conversations (based on the works of Arthur Shelley, Ph.D)
Avatar for Dr. Kim W Petersen kimpetersen
PRO
0
240

Transcript

  1. 2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ

  2. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ

  3. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ

  4. ηογϣϯͷ͓͞Β͍

  5. ηογϣϯͱ͸ ϩάΠϯ͔ͯ͠ΒϩάΞ΢τ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯ؅ཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ৘ ใ΍ΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷ৘ใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ

  6. ηογϣϯϋΠδϟοΫͱ͸ ౪೉ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧ΢ϯτΛ৐ͬऔΔ߈ܸ

  7. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  8. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  9. ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰ౰ͯΕͦ͏ͳจࣈྻʣ

  10. ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ର৅ΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰର৅ΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ࢖͏

  11. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  12. ౪೉ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ৔߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥ΢β͕ ૹ৴ͯ͘͠Δ

    REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID ͸ COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍৔߹ʹ ΋ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ

  13. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  14. ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸ͸ɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ৔߹ɺͦͷηογϣϯIDΛݩʑ ஌͍ͬͯΔѱҙΛ࣋ͬͨϢʔβ͸ϩάΠϯͨ͠Ϣʔβʹ੒Γ୅Θͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ

  15. ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱ͸ผʹೝՄ͞Εͨ͜ͱΛূ໌͢Δ৘ใΛ෇Ճ͢Δɻ

  16. ·ͱΊ

  17. ·ͱΊ ɾηογϣϯ؅ཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ࢖͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪೉ରࡦʣ →ΫοΩʔͰηογϣϯIDΛ؅ཧ͢Δ ɾೝূ੒ޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ

  18. ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