[B! Twitter][xss] HeavyFeatherã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

HeavyFeather id:HeavyFeather

Twitterã¨xssã«é–¢ã™ã‚‹HeavyFeatherã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Twitterã®è„†å¼±æ€§3é€£ç™º - ma<s>atokinugawa's blog
æœ€è¿‘åƒ•ãŒç™ºè¦‹ã—ã€ä¿®æ£ã•ã‚ŒãŸTwitterã®è„†å¼±æ€§ã‚’3ã¤ç´¹ä»‹ã—ã¾ã™ã€‚ 1.æ—§Twitterã®æ–‡å—åˆ—å‡¦ç†ã«çµ¡ã‚“ã XSS åŽ»å¹´ã®å¤ãã‚‰ã„ã«ã€Twitter Webä¸Šã§  ã€œ ÿ ã®æ–‡å—å‚ç…§ãŒå«ã¾ã‚Œã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã‚’XMLHttpRequestã§èªã¿è¾¼ã‚“ã éš›ã«è¡¨ç¤ºãŒä¹±ã‚Œã‚‹ã¨ã„ã†å•é¡Œã«æ°—ä»˜ã*1ã€ãã®æ™‚ã¯ã“ã‚Œã¯è„†å¼±æ€§ã«ã¯ç¹‹ãŒã‚‰ãªã„ã ã‚ã†ã¨ã„ã†åˆ¤æ–ã‚’ã—ãŸã®ã ã‘ã©ã€ä»Šå¹´ã®4æœˆã«ãªã£ã¦æ”¹ã‚ã¦èª¿ã¹ãŸã¨ã“ã‚è²«é€šã—ã¾ã—ãŸã€‚ è¡¨ç¤ºãŒä¹±ã‚Œã‚‹ã¨ã„ã†ã®ã¯ã€ ã€œ ÿ ã®æ–‡å—å‚ç…§ãŒå«ã¾ã‚Œã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆãŒã‚ã‚‹ã¨ã€ä¸€éƒ¨ã®æ–‡å—ãŒ\XXXXã®å½¢å¼ã«åŒ–ã‘ãŸã‚Šã€ãƒ„ã‚¤ãƒ¼ãƒˆå‘¨è¾ºã®ã€Œ"ã€ãŒã€Œ\"ã€ã«ãªã£ãŸã‚Šã™ã‚‹ã‚‚ã®ã ã£ãŸã®ã§ã™ãŒã€ä»Šå›žã¯ã€Œ"ã€ãŒã€Œ\"ã€ã«ãªã‚‹ç‚¹ãŒè„†å¼±æ€§ã‚’ç™ºç”Ÿã•ã›ã¦ã„ã¾ã—ãŸã€‚ ã“ã®æ¡ä»¶ã§XSSã•ã›ã‚ˆã†ã¨æ€ã£ãŸã‚‰ã€ãƒ„ã‚¤ãƒ¼ãƒˆã‚’ç´°å·¥ã—ã¦URLã‚„@ã‚„#ãªã©ã‚ªãƒ¼ãƒˆãƒªãƒ³ã‚¯ãŒä½œæˆã•ã‚Œã‚‹éƒ¨åˆ†ã«ã†ã¾ã„ã“ã¨ã‚¤ãƒ™ãƒ³
HeavyFeather 2011/07/28
Twitter

