[B! XSS] denkenã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

denken id:denken

XSSã«é–¢ã™ã‚‹denkenã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (37)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XSSã¨SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®ä¸¡æ–¹ãŒå¯èƒ½ãªRFC5322é©åˆã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹
ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã®ã€Œãƒ«ãƒ¼ãƒ«ã€ã«é–¢ã™ã‚‹è©±é¡ŒãŒç››ã‚Šä¸ŠãŒã£ã¦ã„ã¾ã™ãã€‚ ã€Œãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã®ãƒ«ãƒ¼ãƒ«ã€ç³»ã¾ã¨ã‚ãŒãã‚ã£ã¦é–“é•ã£ã¦ã‚‹ã®ã§ã”æ³¨æ„ã‚’ ã€Œãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã®ãƒ«ãƒ¼ãƒ«ã€ãªã‚“ã¦ä½¿ã£ã¦ã¯ã„ã‘ãªã„3ã¤ã®ç†ç”± ã“ã‚Œã‚‰ã®ã‚¨ãƒ³ãƒˆãƒªã«ç•°è«–ãŒã‚ã‚‹ã‚ã‘ã§ã‚ã‚Šã¾ã›ã‚“ã€‚ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã«é–¢ã™ã‚‹ãƒ«ãƒ¼ãƒ«ã¨ã„ã†ã¨RFC5322ãªã©ãŒã‚ã‚‹ã‚‚ã®ã®ã€ç¾å®Ÿã®é‹ç”¨ã§ã¯ç°¡æ˜“çš„ãªä»•æ§˜ã‚’ç”¨ã„ã¦ã„ã‚‹å ´åˆãŒå¤§åŠã§ã‚ã‚‹â€¦ã¨ã„ã†äº‹æƒ…ã¯ã€ç§ã‚‚ä»¥å‰ãƒ–ãƒã‚°ã«æ›¸ãã¾ã—ãŸã€‚ã€ æœ¬ç¨¿ã§ã¯ã€ã€Œç©ºå‰ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã®ãƒ«ãƒ¼ãƒ«ãƒ–ãƒ¼ãƒ (?)ã€ã«ä¾¿ä¹—ã™ã‚‹å½¢ã§ã€RFC5322ã«æº–æ‹ ã—ãŸãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã§ã€XSSã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®æ”»æ’ƒãŒã§ãã‚‹ã“ã¨ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ã¨è¨€ã£ã¦ã‚‚ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦ã¯ã€éŽåŽ»ã«æ›¸ãã¾ã—ãŸã®ã§ã€æœ¬ç¨¿ã§ã¯ã€RFC5322ãƒãƒªãƒƒãƒ‰ãªãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã§SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨XSSã®ä¸¡æ–¹ãŒã§ãã‚‹ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ã¾ãšã€æ”»æ’ƒå¯¾è±¡ã¨ã—ã¦ã€ä»¥ä¸‹
denken 2013/11/29
"><script>alert('or/**/1=1#')</script>"@example.jp

ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SQL
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
denken 2011/04/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
XSSä¾‹é¡Œ - masa141421356â€™s blog
alert(1)ã‚’å®Ÿè¡Œã•ã›ã¦ãã ã•ã„ã€‚ãŸã ã—ã€ãƒªãƒ³ã‚¯å…ˆã®ã‚µãƒ¼ãƒã¸ã®ç´°å·¥ã¯ä¸€åˆ‡å‡ºæ¥ãªã„ã‚‚ã®ã¨ã—ã¾ã™ï¼ˆjavascriptã‚¹ã‚ãƒ¼ãƒ ã¸ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã¨ã‹ã¯ç¦æ¢ã¨ã„ã†ã“ã¨ã§ï¼‰ã€‚ Execute alert(1), but you can not customize server linked from IMG element (for example, redirection to "javascript:" scheme is not allowed). <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>XSS challange ( execute alert())</title> <script type="text/javascript"> var w = nul
denken 2011/03/05
ã‚ã¨ã§ã‚ã¨ã§

xss

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
denken 2010/05/11
ã‚ˆãã‚‚ã¾ã‚

