[B! browser][security] shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sho id:sho

browserã¨securityã«é–¢ã™ã‚‹shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ–ãƒ©ã‚¦ã‚¶é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«è¡¨ç¤ºã•ã‚Œãªã„æƒ…å ±é€ä¿¡æ‰‹æ³• - Qiita
ã¯ã˜ã‚ã« ã¯ã˜ã‚ã¾ã—ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®Satoki (@satoki00) ã§ã™ã€‚ä»Šå›žã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã‹ã‚‰éš ã‚Œã¦ã€Webã‚µã‚¤ãƒˆå†…ã®æƒ…å ±ã‚’é€ä¿¡ã™ã‚‹æ‰‹æ³•ã‚’ã¾ã¨ã‚ã¾ã™ã€‚æ‰€è¬‚Exfiltrationã¨ã„ã†ã‚„ã¤ã§ã™ã€‚ä¸ã«ã¯CSPã®åˆ¶é™ã‚’Bypassã™ã‚‹ãŸã‚ã«ç”¨ã„ã‚‰ã‚Œã‚‹ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚‚ã‚ã‚Šã¾ã™ã€‚CTFãªã©ã§å®‰å…¨ã«ä½¿ã£ã¦ãã ã•ã„ã€‚ å‰æ ç™ºç«¯ã¯Webä¸Šã§ãƒ†ã‚ã‚¹ãƒˆã®æ–‡å—æ•°ã‚’ã‚«ã‚¦ãƒ³ãƒˆã§ãã‚‹ã‚µã‚¤ãƒˆãŒé–‰éŽ–ã™ã‚‹éš›ã®è©±ã§ã™ã€‚ã‚«ã‚¦ãƒ³ãƒˆå¯¾è±¡ã®ãƒ†ã‚ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ãŒã‚µã‚¤ãƒˆé‹å–¶ (ã‚„ã‚µã‚¤ãƒˆã‚’æ”¹ç«„ã—ãŸæ”»æ’ƒè€…) ã«ç›—ã¿å–ã‚‰ã‚Œã¦ã„ãªã„ã‹ã¨ã„ã†è°è«–ãŒå·»ãèµ·ã“ã£ã¦ã„ã¾ã—ãŸã€‚ã€Œç›—ã¿å–ã‚‰ã‚Œã¦ã„ãªã„ã€å´ã®ä¸»å¼µã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é€ä¿¡ã—ãŸå½¢è·¡ãŒãªã„ã¨ã„ã†ã‚‚ã®ã§ã—ãŸã€‚ã“ã“ã§ ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«è¡¨ç¤ºãŒãªã‘ã‚Œã°å¤–éƒ¨ã¸ãƒ‡ãƒ¼ã‚¿ã‚’é€ä¿¡ã—ã¦ã„ãªã„ã®ã‹ï¼Ÿ ã¨ã„ã£ãŸç–‘å•ãŒ
sho 2024/07/15
ã¾ããã®ã¸ã‚“ã ã‚ã†ãªã¨ã„ã†å†…å®¹ã ã£ãŸãŒã€æ¤œè¨¼ã¨ã„ã£ã—ã‚‡ã«æ‰‹æ³•ãŒã¾ã¨ã¾ã£ã¦ã‚‹ã®ã¯è‰¯ã

security

browser
ãƒªãƒ³ã‚¯
æ–°ãŸãªãƒ–ãƒ©ã‚¦ã‚¶æ”»æ’ƒæ‰‹æ³•ãŒè¦‹ã¤ã‹ã‚‹--ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã‚¦ã‚§ãƒ–ãƒšãƒ¼ã‚¸ã‚’é›¢ã‚ŒãŸå¾Œã‚‚æœ‰åŠ¹
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ„ŸæŸ“ã—ãŸã‚¦ã‚§ãƒ–ãƒšãƒ¼ã‚¸ã‚’é–‰ã˜ãŸã‚Šã€ãã“ã‹ã‚‰é›¢ã‚ŒãŸã‚Šã—ãŸå¾Œã§ã‚‚ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ–ãƒ©ã‚¦ã‚¶å†…ã§æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã§ãã‚‹æ–°ã—ã„ãƒ–ãƒ©ã‚¦ã‚¶ãƒ™ãƒ¼ã‚¹ã®æ”»æ’ƒãŒã‚®ãƒªã‚·ãƒ£ã®å¦è€…ã‚‰ã«ã‚ˆã£ã¦è€ƒãˆå‡ºã•ã‚ŒãŸã€‚ ã€ŒMarioNetã€ã¨å‘¼ã°ã‚Œã‚‹ã“ã®æ–°ã—ã„æ”»æ’ƒã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰å·¨å¤§ãªãƒœãƒƒãƒˆãƒãƒƒãƒˆã‚’æ§‹ç¯‰ã™ã‚‹ãŸã‚ã®æ‰‰ã‚’é–‹ãã€‚ç ”ç©¶è€…ã«ã‚ˆã‚‹ã¨ã€ã“ã‚Œã‚‰ã®ãƒœãƒƒãƒˆãƒãƒƒãƒˆã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶å†…ã§ã®ä¸æ£ãªä»®æƒ³é€šè²¨ãƒžã‚¤ãƒ‹ãƒ³ã‚°ï¼ˆã‚¯ãƒªãƒ—ãƒˆã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ï¼‰ã€DDoSæ”»æ’ƒã€æ‚ªæ„ã‚ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ›ã‚¹ãƒ†ã‚£ãƒ³ã‚°ï¼å…±æœ‰ã€åˆ†æ•£åž‹ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚¯ãƒ©ãƒƒã‚ãƒ³ã‚°ã€ãƒ—ãƒã‚ã‚·ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã§ã®ä¸æ£ãƒªãƒ¬ãƒ¼ã€ã‚¯ãƒªãƒƒã‚¯è©æ¬ºã®å®£ä¼ã€ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯çµ±è¨ˆã®ã‹ã•å¢—ã—ã«ä½¿ç”¨ã§ãã‚‹ã€‚ ä¸¡è€…ã®é•ã„ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¿ãƒ–ã‚’é–‰ã˜ãŸã‚Šã€æ‚ªæ„ã‚ã‚‹
sho 2019/02/26
security

