{"id":121,"date":"2016-03-11T14:09:35","date_gmt":"2016-03-11T05:09:35","guid":{"rendered":"https:\/\/iwako.pgw.jp\/?p=121"},"modified":"2019-03-28T12:42:10","modified_gmt":"2019-03-28T03:42:10","slug":"%e6%8b%be%e8%82%86-apache2%e3%81%ae%e8%a8%ad%e5%ae%9a-%e8%82%86","status":"publish","type":"post","link":"https:\/\/iwako.pgw.jp\/?p=121","title":{"rendered":"\u62fe\u8086-apache2\u306e\u8a2d\u5b9a-\u8086"},"content":{"rendered":"

\"trace\"<\/p>\n

\u30fbHTTP TRACE\u30e1\u30bd\u30c3\u30c9\u3092\u7121\u6548\u306b\u3059\u308b
\n\u306a\u3093\u3060\u305d\u308a\u3083\u3063\u3066\u611f\u3058\u3060\u304c\u3001\u3053\u306eTRACE\u30e1\u30bd\u30c3\u30c9\u304c\u6709\u6548\u3060\u3068\u3001
\n\u3044\u308d\u3044\u308d\u3068\u6f0f\u308c\u305f\u3089\u307e\u305a\u3044\u60c5\u5831\u304c\u62d4\u304d\u51fa\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308b\u3002\u2026\u3089\u3057\u3044\u3002
\n\u5177\u9ad4\u7684\u306b\u306f\u3001\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff08XSS\uff09\u3068TRACE\u30e1\u30bd\u30c3\u30c9\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3068\u3001
\nBasic\u8a8d\u8b49\u3068\u304b\u306e\u60c5\u5831\u3092\u62d4\u304d\u51fa\u3059\u3053\u3068\u304c\u53ef\u80fd\u306a\u306e\u3060\u3002\u2026\u3089\u3057\u3044\u3002
\nTRACE\u30e1\u30bd\u30c3\u30c9\u3068\u3044\u3046\u306e\u306fHTTP\u30e1\u30bd\u30c3\u30c9\u306e\uff18\u6840\u3001
\n\u30fbGET
\n\u30fbPOST
\n\u30fbHEAD
\n\u30fbPUT
\n\u30fbDELETE
\n\u30fbOPTIONS
\n\u30fbTRACE
\n\u30fbCONNECT
\n\u306e\u4e00\u3064\u306a\u306e\u3060\uff01\u2026\u3089\u3057\u3044\u3002
\nGET\u3068POST\u4ee5\u5916\u521d\u3081\u3066\u77e5\u3063\u305f\u305c\uff01
\nTRACE\u30e1\u30bd\u30c3\u30c9\u306f\u9001\u3089\u308c\u3066\u304d\u305fHTTP\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u305d\u306e\u307e\u307e\u8fd4\u3057\u3066\u3057\u307e\u3046\u3089\u3057\u304f\u3001
\nXSS\u3068\u7d44\u307f\u308f\u305b\u3066\u4f7f\u308f\u308c\u308b\u3068\u5371\u96aa\u306a\u306e\u3060\u305d\u3046\u306a\u3002<\/p>\n

\u307e\u305a\u306f\u3001TRACE\u30e1\u30bd\u30c3\u30c9\u304c\u6709\u6548\u304b\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3002
\n\u203b\u81ea\u5206\u3067\u6253\u3064\u6587\u5b57\u306f\u9ed1\u3001\u6253\u3061\u8fbc\u307e\u306a\u3044\u6587\u5b57\u306f\u30b0\u30ec\u30fc
\n$ telnet localhost 80
\nTrying 127.0.0.1…<\/span>
\n Connected to localhost.<\/span>
\n Escape character is ‘^]’.<\/span>
\nTRACE \/ HTTP\/1.0
\nHOST: TRACE_TEST
\n\uff08return\u4e8c\u56d8\uff09<\/p>\n