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
JavaScriptå¤‰æ…‹æ–‡æ³•æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - è‘‰ã£ã±æ—¥è¨˜
Javaå¤‰æ…‹æ–‡æ³•æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®è„³ã¿ãã‚’ãƒªã‚¹ãƒšã‚¯ãƒˆã€‚ JavaScriptã®å¤‰æ…‹æ–‡æ³•ãƒ»æŠ€æ³•ä¸€è¦§ã§ã™ã€‚ã‚ã‚“ã¾ã‚Šä½¿ã‚ãªã„ã‘ã©ã€çŸ¥ã£ã¦ã‚‹ã¨XSSã¨ã‹æ”»æ’ƒã—ãŸã„ã®ã«WAFã«å¦¨å®³ã•ã‚Œã‚‹ãªã©ã€ã„ã‚ã„ã‚åˆ¶ç´„ãŒã‚ã‚‹ã¨ã„ã†å ´åˆã«ä¾¿åˆ©ã€‚ æ–‡å—åˆ—ã®ç”Ÿæˆ å¼•ç”¨ç¬¦ã‚’ä½¿ã‚ãšã«ã•ãã£ã¨æ–‡å—åˆ—ã‚’ä½œã‚‹ã€‚fromCharCode ã¨ã‹ä½¿ã£ã¦ã‚‚ã„ã„ã‘ã©ã‚ã‚“ã©ãã•ã„ã®ã§ã€æ£è¦è¡¨ç¾ã‚„E4Xã‚’åˆ©ç”¨ã€‚ alert( /string/.source ); alert( <>string</> ) ç©ºç™½æ–‡å—ã‚’ä½¿ã‚ãšè¨˜è¿° æ–‡è„ˆä¸Šã€ã‚¹ãƒšãƒ¼ã‚¹ã‚’æ›¸ããŸã„ã‘ã‚Œã©ã„ã‚ã„ã‚åˆ¶ç´„ãŒã‚ã£ã¦æ›¸ã‘ãªã„å ´åˆã«ã¯ã‚³ãƒ¡ãƒ³ãƒˆã§ä»£æ›¿ã€‚å®Ÿè¡Œã™ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’ä½œã‚Šä¸Šã’ã¦evalã—ã¦ã‚‚ã„ã„ã‘ã©å¤§è¢ˆè£Ÿãªã®ã§ã€‚ var/**/x=1; */ ã‚’å«ã‚€ã‚³ãƒ¼ãƒ‰ãƒ–ãƒãƒƒã‚¯ã‚’ã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆ ã‚³ãƒ¼ãƒ‰ã®å¡Šã‚Šã‚’ã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆã—ã‚ˆã†ã¨æ€ã£ã¦ /* */ ã§å›²ã‚€ã¨ã€ã‚³ãƒ¼ãƒ‰å†…ã« string.
denken 2010/02/10
ã€ŒXSSãŒã‚ã‚‹ã®ã§ < ã‚„ > ã¯æ³¨å…¥ã§ãã‚‹ã®ã«ã€/ ã¯ä½¿ãˆãªã„ã¨ã„ã†æŒ™å‹•ã‚’ã™ã‚‹ã‚µã‚¤ãƒˆã§ã¯ã€çµ‚äº†è¦ç´ ãªã—ã®<script>ã‚’è¨˜è¿°ã—ã¦ onreadystatechange ã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å‹•ã‹ã™ã€‚IEé™å®šã€‚JSã®è©±ã˜ã‚ƒãªã„ã‘ã©ã€‚ã€

javascript

xss

ãŠã‚Œã¯ã™ã”ã„
ãƒªãƒ³ã‚¯
oqunoã®ãƒ–ãƒã‚°
ã‚µã‚¤ãƒ‰ãƒãƒ¼ã«ãƒ•ãƒªãƒ¼ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’è¿½åŠ ã—ã¦ä¸èº«ã‚’ <script type="text/javascript"> $(document).ready(function(){ timer = setInterval('$.get("./")', 1000); }); </script> ã«è¨å®šã™ã‚‹ã¨ã‚ˆã•ãã†ã§ã™ã€‚
denken 2009/12/14
ã“ã†ã„ã†youpyçš„ãªãƒ‡ã‚¶ã‚¤ãƒ³ã£ã¦ã©ã†ã‚„ã£ãŸã‚‰ã§ãã‚‹ã‚“ã ã‚ã†

ameblo

XSS
ãƒªãƒ³ã‚¯
Rails 2ç³»ã®XSSè„†å¼±æ€§ãŒRuby 1.9ã§ã¯å½±éŸ¿ãªã—ã¨ã•ã‚Œã‚‹ç†ç”± - å²©æœ¬éš†å²ã®æ—¥è¨˜å¸³ï¼ˆã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ï¼‰
Rails 2ç³»ã®XSSè„†å¼±æ€§ã‚’ä¿®æ£ã™ã‚‹ãƒ‘ãƒƒãƒãŒå…ˆæ—¥å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ 4æ—¥(ç±³å›½æ™‚é–“)ã€Ruby on Railsã®2ç³»ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«XSSã®è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒRiding Rails: XSS Vulnerability in Ruby on Railsã«ãŠã„ã¦ç™ºè¡¨ã•ã‚ŒãŸã€‚ç‰¹å®šã®Unicodeæ–‡å—åˆ—ã‚’ä½¿ã£ã¦ãƒã‚§ãƒƒã‚¯ã‚’ããã‚ŠæŠœã‘ã€ä»»æ„ã®HTMLã‚’é€ã‚Šè¾¼ã¾ã‚Œã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã€‚ãªãŠRuby 1.9ç³»ã§å‹•ä½œã—ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã“ã®å½±éŸ¿ã‚’å—ã‘ãªã„ã€‚ http://journal.mycom.co.jp/news/2009/09/07/048/index.html ã“ã®ä»¶ã«é–¢ã—ã¦ã€å¤§åž£ã•ã‚“ã¯æ¬¡ã®ã‚ˆã†ã«èª¬æ˜Žã—ã¦ã„ã¾ã™ã€‚ RoRã®è„†å¼±æ€§ã«é–¢é€£ã—ã¦Ruby1.9ã§ã¯å®‰å…¨ã€ã¨è§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€ãã‚Œã¯Ruby1.9ã¯ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’å—ã‘ä»˜ã‘ãªã„ã‹ã‚‰ã§ã™ã€‚ ä½•æ•…ã‹ã‚ãŸã‚Šå‰ã«ãªã‚‰ãªã„æ–‡å—ã‚¨
denken 2009/09/24
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

