{"id":476474,"date":"2023-08-09T07:29:55","date_gmt":"2023-08-09T07:29:55","guid":{"rendered":""},"modified":"2023-09-05T11:12:51","modified_gmt":"2023-09-05T11:12:51","slug":"crlf-injection","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/jp\/wiki\/crlf-injection\/","title":{"rendered":"CRLF\u6ce8\u5c04"},"content":{"rendered":"<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001Carriage Return Line Feed Injection \u306e\u7565\u3067\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306e\u4e00\u7a2e\u3067\u3059\u3002\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u307e\u305f\u306f Web \u30b5\u30a4\u30c8\u306b\u4fb5\u5165\u3055\u305b\u308b\u30b3\u30fc\u30c9 \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u624b\u6cd5\u3067\u3059\u3002\u3053\u306e\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u4e3b\u306b HTTP \u30d8\u30c3\u30c0\u30fc\u306b\u5f71\u97ff\u3057\u3001HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u5206\u5272\u3001\u30af\u30ed\u30b9\u30b5\u30a4\u30c8 \u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0 (XSS) \u306a\u3069\u306e\u3055\u307e\u3056\u307e\u306a\u8105\u5a01\u306b\u3064\u306a\u304c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<h2>CRLF\u6ce8\u5c04\u306e\u8d77\u6e90\u3068\u6b74\u53f2\u7684\u80cc\u666f<\/h2>\n<p>\u300cCRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u300d\u3068\u3044\u3046\u7528\u8a9e\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306e\u521d\u671f\u306e\u9803\u304b\u3089\u5b58\u5728\u3057\u3001HTTP \u30d7\u30ed\u30c8\u30b3\u30eb\u81ea\u4f53\u3068\u540c\u3058\u304f\u3089\u3044\u53e4\u3044\u3082\u306e\u3067\u3059\u3002CRLF \u30b7\u30fc\u30b1\u30f3\u30b9 (rn \u3067\u8868\u3055\u308c\u307e\u3059) \u306f\u3001\u591a\u304f\u306e\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u3067\u6539\u884c (\u884c\u672b) \u3092\u8868\u3059\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u30bf\u30a4\u30d7\u30e9\u30a4\u30bf\u30fc\u306e\u6642\u4ee3\u306b\u7531\u6765\u3057\u3066\u304a\u308a\u3001\u300c\u30ad\u30e3\u30ea\u30c3\u30b8 \u30ea\u30bf\u30fc\u30f3\u300d(CR) \u306f\u30c7\u30d0\u30a4\u30b9\u306e\u4f4d\u7f6e\u3092\u884c\u306e\u5148\u982d\u306b\u30ea\u30bb\u30c3\u30c8\u3057\u3001\u300c\u30e9\u30a4\u30f3 \u30d5\u30a3\u30fc\u30c9\u300d(LF) \u306f\u30c7\u30d0\u30a4\u30b9\u306e\u4f4d\u7f6e\u3092 1 \u884c\u4e0b\u306b\u79fb\u52d5\u3057\u307e\u3059\u3002<\/p>\n<p>\u305d\u306e\u60aa\u7528\u3001\u3064\u307e\u308a\u300c\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u300d\u306b\u3064\u3044\u3066\u306e\u6700\u521d\u306e\u8a00\u53ca\u306f\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u3088\u308a\u8907\u96d1\u306b\u306a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u5bfe\u3059\u308b\u7406\u89e3\u304c\u9032\u307f\u59cb\u3081\u305f 1990 \u5e74\u4ee3\u5f8c\u534a\u304b\u3089 2000 \u5e74\u4ee3\u521d\u982d\u306b\u307e\u3067\u9061\u308a\u307e\u3059\u3002<\/p>\n<h2>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8a73\u7d30<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3068\u30b5\u30fc\u30d0\u30fc\u306b\u3088\u308b\u30c7\u30fc\u30bf\u306e\u51e6\u7406\u65b9\u6cd5\u3092\u5229\u7528\u3059\u308b\u305f\u3081\u306b CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u64cd\u4f5c\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u4e88\u671f\u3057\u306a\u3044 CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u633f\u5165\u3059\u308b\u3053\u3068\u3067\u3001\u653b\u6483\u8005\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30c7\u30fc\u30bf \u30d5\u30ed\u30fc\u3092\u64cd\u4f5c\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u5178\u578b\u7684\u306a CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306b\u306f\u3001Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u30d5\u30a3\u30fc\u30eb\u30c9\u306b CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u8ffd\u52a0\u3057\u3066\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u65b0\u3057\u3044\u884c\u304c\u59cb\u307e\u3063\u305f\u3068\u601d\u308f\u305b\u308b\u3068\u3044\u3046\u653b\u6483\u304c\u542b\u307e\u308c\u307e\u3059\u3002\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306e\u901a\u4fe1\u306b\u4e0d\u53ef\u6b20\u306a HTTP \u30d8\u30c3\u30c0\u30fc\u3067\u306f\u3001CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u3088\u3063\u3066 HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u5206\u5272\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u5834\u5408\u3001\u60aa\u610f\u306e\u3042\u308b\u653b\u6483\u8005\u306f\u30b5\u30fc\u30d0\u30fc\u3092\u6b3a\u3044\u3066\u5909\u66f4\u3055\u308c\u305f HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u9001\u4fe1\u3055\u305b\u3001\u6f5c\u5728\u7684\u306a\u8106\u5f31\u6027\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<h2>CRLF\u6ce8\u5165\u306e\u5185\u90e8\u30e1\u30ab\u30cb\u30ba\u30e0<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u60f3\u5b9a\u3055\u308c\u308b\u30c7\u30fc\u30bf \u30b9\u30c8\u30ea\u30fc\u30e0\u306b CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u633f\u5165\u3059\u308b\u3053\u3068\u3067\u6a5f\u80fd\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u30b7\u30b9\u30c6\u30e0\u3092\u64cd\u4f5c\u3057\u3066\u3001\u3053\u308c\u3089\u306e\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u6b63\u5f53\u306a\u30b3\u30de\u30f3\u30c9\u307e\u305f\u306f\u30c7\u30a3\u30ec\u30af\u30c6\u30a3\u30d6\u3068\u3057\u3066\u8a8d\u8b58\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u305f\u3068\u3048\u3070\u3001HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u5206\u5272\u306e\u5834\u5408\u3001\u653b\u6483\u8005\u306f CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u306b\u7d9a\u3044\u3066\u8ffd\u52a0\u306e HTTP \u30d8\u30c3\u30c0\u30fc\u307e\u305f\u306f\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u542b\u3080\u6587\u5b57\u5217\u3092\u5165\u529b\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u30d8\u30c3\u30c0\u30fc\u304c\u7d42\u4e86\u3057\u3001\u65b0\u3057\u3044\u30d8\u30c3\u30c0\u30fc\u304c\u59cb\u307e\u3063\u305f\u3068\u8a8d\u8b58\u3057\u3001\u653b\u6483\u8005\u306f HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u306e\u30ec\u30b9\u30dd\u30f3\u30b9 \u30d8\u30c3\u30c0\u30fc\u3092\u5236\u5fa1\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<h2>CRLF\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u4e3b\u306a\u7279\u5fb4<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306e\u4e3b\u306a\u7279\u5fb4\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<ol>\n<li>\n<p>CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u306e\u64cd\u4f5c: CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u4e3b\u306a\u7279\u5fb4\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u30d5\u30a3\u30fc\u30eb\u30c9\u307e\u305f\u306f HTTP \u30d8\u30c3\u30c0\u30fc\u306b CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u304c\u4e88\u671f\u305b\u305a\u8ffd\u52a0\u3055\u308c\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<\/li>\n<li>\n<p>\u30c7\u30fc\u30bf \u30d5\u30ed\u30fc\u3078\u306e\u5f71\u97ff: \u633f\u5165\u3055\u308c\u305f CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u5185\u306e\u30c7\u30fc\u30bf \u30d5\u30ed\u30fc\u3092\u64cd\u4f5c\u3057\u3001\u6f5c\u5728\u7684\u306a\u8106\u5f31\u6027\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<\/li>\n<li>\n<p>\u5f71\u97ff\u7bc4\u56f2: \u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u304c\u767a\u751f\u3057\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3060\u3051\u3067\u306a\u304f\u3001\u4e0b\u6d41\u3067\u540c\u3058\u30c7\u30fc\u30bf\u3092\u51e6\u7406\u3059\u308b\u4ed6\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3082\u5f71\u97ff\u3092\u53ca\u307c\u3057\u307e\u3059\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>CRLF\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u7a2e\u985e<\/h2>\n<p>CRLF \u6ce8\u5c04\u306b\u306f\u4e3b\u306b 