Glossary of information security: Difference between revisions
No edit summary Tag: wikieditor |
m →C |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 12: | Line 12: | ||
* [https://owasp.org/www-community/attacks/Command_Injection Command Injection] "an attack technique in which an attacker exploits vulnerabilities in an application to inject and execute malicious operating system commands, typically through unvalidated user input such as forms, cookies, or HTTP headers." | * [https://owasp.org/www-community/attacks/Command_Injection Command Injection] "an attack technique in which an attacker exploits vulnerabilities in an application to inject and execute malicious operating system commands, typically through unvalidated user input such as forms, cookies, or HTTP headers." | ||
* CORS (Cross-Origin Resource Sharing，跨來源資源共用)：瀏覽器基於安全考量採用「同源政策」(Same-origin policy, SOP)，網頁上的 JavaScript 程式碼只能讀取同源（協定、網域、通訊埠皆相同）的資源，無法讀取其他來源的回應。CORS 則是放寬這項限制的例外機制：「基於 HTTP 標頭的機制，讓伺服器指示瀏覽器可以從自身以外的哪些來源（網域、協定或通訊埠）載入資源。」例如 a.com 的網頁想用 fetch 抓取 b.com 的資源時，瀏覽器會檢查 b.com 的回應中是否有 Access-Control-Allow-Origin 等標頭；若沒有，瀏覽器就會擋下這個回應，程式便拿不到資料。(資料來源：[https://en.wikipedia.org/wiki/Cross-origin_resource_sharing Wikipedia]、[https://developer.mozilla.org/zh-TW/docs/Web/HTTP/Guides/CORS MDN]) | |||
* CORS Proxy：跨來源資源共用的中間伺服器，透過中間伺服器繞過瀏覽器的跨來源限制（CORS）。可以透過後端程式語言、Cloudflare Workers、Vercel 架設 Proxy。 | |||
== D == | == D == | ||
Latest revision as of 12:01, 3 November 2026
Glossary of information Security - Information Security Terms
 This article "Glossary of information security" is still being written. If there are any incomplete parts, you are welcome to directly edit them. 這篇文章「Glossary of information security」內容還在撰寫中，如果有不完整的部分，歡迎你直接動手修改。
|
A[edit]
- Adware: 使用者端的安全威脅。Symantec::Security Response - (Types of threat:Adware, Dialers, Hack Tools, Hoax, Joke Programs, Remote Access, Spyware, Trojan Horse, Virus, Worm)
- ARP(Address Resolution Protocol, 位址解析通訊協定)病毒 Address Resolution Protocol (ARP)
C[edit]
- Code Injection: "a type of attack in which an attacker injects malicious code into an application and causes it to be executed, typically due to the application's lack of proper validation and filtering of external input data."
- Command Injection "an attack technique in which an attacker exploits vulnerabilities in an application to inject and execute malicious operating system commands, typically through unvalidated user input such as forms, cookies, or HTTP headers."
- CORS (Cross-Origin Resource Sharing，跨來源資源共用)：瀏覽器基於安全考量採用「同源政策」(Same-origin policy, SOP)，網頁上的 JavaScript 程式碼只能讀取同源（協定、網域、通訊埠皆相同）的資源，無法讀取其他來源的回應。CORS 則是放寬這項限制的例外機制：「基於 HTTP 標頭的機制，讓伺服器指示瀏覽器可以從自身以外的哪些來源（網域、協定或通訊埠）載入資源。」例如 a.com 的網頁想用 fetch 抓取 b.com 的資源時，瀏覽器會檢查 b.com 的回應中是否有 Access-Control-Allow-Origin 等標頭；若沒有，瀏覽器就會擋下這個回應，程式便拿不到資料。(資料來源：Wikipedia、MDN)
- CORS Proxy：跨來源資源共用的中間伺服器，透過中間伺服器繞過瀏覽器的跨來源限制（CORS）。可以透過後端程式語言、Cloudflare Workers、Vercel 架設 Proxy。
D[edit]
- DoS (Denial of Service, 阻絕服務攻擊) / DDoS (Distributed Denial of Service, 分散式阻斷服務攻擊) 說明：產生大量封包或資料流，癱瘓網站服務。 (詳: Wikipedia)
K[edit]
- Keylogger(鍵盤記錄, Keystroke logging) 記錄使用者電腦的鍵盤操作 資料來源:Keystroke logging - Wikipedia, the free encyclopedia
M[edit]
- MalWare (惡意軟體, 流氓軟體) 流氓軟體 - Wikipedia
P[edit]
- ;Phishing(網站偽造, Web Forgery) AntiPhishing - 檢舉網站偽造/防制工具
R[edit]
- Rootkit Rootkit - Wikipedia
S[edit]
- SpyWare(間諜軟體) 組合國際（Computer Associate）的安全顧問小組（Security Advisor Team）(RSS[1])
- Spoofing (假冒) (E-mail spoofing)郵件假冒/偽造寄信者的電子郵件:
- 惡意網站
- 防範工具: McAfee SiteAdvisor, TrendProtect™
- 軟體供應鏈攻擊 (Supply chain attack) 針對供應鏈中防護較弱的部分進行攻擊
使用者端[edit]
Symantec::Security Response - (Types of threat:Adware, Dialers, Hack Tools, Hoax, Joke Programs, Remote Access, Spyware, Trojan Horse, Virus, Worm)