RoR

UTF-8

Ruby
ãƒªãƒ³ã‚¯
UTF-8ã®å‹•çš„ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’Shift_JISã¨èª¤èªã•ã›ã‚‹ã“ã¨ã§æˆç«‹ã™ã‚‹XSS - masa141421356â€™s blog
æ–‡å—ã‚³ãƒ¼ãƒ‰æŒ‡å®šã®ç„¡ã„UTF-8ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã§ã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶å´ã®æ–‡å—ã‚³ãƒ¼ãƒ‰è‡ªå‹•èªè˜ã§ã‚·ãƒ•ãƒˆJISã¨èª¤èªã•ã›ã‚‹ã“ã¨ã§ã€HTMLã®ç‰¹æ®Šæ–‡å—ã‚’ä¸€åˆ‡ä½¿ã‚ãšã«XSSãŒæˆç«‹ã™ã‚‹å ´åˆãŒã‚ã‚Šã¾ã™ã€‚ åŽŸç† UTF-8 ã§ã¯ï¼‘æ–‡å—ãŒï¼“ãƒã‚¤ãƒˆãƒžãƒƒãƒ”ãƒ³ã‚°ã•ã‚Œã‚‹å ´åˆãŒã‚ã‚Šã¾ã™ã€‚ ãã“ã§ã€ã“ã‚Œã‚’Shift_JISã¨èª¤èªã•ã›ã‚‹ã¨ã€ï¼“ãƒã‚¤ãƒˆç›®ã¨æ¬¡ã®ï¼‘ãƒã‚¤ãƒˆã‚’ã‚»ãƒƒãƒˆã§ï¼‘æ–‡å—ã¨èª¤èªã•ã›ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€HTMLã®åŒºåˆ‡ã‚Šæ–‡å—ã®åŠ¹åŠ›ã‚’å¤±ã‚ã›ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’æ³¨å…¥ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã€‚ ä¾‹ï¼š"ã‚" = E3 81 82 ãªã®ã§ã€ã‚·ãƒ•ãƒˆJISã¨èª¤èªã™ã‚‹ã¨ "ç¸º" (E381) +ä½™åˆ†ãªå…ˆè¡Œãƒã‚¤ãƒˆã® 0x82 å…·ä½“ä¾‹ ä¾‹ãˆã°ã€å‹•çš„ãªã‚³ãƒ³ãƒ†ãƒ³ãƒ„ï¼ˆUTF-8ã§å¿œç”ã‚’ç”Ÿæˆï¼‰ <html> <head> <title>abcde</title> </head> <body> <form> <input type=text value="ãƒ¦ãƒ¼
denken 2009/08/13
æƒ³åƒã‚’çµ¶ã™ã‚‹

æ–‡å—ã‚³ãƒ¼ãƒ‰

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
XSSã‚’ä¿®æ£ã—ãªã„ã¨ã„ã†äº‹ (Kanasansoft Web Lab.)
ä»Šèªã¿è¿”ã™ã¨ã€ã‚ã¡ã“ã¡ã«å¤‰ãªæ—¥æœ¬èªžãŒæ··ã˜ã£ã¦ã„ã¾ã™ãã€‚ è¨‚æ£ã™ã‚‹ã®ã‚‚å«Œã‚‰ã—ã„ã®ã§ãã®ã¾ã¾ã«ã—ã¦ãŠãã¾ã™ã€‚ ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã¨ã„ã†ã‚µãƒ¼ãƒ“ã‚¹ã§ã€å½“ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã«å¯¾ã—ã¦ã¤ã„ãŸã‚³ãƒ¡ãƒ³ãƒˆã«è¿”ä¿¡ã—ã¦ã„ãã¾ã™ã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã«ã¯ã€ã€ŒXSSã®å±é™ºæ€§ã‚’ã‚ã‹ã£ã¦ã„ãªã„äººã«ç†è§£ã—ã¦ã‚‚ã‚‰ã†ã€ã¨ã„ã†ã®ãŒå‰æã¨ã—ã¦ã‚ã‚Šã¾ã—ãŸã€‚ ãã—ã¦ã€ã€ŒæŠ€è¡“ã®ç–Žã„äººã«ã‚‚ç†è§£ã—ã¦å‹•ã„ã¦ã‚‚ã‚‰ã†ã€ã¨ã„ã†é¡˜ã„ã‚‚ã‚ã‚Šã¾ã—ãŸã€‚ ã“ã®ãŸã‚ã«ã€ã€Œå¤šå°‘ã®èª¤è§£ã‚’ä¸ŽãˆãŸã¨ã—ã¦ã‚‚ãªã‚“ã¨ãªãç†è§£ã—ã¦ã‚‚ã‚‰ã†ã€äº‹ã‚’é‡è¦è¦–ã—ã¦ã„ã¾ã™ã€‚ ã“ã‚Œã‚’è¸ã¾ãˆã¦ä»¥ä¸‹è¨˜è¿°ã—ã¾ã™ã€‚ ã€Œ#ã€ã§ã¯ã˜ã¾ã‚‹ã®ãŒã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã®ã‚³ãƒ¡ãƒ³ãƒˆã§ã™ã€‚ #2008å¹´10æœˆ24æ—¥Â g616blackheartÂ ã‚¬ãƒ¼ãƒ‰ãŒå …ã„ã¨è¨€ã‚ã‚ŒãŸâ€¦â€¦ã©ã†ã—ã¦ã ã‚ã†ï¼Ÿ #2008å¹´10æœˆ24æ—¥Â anigokaÂ ãªã‚“ã‹ã‚¬ãƒ¼ãƒ‰ãŒå …ã„ã¦è¨€ã‚ã‚Œã¡ã‚ƒã£ãŸã‚“ã ã‘ã©ã€ãªã«,ã‚ªãƒ¬ãŒéžã‚³ãƒŸãƒ¥ã ã£ã¦è¨€ã„ãŸã„ã®ï¼ï¼Ÿ ç”³ã—è¨³ãªã„ã§ã™ã€‚
denken 2008/10/25
javascript