security

xss

web
ãƒªãƒ³ã‚¯
ä¸–ç•Œçš„çŒ›å¨ã‚’å¥®ã£ãŸTwitterãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ãƒ»ãƒã‚°ã¯ã©ã†åºƒã¾ã£ãŸï¼Ÿ
ä¸–ç•Œçš„çŒ›å¨ã‚’å¥®ã£ãŸTwitterãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ãƒ»ãƒã‚°ã¯ã©ã†åºƒã¾ã£ãŸï¼Ÿ2010.09.22 10:305,281 satomi ã“ã‚Œã¯ä»Šæœä¸–ç•Œä¸ã‚’å¸å·»ã—ãŸTwitterãƒã‚°ã«ã‚„ã‚‰ã‚ŒãŸãƒ–ãƒ©ã‚¦ãƒ³å…ƒè‹±é¦–ç›¸å¤«äººã®Twitterå…¬å¼ã‚µã‚¤ãƒˆã€‚å·¨å¤§ãªè‹±æ–‡å—ï½¢hï½£ãŒå‡ºã¦ã€æ—¥æœ¬ã®ãƒãƒ«ãƒŽã‚µã‚¤ãƒˆã«è‡ªå‹•ãƒªãƒ³ã‚¯ã—ã¦ã¾ã™...ãªã‚“ã¨ã¾ã‚...ã€‚ ãƒ„ã‚¤ãƒƒã‚¿ãƒ¼å…¬å¼Webã§ãƒªãƒ³ã‚¯ã‚’ãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ã™ã‚‹ã¨ã€ãƒ•ã‚©ãƒãƒ¯ãƒ¼ã«ã‚¹ãƒ‘ãƒ ã‚„ãƒãƒ«ãƒŽãŒãƒªãƒ„ã‚¤ãƒ¼ãƒˆï¼ˆRTï¼‰ã•ã‚Œã¡ã‚ƒã†ã€ã“ã®ï½¢ãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ãƒã‚°ï½£ã€‚ã„ã‚„ã‚ã€ã²ã©ã‹ã£ãŸã²ã©ã‹ã£ãŸã€‚ä¸–ç•Œä¸ã«ã¿ã‚‹ã¿ã‚‹é‡Žç«ã®ã‚ˆã†ã«åºƒã¾ã£ã¦ä¸€æ™‚ã¯ã©ã†ãªã‚‹ã“ã¨ã‹ã¨æ€ã„ã¾ã—ãŸã‚ˆã€‚ ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼ã®ã‚¢ãƒ—ãƒªä½¿ã£ã¦ã‚‹äººã¯å¤§ä¸ˆå¤«ã§ã™ï¼ˆãƒã‚°ã£ãŸRTã‚‚ãã£ã¡ã§å‰Šé™¤ã§ãã¾ã™ï¼‰ãŒã€twitter.comé–‹ã„ã¦ã“ã‚“ãªçŠ¶æ…‹ãªã£ã¦ã¦ãƒ“ãƒƒã‚¯ãƒªã“ã„ãŸäººã‚‚å¤šã„ã‚“ã˜ã‚ƒï¼Ÿ ã“ã‚Œã¯Twitterã®ã‚µã‚¤ãƒˆã«ã‚ã‚‹ã‚¯ãƒã‚¹ãƒ»ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSS
HeavyFeather 2010/09/25
twitter

security

XSS
ãƒªãƒ³ã‚¯
Kazuho@Cybozu Labs: (Twitter ã® XSS è„†å¼±æ€§ã«é–¢é€£ã—ã¦) æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®æ£ã—ã„ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦
æ˜¨æ—¥ã® Twitter ã® XSS é¨’ãŽã¯ã€ã¾ã çš†ã•ã‚“ã®è¨˜æ†¶ã«æ–°ã—ã„ã“ã¨ã¨æ€ã„ã¾ã™ã€‚ã„ã„æ©Ÿä¼šãªã®ã§ã€ãƒ„ã‚¤ãƒ¼ãƒˆã®ã‚ˆã†ãªæ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹æ³•ã«ã¤ã„ã¦è§¦ã‚Œã¦ãŠããŸã„ã¨æ€ã„ã¾ã™ã€‚ Twitter ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã¯ã€å˜ãªã‚‹å¹³æ–‡ï¼ˆãƒ—ãƒ¬ã‚¤ãƒ³ãƒ†ã‚ã‚¹ãƒˆï¼‰ã§ã¯ãªãã€ã€Œ@è‹±æ•°å—ã€ã®ã‚ˆã†ãªä»–ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¸ã®è¨€åŠã¨ã€Œhttp://ã€œã€ã®ã‚ˆã†ãª URL ã‚’è‡ªå‹•çš„ã«ãƒã‚¤ãƒ‘ãƒ¼ãƒªãƒ³ã‚¯åŒ–ã™ã‚‹æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã§ã™ã€‚ ã“ã®ã‚ˆã†ãªè¤‡æ•°ã®ãƒ«ãƒ¼ãƒ«ã‚’ã‚‚ã¤æ§‹é€ åŒ–ãƒ†ã‚ã‚¹ãƒˆã‚’ HTML åŒ–ã™ã‚‹éš›ã«ã¯ã€ã©ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã‘ã°ã„ã„ã®ã§ã—ã‚‡ã†ï¼Ÿã€€ã¾ãšã€Œ@ã€œã€ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ã€œ ã®ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ãŸ A HREF ã‚¿ã‚°ã®ä¸ã® URL ãŒã•ã‚‰ã«ãƒªãƒ³ã‚¯åŒ–ã•ã‚Œã¦ã„ã¾ã„ã¾ã™ãã€‚ ã§ã¯ã€URL ã‚’ãƒªãƒ³ã‚¯åŒ–ã—ã¦ã‹ã‚‰ @ã€œ ã‚’ãƒªãƒ³ã‚¯åŒ–ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿã€€ãã‚Œã ã¨ã€@ ã‚’å«ã‚€ URL ãŒã‚ã£ãŸå ´åˆã«
HeavyFeather 2010/09/25
XSS