\nHTTP\/1.1 405 Method Not Allowed
\nDate: Fri, 11 Mar 2016 04:12:47 GMT
\nServer: Apache
\nAllow:
\nContent-Length: 223
\nConnection: close
\nContent-Type: text\/html; charset=iso-8859-1<\/p>\n

405 Method Not Allowed<\/p>\n

Method Not Allowed<\/p>\n

The requested method TRACE is not allowed for the URL \/. Connection closed by foreign host.
\n<\/span><\/p>\n

\u3059\u308b\u3068\u3053\u3093\u306a\u611f\u3058\u3067\u30a8\u30e9\u30fc\u304c\u51fa\u308b\u2026\u30a8\u30e9\u30fc\uff1f
\n\u3069\u3046\u3084\u3089\u3001\u6700\u8fd1\u306f\u521d\u671f\u8a2d\u5b9a\u3067\u7121\u6548\u306b\u306a\u3063\u3066\u3044\u308b\u3088\u3046\u3060\u3002
\n\u8a66\u3057\u306b\u3001\/etc\/apache2\/\u306e\u4e2d\u306b\u3042\u308b\u8a2d\u5b9a\u3082\u898b\u3066\u307f\u308b\u3002
\n$ cd \/etc\/apache2\/conf-available\/
\n$ sudo vim security.conf
\n\u4e0b\u8a18\u306e\u8a18\u8ff0\u304c\u3042\u308b\u3068\u3053\u308d\u3067\u3001
\n# Allow TRACE method
\n#
\n# Set to “extended” to also reflect the request body (only for testing and
\n# diagnostic purposes).
\n#
\n# Set to one of: On | Off | extended
\nTraceEnable Off
\n#TraceEnable On
\n\u3068\u306a\u3063\u3066\u3044\u305f\u3089\u8a2d\u5b9a\u306e\u5fc5\u8981\u306f\u306a\u3057\u3002<\/p>\n

\u5be6\u306e\u3068\u3053\u308d\u4eca\u3068\u306a\u3063\u3066\u306f\u305d\u3093\u306a\u306b\u6016\u304f\u306a\u3044\u2026\u3089\u3057\u3044\u3002
\n\u5927\u591a\u6578\u306f\u30d6\u30e9\u30a6\u30b6\u5074\u3067\u898f\u5236\u3055\u308c\u3066\u3044\u308b\u304b\u3089\u3060\u3002\u2026\u3089\u3057\u3044\u3002
\n\u5be6\u306f\u305d\u3093\u306a\u306b\u6016\u304f\u306a\u3044TRACE\u30e1\u30bd\u30c3\u30c9
\n\u53c3\u8003\uff1ahttp:\/\/blog.tokumaru.org\/2013\/01\/TRACE-method-is-not-so-dangerous-in-fact.html<\/p>\n","protected":false},"excerpt":{"rendered":"

\u30fbHTTP TRACE\u30e1\u30bd\u30c3\u30c9\u3092\u7121\u6548\u306b\u3059\u308b \u306a\u3093\u3060\u305d\u308a\u3083\u3063\u3066\u611f\u3058\u3060\u304c\u3001\u3053\u306eTRACE\u30e1\u30bd\u30c3\u30c9\u304c\u6709\u6548\u3060\u3068\u3001 \u3044\u308d\u3044\u308d\u3068\u6f0f\u308c\u305f\u3089\u307e\u305a\u3044\u60c5\u5831\u304c\u62d4\u304d\u51fa\u3055\u308c\u308b\u6050\u308c\u304c\u3042\u308b\u3002\u2026\u3089\u3057\u3044\u3002 \u5177\u9ad4\u7684\u306b\u306f\u3001\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff08XSS […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-121","post","type-post","status-publish","format-standard","hentry","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/posts\/121","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=121"}],"version-history":[{"count":5,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/posts\/121\/revisions"}],"predecessor-version":[{"id":127,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=\/wp\/v2\/posts\/121\/revisions\/127"}],"wp:attachment":[{"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=121"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=121"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/iwako.pgw.jp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}