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
XSSã®è„†å¼±æ€§ã«ã¤ã„ã¦ã¯ã¾ã¡ã¡ã‚ƒã‚“ã•ã‚“ã«æœã¾ã§æ•™ãˆã¦ã‚‚ã‚‰ã£ãŸã‚ˆï¼ - ã“ã‚Œã¯ãˆãŒã„blog
æµæ¯”å¯¿ã®ITé–¢é€£ã®ä¼šç¤¾ã§å–¶æ¥ãƒžãƒ³ã‚’ã™ã‚‹21æ³ã®â™‚ã€‚ã€€ITæ¥ç•Œã®ãˆãŒã¡ã‚ƒã‚“â™‚ã“ã¨æ°¸ä¸Šè£•ä¹‹ã§ã™ã€‚ ã€ä¸€ç·’ã«ã‚µã‚¤ãƒˆä½œã£ã¦ãã‚Œã‚‹äººå‹Ÿé›†ã€‘ã€€TELï¼š090-2033-5444ã€€ãƒ¡ãƒ¼ãƒ«ï¼šegachanâ˜…gmail.com Twitterï¼šegachanã€€Skypeï¼šhiroru123 ãƒ¡ãƒƒã‚»ï¼š[email protected]ã€€mixiï¼š165462 ã€å‹•ç”»å‡ºæ¼”ã—ã¦ããŸYOï¼ã€‘ã€€ã‚¯ãƒ©ãƒ–ã§éŠã¶ã®ã¨WEBã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã‚‹ã®ã¯ä¸€ç·’ | ãƒˆãƒ¬ãƒ³ãƒ‰GyaO[ã‚®ãƒ£ã‚ª]
denken 2008/10/20
å¢—ç”°ã®ä½¿ã„æ–¹ã¯æ—¥ã€…é€²åŒ–ã—ã¦ã„ã‚‹ãªãƒ¼ã€‚ã¿ã‚“ãªã¯ã¾ã¡ã¡ã‚ƒã‚“ãŒæ›¸ã„ãŸã‚ˆã†ã«ã‚‚è¦‹ãˆã‚‹ã‘ã©