browser

serviveworker
ãƒªãƒ³ã‚¯
NECã€ä½å‹ç”Ÿå‘½ã®æ¬¡æœŸã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆåŸºç›¤ã‚’å—æ³¨ã—2018å¹´åº¦ã«ç¨¼åƒ
NECã¯2016å¹´10æœˆ17æ—¥ã€ä½å‹ç”Ÿå‘½ä¿é™ºã‹ã‚‰ã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆåŸºç›¤ã€Œã‚ã„ã‚ãƒ¥ãƒ¼ãƒ–ã‚·ã‚¹ãƒ†ãƒ ã€ã®æ¬¡æœŸã‚·ã‚¹ãƒ†ãƒ æ§‹ç¯‰ã‚’å—æ³¨ã—ãŸã¨ç™ºè¡¨ã—ãŸã€‚2018å¹´åº¦ã®ç¨¼åƒã‚’äºˆå®šã™ã‚‹ã€‚æ¬¡æœŸã‚·ã‚¹ãƒ†ãƒ ã§ã¯ã€ã‚µãƒ¼ãƒãƒ¼åŸºç›¤ã®ä»®æƒ³åŒ–ã«æ¬¡ã„ã§ã€SDNï¼ˆã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ãƒ»ãƒ‡ãƒ•ã‚¡ã‚¤ãƒ³ãƒ‰ãƒ»ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ï¼‰ã®å°Žå…¥ã«ã‚ˆã£ã¦ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯åŸºç›¤ã‚‚ä»®æƒ³åŒ–ã™ã‚‹ã€‚ æœ¬ã‚·ã‚¹ãƒ†ãƒ åŸºç›¤ã¯ã€ã‚µãƒ¼ãƒãƒ¼ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã€ãƒŸãƒ‰ãƒ«ã‚¦ã‚¨ã‚¢ãªã©ã®ITè³‡æºã‚’æä¾›ã™ã‚‹ã€Œã‚¤ãƒ³ãƒ•ãƒ©åŸºç›¤ã€ã¨ã€å„ç¨®æ¥å‹™ã‚·ã‚¹ãƒ†ãƒ ã‚’åˆ©ç”¨ã™ã‚‹ãŸã‚ã«å¿…è¦ãªèªè¨¼æ©Ÿèƒ½ã€é‹ç”¨ç›£è¦–æ©Ÿèƒ½ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãªã©ã®å…±é€šæ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã€Œã‚ã„ã‚ãƒ¥ãƒ¼ãƒ–åŸºç›¤ã€ã§æ§‹æˆã™ã‚‹ã€‚ æ¬¡æœŸã‚·ã‚¹ãƒ†ãƒ ã®ã‚¤ãƒ³ãƒ•ãƒ©åŸºç›¤ã§ã¯ã€ä»¥å‰ã‹ã‚‰å–ã‚Šçµ„ã‚“ã§ã„ã‚‹ã‚µãƒ¼ãƒãƒ¼ã®ä»®æƒ³åŒ–ã«ç¶šã„ã¦ã€æ–°ãŸã«ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯åŸºç›¤ã‚’ä»®æƒ³åŒ–ã™ã‚‹ã€‚åˆ©ç”¨ã™ã‚‹SDNè£½å“ã¯æœªå®šã€‚ã‚µãƒ¼ãƒãƒ¼ä»®æƒ³åŒ–åŸºç›¤ã«ãŠã„ã¦ã¯ã€ç‰©ç†ã‚µãƒ¼ãƒãƒ¼ã®PCã‚µãƒ¼ãƒãƒ¼åŒ–ã‚’é€²ã‚ã‚‹ã€‚ç¾åœ¨ã¯å•†ç”¨UNIXã‚µãƒ¼ãƒãƒ¼ã¨PCã‚µãƒ¼ãƒãƒ¼ãŒæ··åœ¨ã—ã¦ã„ã‚‹ãŒ
sho 2016/10/18
è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã‚‚ã„ã£ã—ã‚‡ã«ã‚¹ã‚¿ãƒ¼ãƒˆã—ã¦æ¬²ã—ã„ã¨ã“ã‚

