はじめに 対象イベント 読み方、使い方 Remote Code Execution(RCE) 親ディレクトリ指定によるopen_basedirのバイパス PHP-FPMのTCPソケット接続によるopen_basedirとdisable_functionsのバイパス JavaのRuntime.execでシェルを実行 Cross-Site Scripting(XSS) nginx環境でHTTPステータスコードが操作できる場合にCSPヘッダーを無効化 GoogleのClosureLibraryサニタイザーのXSS脆弱性 WebのProxy機能を介したService Workerの登録 括弧を使わないXSS /記号を使用せずに遷移先URLを指定 SOME(Same Origin Method Execution)を利用してdocument.writeを順次実行 SQL Injection MySQ
GitHub - modelcontextprotocol/servers: Model Context Protocol Servers
Official integrations are maintained by companies building production ready MCP servers for their platforms. 21st.dev Magic - Create crafted UI components inspired by the best 21st.dev design engineers. 2slides - An MCP server that provides tools to convert content into slides/PPT/presentation or generate slides/PPT/presentation with user intention. ActionKit by Paragon - Connect to 130+ SaaS inte
How modern browsers work
Note: For those eager to dive deep into how browsers work, an excellent resource is Browser Engineering by Pavel Panchekha and Chris Harrelson (available at browser.engineering). Please do check it out. This article is an overview of how browsers work. Web developers often treat the browser as a black box that magically transforms HTML, CSS, and JavaScript into interactive web applications. In tru
This blog post hopes to convince you that Python is a compiled language. And by “Python”, I don’t mean alternate versions of Python like PyPy, Mypyc, Numba, Cinder, or even Python-like programming languages like Cython, Codon, Mojo1—I mean the regular Python: CPython! The Python that is probably installed on your computer right now. The Python that you got when you searched “python” on Google and
Shai Hulud Strikes Again (v2)Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected. Update: November 26, 2025 PostHog has published a detailed post mortem describing how one of its GitHub Actions workflows was abused as an initial access vector for Shai Hulud v2. An attacker briefly opened a pull request that modified a script executed via pull_requ
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability | Microsoft Security Blog
January 10, 2022 recap – The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only applications that use vulnerable libraries, but also any services that use these applications, so customers may
Introduction This article focuses on tasks that application programmers are likely to encounter, particularly in web applications, such as: Reading and writing text files Reading text, images, JSON from the web Visiting files in a directory Reading a ZIP file Creating a temporary file or directory The Java API supports many other tasks, which are explained in detail in the Java I/O API tutorial. T
Part 2 is here: Code generation and basic optimizations JavaScript is getting very popular now. “Write once, run everywhere” — it’s about JavaScript (not only Java)! But what is behind this “Run everywhere”? V8, SpiderMonkey, JavaScript core, and more and more engines. A good example of “Run everywhere” was Nashorn and Rhino, but have you ever heard about these engines, based on Java Virtual Machi
Part of the Spectral API Security Series Collaboration is key. Not only in software development. But when it comes to collaboration on Git repositories, the word “key” takes on a whole new meaning. Whether it’s API Keys, passwords, or digital certificates; the secrets used to authenticate access must remain secure. The open nature and convenience of Git repositories are often encumbered by human-e
What D-Bus is D-Bus serves various purposes aiming to facilitate the cooperation between different processes in the system. This article will describe D-Bus and how it performs this function. From the D-Bus creators definition: D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it
匿名加工情報の作成に使う鍵つきハッシュの鍵をPBKDF2で生成する - Lazy Diary @ Hatena Blog
個人情報を含むデータをもとにプログラムのテストデータを作成する場合などには、データの匿名化が必要になります。個人情報保護委員会「個人情報の保護に関する法律についてのガイドライン（匿名加工情報編）」*1には、管理用IDなど特定の個人の識別に使える情報を加工する際は「乱数等の他の記述等を加えた上でハッシュ関数等を用いるなどの手法を用いる」よう記載されています。 噛みくだくと、たとえば会員データベースから匿名加工情報を作りたかったら 会員IDなどの情報はHMAC-SHA256などの鍵つきハッシュでハッシュ化しろ 鍵は匿名加工情報の提供先には渡すな 複数の提供先に匿名加工情報を渡すならHMAC-SHA256の鍵は別々にしろ ということだと思います。これは、SHA-256などで単純にハッシュ化した場合、匿名化した情報を受け取った人は以下のような攻撃が可能になってしまうからでしょうね。 たとえば、従業
Update 1.64.1: The update addresses these security issues. Update 1.64.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the January 2022 release of Visual Studio Code. There are many updates in this version that we hope you will like, some of the key highlights include: New Side Panel - Display more view
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally the APTIS ticket1, which later got replaced by a slightly easier to read version printed onto the same stock. Nowadays, the industry would very much like you to ditch your paper ticket in favour of a fancy mobile barcode one (or an ITSO smartcard2); not only do the
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
【2020年】CTF Web問題の攻撃手法まとめ - こんとろーるしーこんとろーるぶい
Python is a Compiled Language
Shai Hulud Strikes Again (v2) - Socket
Common I/O Tasks in Modern Java - Dev.java
Inside JavaScript Engines, Part 1: Parsing
Top 9 Git Secret Scanning Tools for DevSecOps - Spectral
D-Bus overview - Fedora Magazine
January 2022 (version 1.64)
Reversing UK mobile rail tickets