å¢—ç”°

æ°¸ä¸Šè£•ä¹‹

ã¯ã¾ã¡ã¡ã‚ƒã‚“

XSS

ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
I, newbie ï¿½ book review: XSS Exploits
çµè«–: XSSã®(ç¾æ™‚ç‚¹ã§ã®)ã™ã¹ã¦ã‚’ã¾ã¨ã‚ãŸè‰¯æ›¸(ISBN-10: 1597491543)ã€‚ ã‚ã®RSnakeæ°ãŒæ›¸ã„ãŸæœ¬ã¨ã„ã†ã“ã¨ã§ã‚²ãƒƒãƒˆã—ãŸ(æ»èªž)ã€‚ã¾ãã€ã‚ˆãç¶²ç¾…ã—ãŸã¨ã„ã†ã‹ã€‚åŸºæœ¬çš„ã«ã€pentesterå‘ã‘ã®æœ¬ãªã®ã§ã€ãã‚ŒãŒæœ¬è·ã˜ã‚ƒãªã„ã²ã¨ã«ã¯ã‚„ã‚„å†—é•·ã‹ã‚‚ã—ã‚Œãªã„ã€‚ã§ã‚‚ã€XSSã®ä»•çµ„ã¿ã‹ã‚‰å…·ä½“çš„ãªexploitã®ä½œæˆã€XSSãŒã‚‚ãŸã‚‰ã™consequenceã¾ã§ãŒè§£èª¬ã•ã‚Œã‚‹éŽç¨‹ã§ã€æ”»æ’ƒè€…ã®è±Šã‹ãªæƒ³åƒåŠ›ã«åœ§å€’ã•ã‚Œã€Œä¸é€”åŠç«¯ãªå¯¾ç–ã¯ç„¡é§„ã ã€ã¨å¦ãŒå¿œã§ã‚‚æ‚Ÿã‚‰ã›ã‚‹ã€‚è‡ªåˆ†ã¯ã€é˜²å¾¡å´ã®æ–¹ãŒã¯ã‚‹ã‹ã«å›°é›£ã§ã€ã ã‹ã‚‰ã“ãã‚„ã‚ŠãŒã„ã‚‚ã‚ã‚‹ã¨æ„Ÿã˜ã¦ã„ã‚‹ã²ã¨ãªã®ã ã‘ã©ã€ã“ã‚Œã‚’èªã‚€ã¨black hatã«(é‡‘éŠçš„ãªå´é¢ã‚’åˆ¥ã¨ã—ã¦ã‚‚)é…åŠ›ã‚’æ„Ÿã˜ã‚‹ã®ã‚‚ã‚ã‹ã‚‹ã€‚ã“ã®æœ¬ã®ä¸ã§å–ã‚Šä¸Šã’ã‚‰ã‚Œã¦ã„ã‚‹exploitã¯ãã®ã¾ã¾é˜²å¾¡ã«å½¹ç«‹ã¤ã¨ã„ã†ã‚ã‘ã§ã¯ãªã„ã‘ã‚Œã©ã€æ”»æ’ƒè€…ã®æ€è€ƒã‚„æ–¹æ³•è«–ã‚’çŸ¥ã‚‹ã“ã¨ã¯ã¾ã£ãŸãå½¹ã«ç«‹ãŸãªã„ã‚ã‘ã§ã¯ãªã„ã€‚
denken 2008/10/15
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æœ¬
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
denken 2008/10/09
ãªã‚“ã§ãˆãŒã¡ã‚ƒã‚“ã£ã¦ã‚³ãƒ¡ãƒ³ãƒˆæ¬„ã ã¨ã“ã†ãªã®ã ã‚ã†ã€‚ãƒ–ãƒã‚°ã§ã®å°è±¡ã¨ãœã‚“ãœã‚“é•ã†

çŸ¢é‡Žã•ã¨ã‚‹

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚³ãƒ¡ãƒ³ãƒˆæ¬„

æ°¸ä¸Šè£•ä¹‹
ãƒªãƒ³ã‚¯
ã€Œäºˆå‘Š.inã€ã«ä¸æ£ã‚³ãƒ¼ãƒ‰åŸ‹ã‚è¾¼ã¿ã€€é–²è¦§ã™ã‚‹ã¨2chã«çŠ¯è¡Œäºˆå‘ŠæŠ•ç¨¿
çŠ¯è¡Œäºˆå‘ŠåŽé›†ã‚µã‚¤ãƒˆã€Œäºˆå‘Š.inã€ã«8æœˆ3æ—¥ã€ä¸æ£ãªã‚³ãƒ¼ãƒ‰ãŒåŸ‹ã‚è¾¼ã¾ã‚Œã€ã‚¢ã‚¯ã‚»ã‚¹ã¨åŒæ™‚ã«ã€Œè¦è¦–åºçˆ†ç ´ã™ã‚‹ã€ã¨ã„ã†çŠ¯è¡Œäºˆå‘Šæ–‡ã‚’ã€Œ2ã¡ã‚ƒã‚“ãã‚‹ã€ã«å¼·åˆ¶çš„ã«æŠ•ç¨¿ã•ã›ã‚‹å•é¡ŒãŒèµ·ããŸã€‚ç´„1æ™‚é–“åŠå¾Œã«ä¿®æ£ã•ã‚ŒãŸãŒã€é‹å–¶è€…ã®çŸ¢é‡Žã•ã¨ã‚‹ã•ã‚“ã¯ã€Œåˆ©ç”¨è€…ã«è¿·æƒ‘ã‚’ã‹ã‘ã¦ç”³ã—è¨³ãªã„ã€ã¨è¬ç½ªã—ã¦ã„ã‚‹ã€‚ å•é¡ŒãŒç™ºç”Ÿã—ãŸã®ã¯ã€3æ—¥ã®åˆå‰2æ™‚18åˆ†ã‹ã‚‰3æ™‚55åˆ†ã€‚PCã§äºˆå‘Šinã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€2ã¡ã‚ƒã‚“ãã‚‹ã®VIPæ¿ã«ã€ã‚¿ã‚¤ãƒˆãƒ«ã€Œè¦è¦–åºçˆ†ç ´ã™ã‚‹ã€ã€æœ¬æ–‡ã€Œå˜˜ã§ã™ã€ã€åå‰æ¬„ã«ã‚¢ã‚¯ã‚»ã‚¹å…ƒãƒªãƒ¢ãƒ¼ãƒˆãƒ›ã‚¹ãƒˆã‚’æ›¸ã„ãŸã‚¹ãƒ¬ãƒƒãƒ‰ã‚’ã€å¼·åˆ¶çš„ã«æŠ•ç¨¿ã•ã›ã‚‹çŠ¶æ…‹ã«ãªã£ã¦ã„ãŸã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã®è„†å¼±æ€§ã‚’ã¤ãã€äºˆå‘ŠæŠ•ç¨¿æ¬„ã«ä¸æ£ãªã‚³ãƒ¼ãƒ‰ãŒåŸ‹ã‚è¾¼ã¾ã‚Œã¦ã„ãŸã“ã¨ãŒåŽŸå› ã€‚æŠ•ç¨¿æ¬„ã®URLéƒ¨åˆ†ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ï¼ˆä¸æ£ãªæ–‡å—åˆ—ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹å‡¦ç†ï¼‰ã‚’è¡Œã£ã¦ã„ãªã‹ã£ãŸãŸã‚ã€æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’æŠ•ç¨¿æ¬„ã®URLéƒ¨åˆ†ã«åŸ‹ã‚è¾¼ã‚“ã å ´åˆã€ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã›ã‚‹å±é™ºæ€§ãŒ
denken 2008/08/04
äºˆå‘Š.in