2 \u3064\u306e\u7a2e\u985e\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<ol>\n<li>\n<p><strong>HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u306e\u5206\u5272<\/strong>\u3053\u308c\u306f\u6700\u3082\u4e00\u822c\u7684\u306a\u30bf\u30a4\u30d7\u3067\u3042\u308a\u3001CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u304c HTTP \u30d8\u30c3\u30c0\u30fc\u306b\u633f\u5165\u3055\u308c\u3001HTTP \u5fdc\u7b54\u3092\u64cd\u4f5c\u307e\u305f\u306f\u5206\u5272\u3057\u307e\u3059\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u30ed\u30b0\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong>: \u3053\u306e\u30bf\u30a4\u30d7\u3067\u306f\u3001\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u30ed\u30b0 \u30d5\u30a1\u30a4\u30eb\u306b\u884c\u308f\u308c\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u30ed\u30b0 \u30a8\u30f3\u30c8\u30ea\u3092\u507d\u9020\u3057\u305f\u308a\u3001\u60aa\u610f\u306e\u3042\u308b\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u633f\u5165\u3057\u305f\u308a\u3059\u308b\u3053\u3068\u3067\u3053\u308c\u3092\u60aa\u7528\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3001\u554f\u984c\u3001\u304a\u3088\u3073\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001\u30e6\u30fc\u30b6\u30fc \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u4e57\u3063\u53d6\u308a\u3001\u30e6\u30fc\u30b6\u30fc \u30c7\u30fc\u30bf\u306e\u76d7\u96e3\u3001\u30e6\u30fc\u30b6\u30fc\u3092\u9a19\u3057\u3066\u60aa\u610f\u306e\u3042\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3055\u305b\u308b\u306a\u3069\u3001\u3055\u307e\u3056\u307e\u306a\u65b9\u6cd5\u3067\u60aa\u610f\u3092\u6301\u3063\u3066\u4f7f\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u3092\u9632\u3050\u306b\u306f\u3001\u5165\u529b\u306e\u691c\u8a3c\u3068\u30b5\u30cb\u30bf\u30a4\u30ba\u304c\u5fc5\u8981\u3067\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u30d5\u30a3\u30fc\u30eb\u30c9\u3067\u53d7\u3051\u5165\u308c\u53ef\u80fd\u306a\u6587\u5b57\u306e\u7a2e\u985e\u3092\u5236\u9650\u3057\u3001HTTP \u30d8\u30c3\u30c0\u30fc\u3067\u4e88\u671f\u3057\u306a\u3044 CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u691c\u67fb\u3059\u308b\u3053\u3068\u3067\u3001\u6f5c\u5728\u7684\u306a CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u9632\u3050\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<h2>\u985e\u4f3c\u306e\u7528\u8a9e\u3068\u306e\u6bd4\u8f03<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u4e3b\u306b CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u306e\u4fb5\u5165\u3092\u6271\u3044\u307e\u3059\u304c\u3001\u305d\u306e\u4ed6\u306e\u95a2\u9023\u3059\u308b\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306b\u306f\u6b21\u306e\u3082\u306e\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<ol>\n<li>\n<p><strong>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong>: \u60aa\u610f\u306e\u3042\u308b SQL \u30b3\u30fc\u30c9\u304c\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u633f\u5165\u3055\u308c\u3001\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3001\u30c7\u30fc\u30bf\u7834\u640d\u3001\u307e\u305f\u306f\u30c7\u30fc\u30bf\u76d7\u96e3\u306b\u3064\u306a\u304c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0 (XSS)<\/strong>\u3053\u306e\u30bf\u30a4\u30d7\u306e\u653b\u6483\u3067\u306f\u3001\u4fe1\u983c\u3067\u304d\u308b Web \u30b5\u30a4\u30c8\u306b\u60aa\u610f\u306e\u3042\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u633f\u5165\u3055\u308c\u3001\u88ab\u5bb3\u8005\u306e\u30d6\u30e9\u30a6\u30b6\u306b\u3088\u3063\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong>: \u653b\u6483\u8005\u304c\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3078\u306e\u30c7\u30fc\u30bf\u5165\u529b\u3092\u6539\u3056\u3093\u3057\u3066\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u3092\u5b9f\u73fe\u3059\u308b\u653b\u6483\u65b9\u6cd5\u3067\u3059\u3002<\/p>\n<\/li>\n<\/ol>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th>CRLF\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/th>\n<th>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/th>\n<th>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0<\/th>\n<th>\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u30e1\u30a4\u30f3\u30bf\u30fc\u30b2\u30c3\u30c8<\/td>\n<td>HTTP \u30d8\u30c3\u30c0\u30fc\u3068\u30e6\u30fc\u30b6\u30fc\u5165\u529b<\/td>\n<td>\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30af\u30a8\u30ea<\/td>\n<td>\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5074\u30b9\u30af\u30ea\u30d7\u30c8<\/td>\n<td>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30db\u30b9\u30c8\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb<\/td>\n<\/tr>\n<tr>\n<td>\u9632\u6b62<\/td>\n<td>\u5165\u529b\u306e\u691c\u8a3c\u3068\u30b5\u30cb\u30bf\u30a4\u30ba<\/td>\n<td>\u6e96\u5099\u3055\u308c\u305f\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u307e\u305f\u306f\u30d1\u30e9\u30e1\u30fc\u30bf\u5316\u3055\u308c\u305f\u30af\u30a8\u30ea\u306e\u4f7f\u7528<\/td>\n<td>\u5165\u529b\u691c\u8a3c\u3001\u51fa\u529b\u30a8\u30f3\u30b3\u30fc\u30c9\u3001HTTP \u306e\u307f\u306e Cookie<\/td>\n<td>\u5165\u529b\u691c\u8a3c\u3001\u5b89\u5168\u306aAPI\u306e\u4f7f\u7528<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u5c06\u6765\u306e\u5c55\u671b\u3068\u6280\u8853<\/h2>\n<p>\u5c06\u6765\u7684\u306b\u306f\u3001\u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30c4\u30fc\u30eb\u3084 AI \u30d9\u30fc\u30b9\u306e\u8106\u5f31\u6027\u691c\u51fa\u30b7\u30b9\u30c6\u30e0\u3078\u306e\u4f9d\u5b58\u5ea6\u304c\u9ad8\u307e\u308a\u3001CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306e\u691c\u51fa\u3068\u9632\u6b62\u304c\u6539\u5584\u3055\u308c\u308b\u306f\u305a\u3067\u3059\u3002\u3055\u3089\u306b\u3001\u5b89\u5168\u306a\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0 \u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u3084\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u306b\u95a2\u3059\u308b\u6559\u80b2\u304c\u958b\u767a\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u3067\u3055\u3089\u306b\u666e\u53ca\u3057\u3001\u3053\u306e\u30ea\u30b9\u30af\u304c\u3055\u3089\u306b\u8efd\u6e1b\u3055\u308c\u308b\u3053\u3068\u304c\u671f\u5f85\u3055\u308c\u307e\u3059\u3002<\/p>\n<h2>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3068\u30d7\u30ed\u30ad\u30b7 \u30b5\u30fc\u30d0\u30fc<\/h2>\n<p>OneProxy \u304c\u63d0\u4f9b\u3059\u308b\u3088\u3046\u306a\u30d7\u30ed\u30ad\u30b7 \u30b5\u30fc\u30d0\u30fc\u306f\u3001CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483\u3092\u9632\u3050\u5f79\u5272\u3092\u679c\u305f\u3057\u307e\u3059\u3002\u30d7\u30ed\u30ad\u30b7 \u30b5\u30fc\u30d0\u30fc\u306f\u3001\u7740\u4fe1\u30c7\u30fc\u30bf\u3068\u767a\u4fe1\u30c7\u30fc\u30bf\u3092\u7cbe\u67fb\u3057\u3066\u7591\u308f\u3057\u3044\u30d1\u30bf\u30fc\u30f3\u3092\u691c\u51fa\u3059\u308b\u3053\u3068\u3067\u3001\u6f5c\u5728\u7684\u306a\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8a66\u307f\u3092\u8b58\u5225\u3067\u304d\u307e\u3059\u3002\u9ad8\u5ea6\u306a\u30d7\u30ed\u30ad\u30b7 \u30b5\u30fc\u30d0\u30fc\u306f\u3001\u30c7\u30fc\u30bf\u3092\u30bf\u30fc\u30b2\u30c3\u30c8 \u30b5\u30fc\u30d0\u30fc\u306b\u8ee2\u9001\u3059\u308b\u524d\u306b\u30c7\u30fc\u30bf\u3092\u30b5\u30cb\u30bf\u30a4\u30ba\u3057\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u3055\u3089\u306b\u5f37\u5316\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002<\/p>\n<h2>\u95a2\u9023\u30ea\u30f3\u30af<\/h2>\n<p>CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u6b21\u306e\u30ea\u30bd\u30fc\u30b9\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/CRLF_Injection\" target=\"_new\" rel=\"noopener nofollow\">OWASP CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Securing_your_site\/Http_splitting\" target=\"_new\" rel=\"noopener nofollow\">MDN Web \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8: HTTP \u30ec\u30b9\u30dd\u30f3\u30b9\u306e\u5206\u5272<\/a><\/li>\n<li><a href=\"https:\/\/www.acunetix.com\/websitesecurity\/crlf-injection\/\" target=\"_new\" rel=\"noopener nofollow\">Web \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3 \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30ac\u30a4\u30c9: CRLF \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/a><\/li>\n<li><a href=\"https:\/\/cwe.mitre.org\/data\/definitions\/93.html\" target=\"_new\" rel=\"noopener nofollow\">CWE \u2013 CWE-93: CRLF \u30b7\u30fc\u30b1\u30f3\u30b9\u306e\u4e0d\u9069\u5207\u306a\u4e2d\u548c<\/a><\/li>\n<\/ul>","protected":false},"featured_media":476475,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-476474","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Understanding CRLF Injection<\/mark>","faq_items":[{"question":"What is a CRLF Injection?","answer":"<p>A CRLF Injection is a type of security vulnerability where an attacker infiltrates Carriage Return Line Feed (CRLF) sequences into a web application. This infiltration primarily affects HTTP headers and can lead to various threats such as HTTP Response Splitting and Cross-Site Scripting.<\/p>"},{"question":"When was CRLF Injection first discovered?","answer":"<p>The term 'CRLF Injection' originated from the early days of the internet, as old as the HTTP protocol itself. Its misuse, or \"injection,\" started being recognized as a threat to web application security in the late 1990s and early 2000s.<\/p>"},{"question":"How does a CRLF Injection work?","answer":"<p>A CRLF Injection works by inserting CRLF sequences into an application's expected data stream. By doing this, the attacker can manipulate the system into recognizing these injections as legitimate commands or directives. This can lead to manipulated data flow and potential security vulnerabilities.<\/p>"},{"question":"What are the types of CRLF Injection?","answer":"<p>The two main types of CRLF injections are HTTP Response Splitting, where CRLF sequences are injected into HTTP headers to manipulate the HTTP response, and Log Injection, where the injection is made into log files, potentially forging log entries or inserting malicious content.<\/p>"},{"question":"How can we prevent CRLF Injection attacks?","answer":"<p>CRLF injection attacks can be prevented by implementing input validation and sanitization. This involves limiting the types of characters that can be accepted in user input fields and inspecting HTTP headers for unexpected CRLF sequences.<\/p>"},{"question":"How does CRLF Injection compare with other similar attacks?","answer":"<p>CRLF Injection involves infiltrating CRLF sequences, primarily affecting HTTP headers and user inputs. SQL Injection involves the injection of malicious SQL code, targeting database queries. Cross-Site Scripting involves the injection of malicious scripts into trusted websites, affecting client-side scripts. Command Injection is where an attacker alters dill data inputs to an application to achieve arbitrary command execution, targeting the application's host command shell.<\/p>"},{"question":"How are proxy servers related to CRLF Injection?","answer":"<p>Proxy servers, like OneProxy, can help prevent CRLF Injection attacks. They scrutinize incoming and outgoing data for suspicious patterns, identifying potential injection attempts. Some advanced proxy servers can also sanitize the data before forwarding it to the target server, adding an extra layer of security.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/wiki\/476474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/wiki\/476474\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/media\/476475"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/jp\/wp-json\/wp\/v2\/media?parent=476474"}],"curies":[{"name":"\u3046\u30fc\u3093","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}