twitter

security

programming

encode

HTML
ãƒªãƒ³ã‚¯
Twitterã«XSSæ”»æ’ƒ--ã‚½ãƒ•ã‚©ã‚¹å ±å‘Š
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼šç¤¾Sophosã¯ç±³å›½æ™‚é–“9æœˆ21æ—¥ã€Twitterã®ã‚¦ã‚§ãƒ–ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ã‚’æ‚ªç”¨ã—ãŸã€æ½œåœ¨çš„ãªå±é™ºæ€§ã‚’æŒã¤æ–°ãŸãªãƒãƒƒã‚¯ã«é–¢ã™ã‚‹ã‚¨ãƒ³ãƒˆãƒªã‚’åŒç¤¾ãƒ–ãƒã‚°ã«æŠ•ç¨¿ã—ãŸã€‚å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã¯Twitter.comã®ã¿ã§ã€ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼è£½ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¯å½±éŸ¿ã‚’å—ã‘ãªã„ã€‚ ã“ã®ãƒãƒƒã‚¯ã®ä»•çµ„ã¿ã¯æ¬¡ã®ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚ãƒ„ã‚¤ãƒ¼ãƒˆã®URLå†…ã«JavaScriptã‚³ãƒ¼ãƒ‰ï¼ˆonmouseoverï¼‰ã‚’æŒ¿å…¥ã™ã‚‹ã“ã¨ã§ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒãƒªãƒ³ã‚¯ã®ä¸Šã«ã‚«ãƒ¼ã‚½ãƒ«ã‚’ç§»å‹•ã•ã›ãŸå ´åˆã«ãƒãƒƒãƒ—ã‚¢ãƒƒãƒ—ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’è¡¨ç¤ºã•ã›ã‚‹ã‚ˆã†ã«ã™ã‚‹ã€‚ Sophosã¯ã€ã“ã®æ”»æ’ƒã‚’æœ€åˆã«èµ·ã“ã—ãŸäººã€…ã¯ä»Šã®ã¨ã“ã‚ã€ŒéŠã³ã§ã‚„ã£ã¦ã„ã‚‹ã€ãŒã€ã‚¹ãƒ‘ãƒžãƒ¼ã‚„æ‚ªæ„ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã®æä¾›è€…ã‚‰ã«æ‚ªç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚‹ã¨ã—ã¦ã„ã‚‹ã€‚ã“ã®å•é¡Œã¯ã€å…ˆé€±å…¬é–‹ã•ã‚ŒãŸæ–°ã—ã„Twitterã®ã‚¦ã‚§ãƒ–ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ã¨ã¨ã‚‚ã«ã€å¾“æ¥ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ã«ã‚‚å½±éŸ¿ãŒã‚ã‚‹ã¨æ€ã‚ã‚Œã‚‹ã€‚ ã€ŒMouseoverã€ãƒ
HeavyFeather 2010/09/22
javascript