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
äºˆå‘Š.inãŒæ¥½ã—ã„ã“ã¨ã«ãªã£ã¦ã‚‹ã¿ãŸã„ã ã
è¦‹ã‚‹ã¨å¤§å¤‰ãªã“ã¨ã«ãªã‚‹ã‚‰ã—ã„ã‚ˆï¼Ÿãªã‚“ã‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°äº‘ã€…â€¦ãªã‚“ã‹ã‚‚ã†æˆ»ã£ãŸã¨ã‹ã„ã†è©±ã‚‚ã‚ã‚‹ã‘ã©æ—©ã™ãŽã¦ãƒ•ã‚©ãƒãƒ¼ã—ãã‚Œã‚“ã€‚ãªã‚“ã‹æˆ»ã£ãŸã£ã¦ã®ã¯è¸ã¾ã›ã‚‹ãŸã‚ã£ã½ã„æ„Ÿã˜ã ã‘ã©ã€‚å–ã‚Šæ•¢ãˆãšè¸ã‚“ã ã‚‰VIPã«è¦è¦–åºçˆ†ç ´ã™ã‚‹ã£ã¦ä»¶åã§å‹æ‰‹ã«ã‚¹ãƒ¬ãŸã¦ã•ã›ã‚‰ã‚Œã‚‹ã‚“ã ã£ã¦ã€‚ ãã‚€ã„ã‘ã©ä¸€æ°—ã«åŒã˜ã‚¿ã‚¤ãƒˆãƒ«ã§ã‚¹ãƒ¬ç«‹ã¡ã¾ãã£ã¦ã‚‹ã®ã‚’ãƒªã‚¢ãƒ«ã§è¦‹ãŸã‚“ã§å–ã‚Šæ•¢ãˆãšãƒ¡ãƒ¢ã€‚ã‚ã¨åå‰ã¯ãƒ•ã‚·ã‚¢ãƒŠã«ãªã£ã¦ã‚‹ã‚“ã ã‚ˆãªã€ã“ã‚Œâ€¦ã€‚ ã«ã—ã¦ã‚‚ã“ã†ã„ã£ãŸæŠ€è¡“ãŒã‚ã‚‹ã“ã¨ã«å…ˆãšé©šãã â€¦
denken 2008/08/04
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’æœ¬æ°—ã§ã‚„ã£ã¦ãŸã‚‰2æ™‚é–“ã§ä»•ä¸Šã’ã‚‹ã®ã¯ç„¡ç†ã ã¨æ€ã†

äºˆå‘Š.in

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
printenv at xss-quiz.int21h.jp
printenv at xss-quiz.int21h.jp Your IP address: 133.242.243.6 () NameValue HTTP_ACCEPT*/* HTTP_CACHE_CONTROLno-cache HTTP_CONNECTIONclose HTTP_HOSTxss-quiz.int21h.jp HTTP_USER_AGENTHatenaBookmark/4.0 (Hatena::Bookmark; Analyzer) QUERY_STRING REMOTE_ADDR133.242.243.6 REQUEST_METHODGET REQUEST_SCHEMEhttp REQUEST_URI/
denken 2008/02/22
é€†è»¢ã®ç™ºæƒ³