security

browser

nec
ãƒªãƒ³ã‚¯
ç¬¬4å›žã€€URLã¨ã‚ªãƒªã‚¸ãƒ³ | gihyo.jp
URLã¯ã€Webãƒ–ãƒ©ã‚¦ã‚¸ãƒ³ã‚°ã‚’é–‹å§‹ã™ã‚‹ã¨ã„ã†æ„å‘³ã§ã‚‚ã€Webã«é–¢é€£ã™ã‚‹æŠ€è¡“ã®å…¥ã‚Šå£ã¨ã„ã†æ„å‘³ã§ã‚‚ã€Webã«ãŠã‘ã‚‹èµ·ç‚¹ãã®ã‚‚ã®ã§ã™ã€‚ æ”»æ’ƒè€…ã®è¦–ç‚¹ã‹ã‚‰è¦‹ã‚‹ã¨ã€å¤šãã®å ´åˆã€URLã¯æ”»æ’ƒè€…è‡ªèº«ã«ã‚ˆã£ã¦ã‚³ãƒ³ãƒˆãƒãƒ¼ãƒ«å¯èƒ½ã§ã™ã€‚ãã®è¤‡é›‘ãªæ§‹é€ ã‹ã‚‰ã€ãƒ—ãƒã‚°ãƒ©ãƒ å†…ã§URLã‚’ãƒ‡ãƒ¼ã‚¿ã¨ã—ã¦å–ã‚Šæ‰±ã†éš›ã«ã¾ã¡ãŒã„ãŒç™ºç”Ÿã—ã‚„ã™ãã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œç‚¹ã‚’å¼•ãèµ·ã“ã—ã‚„ã™ã„æ ¼å¥½ã®ãã‚‰ã„ç›®ã€æ”»æ’ƒã®èµ·ç‚¹ã§ã‚ã‚‹ã¨ã‚‚è¨€ãˆã¾ã™ã€‚ ã¾ãŸã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã„ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ç¢ºä¿ã™ã‚‹ãŸã‚ã«ã¯ã€ç‰¹å®šã®ãƒªã‚½ãƒ¼ã‚¹ãŒãã‚Œãžã‚Œã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è‡ªèº«ã¨åŒä¸€ã®ä¿è·ç¯„å›²ã«ã‚ã‚‹ã‚‚ã®ãªã®ã‹ã€ã‚ã‚‹ã„ã¯ç¬¬ä¸‰è€…ã®ç”¨æ„ã—ãŸå¯èƒ½æ€§ãŒã‚ã‚Šä¿¡ç”¨ã§ããªã„ã‚‚ã®ãªã®ã‹ã‚’åŒºåˆ¥ã—ã¦å–ã‚Šæ‰±ã†å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®å¢ƒç•Œæ¡ä»¶ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³è‡ªèº«ã®å‹•ä½œã—ã¦ã„ã‚‹URLã‚’åŸºã¨ã—ãŸã€Œã‚ªãƒªã‚¸ãƒ³ã€ã¨å‘¼ã°ã‚Œã‚‹ç¯„å›²ã«ã‚ˆã£ã¦æ±ºå®šã•ã‚Œã¾ã™ã€‚ ä»Šå›žã¯ã€JavaScriptã§ã®ã‚»ã‚ãƒ¥
sho 2016/07/27
security

javascript

browser
ãƒªãƒ³ã‚¯
Man in the Browser in Androidã®å¯èƒ½æ€§ - FFRI
Fourteenforty Research Institute, Inc. 1 Fourteenforty Research Institute, Inc. Fourteenforty Research Institute, Inc. æ ªå¼ä¼šç¤¾ ãƒ•ã‚©ãƒ†ã‚£ãƒ¼ãƒ³ãƒ•ã‚©ãƒ†ã‚£æŠ€è¡“ç ”ç©¶æ‰€ http://www.fourteenforty.jp Ver 2.00.01 Man in the Browser in Androidã®å¯èƒ½æ€§ Fourteenforty Research Institute, Inc. â€¢ ç¾åœ¨ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®é–¢å¿ƒãŒé«˜ã¾ã£ã¦ã„ã‚‹ â€¢ ä¸€æ–¹ã§å¾“æ¥ã‹ã‚‰ã®Windows PCã§ã‚‚ãƒžãƒ«ã‚¦ã‚§ã‚¢ã®æ”»æ’ƒæ‰‹æ³•ãŒé«˜åº¦åŒ–ã—ã¦ã ã¦ãŠã‚Šã€ãã®ä¸€ã¤ã®ä¾‹ãŒæœ€è¿‘ãƒ‹ãƒ¥ãƒ¼ã‚¹ã§ã‚‚å–ã‚Šä¸Šã’ã‚Œã¦ã„ã‚‹ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒ ãƒ³ã‚¯ã‚’ç‹™ã£ãŸMan in the Browser (MITB)ã§ã‚ã‚‹ â€¢ ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³
sho 2013/02/19
security

android

browser
ãƒªãƒ³ã‚¯
1