twitter

security

xss
ãƒªãƒ³ã‚¯
ç‹™ã‚ã‚ŒãŸâ€œã¤ã¶ã‚„ãâ€â€•â€•Twitterã«ä»•æŽ›ã‘ã‚‰ã‚ŒãŸãƒ¯ãƒŠ
Twitterã®ã¤ã¶ã‚„ããŒç‹™ã‚ã‚ŒãŸã€‚ã—ã‹ã—ã€ã“ã‚Œã¯æ°·å±±ã®ä¸€è§’ã‹ã‚‚ã—ã‚Œãªã„ã€‚ãã‚Œã ã‘æ‹¡å¤§ã—ãŸTwitterã¯ã€ã“ã‚Œã‹ã‚‰ã©ã®ã‚ˆã†ãªæ–¹å‘ã«é€²ã‚“ã§ã„ãã®ã ã‚ã†ã‹ã€‚ 2008å¹´4æœˆ23æ—¥ã«æ—¥æœ¬ç‰ˆã‚µãƒ¼ãƒ“ã‚¹ãŒé–‹å§‹ã•ã‚Œã¦ã€ã¾ã‚‚ãªã1å‘¨å¹´ã‚’è¿Žãˆã‚‹ãƒŸãƒ‹ãƒ–ãƒã‚°ã‚µãƒ¼ãƒ“ã‚¹ã€ŒTwitterã€ã€‚ç±³comScoreã®èª¿æŸ»ã«ã‚ˆã‚Œã°ã€å…¨ä¸–ç•Œã®Twitterã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã¯ã“ã“æ•°ã‚«æœˆã§æ€¥å¢—ã—ã€2æœˆã«ã¯ä¼¸ã³çŽ‡ãŒ700ï¼…ã‚’è¶…ãˆãŸã¨ã„ã†ã€‚ã—ã‹ã‚‚ã€çˆ†ç™ºçš„ãªæˆé•·ã®èƒŒæ™¯ã«ã¯ã€å¾“æ¥ã®ä¸»ãªãƒ¦ãƒ¼ã‚¶ãƒ¼å±¤ã§ã‚ã‚‹18ï½ž24æ³ã‚ˆã‚Šã‚‚ã€20ä»£å¾ŒåŠï½ž50ä»£ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ€¥å¢—ã—ã¦ã„ã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã‚ˆã†ã ã€‚ ãã—ã¦ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå¢—ãˆã‚‹ã¨ã¨ã‚‚ã«ã€ã•ã¾ã–ã¾ãªçŠ¯ç½ªã®æ¨™çš„ã«ã‚‚ãªã£ã¦ãã¦ã„ã‚‹ã€‚ã“ã®ã“ã¨ã¯ã€ä»¥å‰ã‚‚ä¼ãˆãŸé€šã‚Šã ãŒã€ãã®æ™‚ã¯æƒ³åƒã—å¾—ãªã„ã»ã©ã®æ€¥å¢—ã¶ã‚Šãªã®ã ã€‚ ãƒªãƒ³ã‚¯ã‚’ã‚€ã‚„ã¿ã«ã‚¯ãƒªãƒƒã‚¯ã—ã¦ã¯ã„ã‘ãªã„ï¼Ÿ 4æœˆ12æ—¥ã€ç±³Twitterã¯XSSè„†å¼±æ€§ã‚’çªã„ãŸãƒ¯ãƒ¼ãƒ æ”»æ’ƒã‚’å—ã‘ãŸ
HeavyFeather 2009/04/22
security

twitter

web

xss

sns

communication
ãƒªãƒ³ã‚¯
Twitter XSS é¨’å‹• - Yaks
(2009/04/12 6ï¼š40 pm è¿½è¨˜ã—ã¾ã—ãŸ) (2009/04/12 7ï¼š24 pm å†åº¦è¿½è¨˜ã—ã¾ã—ãŸ) å…ˆã»ã©ã‹ã‚‰ Twitterä¸Šã«ã¦ XSS ã®ã‚ˆã‚‹è¢«å®³ãŒå‡ºã¦ã„ã¾ã™ã€‚ æ—¢ã«æµ·å¤–ã®ãƒ–ãƒã‚°ãªã©ã§ã‚‚å–ã‚Šä¸Šã’ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ HOWTO: Remove StalkDaily.com Auto-Tweets From Your Infected Twitter Profile (Twittercsm) Warning: Twitter Hit By StalkDaily Worm (TechCrunch) æ—¢ã« XSS ã®éƒ¨åˆ†ã¯æ”¹ä¿®ã•ã‚Œã¦å¤§åˆ†åŽã¾ã£ãŸã‚ˆã†ã§ã™ãŒã€å¿µã®ãŸã‚ã«æ›¸ã„ã¦ãŠãã¾ã™ã€‚ å†…å®¹ã¨ã—ã¦ã¯ã€ 1. StalkDaily.com ã‚’å®£ä¼ã™ã‚‹ã¤ã¶ã‚„ããŒå‹æ‰‹ã«æŠ•ç¨¿ã•ã‚Œã‚‹ 2. ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã® Web ãŒæ”¹ã–ã‚“ã•ã‚Œã‚‹ 3. æ”¹ã–ã‚“ã•ã‚ŒãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒšãƒ¼ã‚¸ã‚’è¦‹ã‚‹ã¨ã€è‡ªåˆ†ã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚‚
HeavyFeather 2009/04/14
twitter

security

vulnerability

xss

webservice
ãƒªãƒ³ã‚¯
1