èˆˆå‘³æ·±ã„

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
2007å¹´ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã‚’æŒ¯ã‚Šè¿”ã£ã¦ - è‘‰ã£ã±æ—¥è¨˜
æœ€è¿‘ã‚ã¡ã“ã¡ã§ã€Œæ—¥è¨˜æ›¸ãã®ã‚µãƒœã£ã¦ã‚‹ã‚ˆãã€ã¨ã‹è¨€ã‚ã‚ŒãŸã®ã§ã€ã‚µãƒœã£ã¦ã‚‹ã‚ã‘ã˜ã‚ƒãªãã£ã¦æ›¸ããƒã‚¿ãŒãªã„ã ã‘ã ã‘ã©ã€ç„¡ç†ã‚„ã‚Š2007å¹´ã®XSSã‚’æŒ¯ã‚Šè¿”ã£ã¦ã¿ã‚‹ã¨ã„ã†ãƒã‚¿ã§æ›¸ã„ã¦ã¿ã¾ã™ã€‚ä»¥ä¸‹ã€è‘—åã‚µã‚¤ãƒˆã§è¦‹ã¤ã‘ãŸXSSã§ã™ã€‚ ç”£æ¥æŠ€è¡“ç·åˆç ”ç©¶æ‰€ã®XSS 404å¿œç”ã®ãƒšãƒ¼ã‚¸ã«ã¦charsetã®æŒ‡å®šãŒãªã„ãŸã‚ã€UTF-7ã‚’åˆ©ç”¨ã—ãŸXSSãŒå¯èƒ½ã§ã—ãŸã€‚ãŸã ã—ã€ãƒšãƒ¼ã‚¸ä¸ã«æ—¥æœ¬èªžã‚’å«ã‚€ãŸã‚ã€CVE-2007-1114ã‚’åˆ©ç”¨ã—IE7ã«ã¦UTF-7ã§æ›¸ã‹ã‚ŒãŸiframeã‚’çµŒç”±ã—ãŸå ´åˆã®ã¿XSSå¯èƒ½ã§ã—ãŸã€‚ã§ã™ã®ã§ã€å®Ÿéš›ã®è„…å¨ã«ã¯ã¤ãªãŒã‚Šã«ãã„ã¨æ€ã„ã¾ã™ã€‚å±Šå‡º:2007å¹´4æœˆ11æ—¥ã€ä¿®æ£å®Œäº†:2007å¹´6æœˆ5æ—¥ sourceforge.jpã«ãŠã‘ã‚‹XSS cvs.sourceforge.jpã«ãŠã‘ã‚‹404å¿œç”ã®ãƒšãƒ¼ã‚¸ã«ã¦charsetã®æŒ‡å®šãŒãªã„ãŸã‚ã€UTF-7ã«ã‚ˆã‚‹XSSãŒå¯èƒ½ã§ã—ãŸã€‚ãƒã‚°ã‚¤ãƒ³ã—ãŸçŠ¶æ…‹ã§ã¯ã‚»ãƒƒ
denken 2007/12/26
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
ç¶š: ãã‚ãã‚UTF-7ã«ã¤ã„ã¦ä¸€è¨€ã„ã£ã¨ãã‹ - è‘‰ã£ã±æ—¥è¨˜
å²ä¸Šç©ºå‰ã®EUC-JPãƒ–ãƒ¼ãƒ ã¯ã¨ã‚Šã‚ãˆãšãŠã„ã¦ãŠã„ã¦ã€ä»Šæ—¥ã‚‚æœ€å¼·ã®æ–‡å—ã‚³ãƒ¼ãƒ‰ã§ã‚ã‚‹UTF-7ã«ã¤ã„ã¦ã€‚ ã“ã‚Œã¾ã§ç§ã®ä¸ã§ã¯ã€UTF-7ã«ã‚ˆã‚‹XSSã‚’é¿ã‘ã‚‹ãŸã‚ã«ã¯ã€Shift_JISã‚„UTF-8ã¨ã„ã£ãŸã€IEãŒå—ã‘å…¥ã‚Œå¯èƒ½ãªcharsetã‚’HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã¾ãŸã¯<meta>ã§æ˜Žè¨˜ã—ã¦ã‚„ã‚Œã°ã‚ˆã„ã¨ã„ã†ç†è§£ã§ã—ãŸã€‚ å…·ä½“çš„ã«ã¯ã€HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§ Content-Type: text/html; charset=Shift_JIS ã¨ã™ã‚‹ã‹ã€ç”Ÿæˆã™ã‚‹HTMLå†…ã§ <meta http=equiv="Content-Type" content="text/html; charset=Shift_JIS"> ã¨ã™ã‚Œã°ã€UTF-7ã«ã‚ˆã‚‹XSSã¯é˜²ã’ã‚‹ã¨æ€ã£ã¦ã„ã¾ã—ãŸã€‚ã¨ã“ã‚ãŒã€å¾Œè€…ã®<meta>ã«ã‚ˆã‚‹charsetã®æŒ‡å®šã§ã¯ã€æ¡ä»¶ã«ã‚ˆã£ã¦XSSãŒé˜²ã’ãªã„ã“ã¨ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ã«æ°—ä»˜ãã¾
denken 2007/10/23
UTF-7

æ–‡å—ã‚³ãƒ¼ãƒ‰

XSS
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
denken 2007/08/27
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹‰å¼·ä¼šã«å‚åŠ ã—ã¦ã„ã‚‹äººãŒã“ã‚Œã‚’è¸ã‚€ã®ã¯ã©ã†ãªã®ã‹ã¿ãŸã„ãªã®ãŒTwitterã«ã‚ã£ãŸãª

ã¯ã¾ã¡ã¡ã‚ƒã‚“

XSS

Twitter
ãƒªãƒ³ã‚¯
ç¬¬7å›žã€€ã„ã¾ã•ã‚‰ãªãŒã‚‰ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®åŸºç¤Žã®åŸºç¤Ž | gihyo.jp
ä»Šå›žã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œã£ãŸã“ã¨ãŒãªã„æ–¹ã§ã‚‚åˆ†ã‹ã‚‹ã‚ˆã†ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã‚’è§£èª¬ã—ã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã¯ï¼Ÿ åˆã‚ã¦ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨èžã„ã¦ã€ã©ã®ã‚ˆã†ãªå•é¡Œãªã®ã‹ã™ãã«ç†è§£ã§ãã‚‹äººã¯ã„ãªã„ã¨æ€ã„ã¾ã™ã€‚ã‚µã‚¤ãƒˆAã«è¨˜è¿°ã•ã‚ŒãŸJavaScriptãƒ—ãƒã‚°ãƒ©ãƒ ãŒã‚µã‚¤ãƒˆBä¸Šã§å®Ÿè¡Œã•ã‚Œã‚‹ãŸã‚ã«ç™ºç”Ÿã™ã‚‹ã“ã¨ãŒå•é¡Œã¨ã•ã‚ŒãŸã®ã§ã€ã€Œâ ã‚µã‚¤ãƒˆé–“ã‚’ã¾ãŸãŒã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å®Ÿè¡Œã€å•é¡Œã¨ã—ã¦ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã¨åå‰ãŒä»˜ã‘ã‚‰ã‚Œã¾ã—ãŸã€‚ã“ã®å‘½åã§ã¯ç›´æ„Ÿçš„ã«åˆ†ã‹ã‚Šã¥ã‚‰ã„ã€ã‚µã‚¤ãƒˆé–“ã«ã¾ãŸãŒã‚‰ãšHTMLãƒ¡ãƒ¼ãƒ«ãªã©ã«JavaScriptã‚’æŒ¿å…¥ã™ã‚‹æ”»æ’ƒã§ã‚‚åŒã˜åŠ¹æžœãŒå¾—ã‚‰ã‚Œã‚‹ã“ã¨ã‹ã‚‰ã€ã€Œâ JavaScriptã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã¨ã‚‚å‘¼ã°ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ å›³1ã€€ç°¡å˜ãªã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ä¾‹1ã€€ç°¡å˜ãªç›´æŽ¥æ”»æ’ƒ æŽ²ç¤ºæ¿ã‚µã‚¤ãƒˆã«æŠ•ç¨¿ã•ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦
denken 2007/07/25
PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

è³‡æ–™
ãƒªãƒ³ã‚¯
JavaScriptã‚’åŸ‹ã‚è¾¼ã‚“ã ç”»åƒã‚’ä½œã£ã¦ã¿ã¾ã—ãŸ
è£œè¶³ ã“ã®è¨˜äº‹ã¯æ—§å¾³ä¸¸æµ©ã®æ—¥è¨˜ã‹ã‚‰ã®è»¢è¼‰ã§ã™ã€‚å…ƒURLã€ã‚¢ãƒ¼ã‚«ã‚¤ãƒ–ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯1ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯2ã€‚ å‚™å¿˜ã®ãŸã‚è»¢è¼‰ã„ãŸã—ã¾ã™ãŒã€ã“ã®è¨˜äº‹ã¯2007å¹´7æœˆ17æ—¥ã«å…¬é–‹ã•ã‚ŒãŸã‚‚ã®ã§ã€å½“æ™‚ã®å¾³ä¸¸ã®è€ƒãˆã‚’ç¤ºã™ã‚‚ã®ã‚’ã€åŸºæœ¬çš„ã«å†…å®¹ã‚’å¤‰æ›´ã›ãšã«ãã®ã¾ã¾è»¢è¼‰ã™ã‚‹ã‚‚ã®ã§ã™ã€‚ è£œè¶³çµ‚ã‚ã‚Š å¯ºç”°ã•ã‚“ã®æ—¥è¨˜ã«è§¦ç™ºã•ã‚Œã¦ã€JavaScriptã‚’åŸ‹ã‚è¾¼ã‚“ã PNGç”»åƒã‚’ä½œã£ã¦ã¿ã¾ã—ãŸã€‚ æ³¨æ„:ã“ã®ç”»åƒã«ã¯JavaScriptãŒåŸ‹ã‚è¾¼ã‚“ã§ã‚ã‚Šã¾ã™ã€‚ ã“ã“ã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ã€JavaScriptãŒç™ºå‹•ã—ã€ã‚ãªãŸã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆä¸Šã§Cookieã®å€¤ã‚’è¡¨ç¤ºã—ã¾ã™(IEé™å®šã§ã™) è¿½è¨˜ ImageMagic ã® convertã‚³ãƒžãƒ³ãƒ‰ã§PNGâ†’GIFâ†’PNGã¨å¤‰æ›ã—ã¦ã‚‚ã€JavaScriptã¯å‰Šé™¤ã•ã‚Œã¾ã›ã‚“ã§ã—ãŸã€‚ã“ã‚Œã¯ã€T.Teradaã•ã‚“ã®è§£èª¬ã®è¿½è©¦ã«éŽãŽã¾ã›ã‚“ãŒã€ä¸€å¿œã”å ±å‘Šã¾ã§ã€‚ è¿½è¨˜(2007/10/10)
denken 2007/07/18
IE

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

JavaScript
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