[B! ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] ama-chã®ãƒ

ama-ch id:ama-ch

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹ama-chã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚µã‚¤ãƒœã‚¦ã‚ºãŒè„†å¼±æ€§ç™ºè¦‹ã‚³ãƒ³ãƒ†ã‚¹ãƒˆã‚’å®Ÿæ–½ã—ãŸãƒ¯ã‚±
ã‚µã‚¤ãƒœã‚¦ã‚ºã¯2013å¹´11æœˆ11æ—¥ã‹ã‚‰åŒæœˆ25æ—¥ã«ã‹ã‘ã¦ã®2é€±é–“ã«æ¸¡ã£ã¦ã€è„†å¼±æ€§ç™ºè¦‹ã‚³ãƒ³ãƒ†ã‚¹ãƒˆã€Œcybozu.com Security Challengeã€ã‚’å®Ÿæ–½ã—ãŸã€‚ã€Œå¤–ã‹ã‚‰ã®çŸ¥è¦‹ã‚’å¾—ã¦ã€ã‚µãƒ¼ãƒ“ã‚¹ã®å“è³ªå‘ä¸Šã«ã¤ãªã’ãŸã„ã€ã¨ã„ã†ã®ãŒãã®å‹•æ©Ÿã ã€‚ ã€Œå¤–ã‹ã‚‰ã®çŸ¥è¦‹ã‚’å¾—ã¦ã€ã‚µãƒ¼ãƒ“ã‚¹ã®å“è³ªå‘ä¸Šã«ã¤ãªã’ã¦ã„ããŸã„â€•â€•ã€ï¼ˆã‚µã‚¤ãƒœã‚¦ã‚º ã‚°ãƒãƒ¼ãƒãƒ«é–‹ç™ºæœ¬éƒ¨ å“è³ªä¿è¨¼éƒ¨ ä¼Šè—¤å½°å—£æ°ï¼‰ã€‚ ã‚µã‚¤ãƒœã‚¦ã‚ºã¯2013å¹´11æœˆ11æ—¥ã‹ã‚‰åŒæœˆ25æ—¥ã«ã‹ã‘ã¦ã®2é€±é–“ã«æ¸¡ã£ã¦ã€è„†å¼±æ€§ç™ºè¦‹ã‚³ãƒ³ãƒ†ã‚¹ãƒˆã€Œcybozu.com Security Challengeã€ã‚’å®Ÿæ–½ã—ãŸã€‚å‚åŠ è€…ã¯ã€åŒç¤¾ã®PaaSã‚µãƒ¼ãƒ“ã‚¹ã€Œkintoneã€ã¨åŒç‰ã®æ¤œè¨¼ç”¨ç’°å¢ƒã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã€æœªçŸ¥ã®è„†å¼±æ€§ãŒãªã„ã‹ã©ã†ã‹ã‚’æ¤œæŸ»ã€‚è„†å¼±æ€§ã¨ã—ã¦èªå®šã•ã‚ŒãŸã‚‚ã®ã«ã¤ã„ã¦ã€ãã®æ·±åˆ»åº¦ãªã©ã«å¿œã˜ã¦ã‚µã‚¤ãƒœã‚¦ã‚ºãŒè³žé‡‘ã‚’æ”¯æ‰•ã†è©¦ã¿ã ã€‚è³žé‡‘é…åˆ†ã¯ã€CVSSï¼ˆCommon Vulnerab
ama-ch 2013/11/26
ã‚µã‚¤ãƒœã‚¦ã‚º

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
æœ‰åãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®CSRFå¯¾ç–æ–¹æ³•ã‚’èª¿ã¹ãŸã¾ã¨ã‚ - webãƒã‚¿
ZendFramework æµã‚Œ è¡¨ç¤ºæ™‚ : tokenç”Ÿæˆâ†’hiddenã‚»ãƒƒãƒˆ + ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã‚»ãƒƒãƒˆ é€ä¿¡æ™‚ : é€ã‚‰ã‚Œã¦ããŸtokenã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã‚ã‚‹ã‚‚ã®ã¨åŒã˜ã‹ã§ãƒã‚§ãƒƒã‚¯ tokenç”Ÿæˆæ–¹æ³• ãƒ©ãƒ³ãƒ€ãƒ å€¤ + salt + å›ºå®šå€¤ + ãƒ©ãƒ³ãƒ€ãƒ å€¤ md5( mt_rand(1,1000000) . $this->getSalt() . $this->getName() . mt_rand(1,1000000) ); ã¾ã¨ã‚ ãƒ©ãƒ³ãƒ€ãƒ å€¤ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã„ã‚Œã¦ã€é€ã‚‰ã‚Œã¦ããŸã‚‚ã®ã¨ãƒã‚§ãƒƒã‚¯ã€‚ Symfony æµã‚Œ è¡¨ç¤ºæ™‚ : tokenç”Ÿæˆâ†’hiddenã‚»ãƒƒãƒˆ é€ä¿¡æ™‚ : é€ã‚‰ã‚Œã¦ããŸtokenã‚’ã€å†åº¦ç”Ÿæˆã—ãŸtokenã¨æ¯”è¼ƒã—ã¦åŒã˜ã‹ãƒã‚§ãƒƒã‚¯ tokenç”Ÿæˆæ–¹æ³• salt + å›ºå®šå€¤ + ã‚»ãƒƒã‚·ãƒ§ãƒ³ID sha1($this->secret.$intention.$this->getSe
ama-ch 2012/06/08
security

csrf

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å¾³ä¸¸æœ¬ã«è¼‰ã£ã¦ã„ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
2. æœ¬æ—¥ãŠè©±ã—ã™ã‚‹å†…å®¹ â€¢ ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‹ã‚‰ã®æƒ…å ±æ¼æ´©ã«æ³¨æ„ â€¢ ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°å…¥é–€ â€¢ Ajaxã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€ â€¢ ãƒ‰ãƒªãƒ©ãƒ³ãƒ‰ ã‚«ãƒ¼ãƒ‰å¢—æ®–ç¥ã‚Šã¯ã“ã†ã—ã¦ãŠã“ã£ãŸâ€¦ã‹ã‚‚? Copyright Â© 2012 HASH Consulting Corp. 2 3. å¾³ä¸¸æµ©ã®è‡ªå·±ç´¹ä»‹ â€¢ çµŒæ´ â€“ 1985å¹´ äº¬ã‚»ãƒ©æ ªå¼ä¼šç¤¾å…¥ç¤¾ â€“ 1995å¹´ äº¬ã‚»ãƒ©ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚·ã‚¹ãƒ†ãƒ æ ªå¼ä¼šç¤¾(KCCS)ã«å‡ºå‘ãƒ»è»¢ç± â€“ 2008å¹´ KCCSé€€è·ã€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾è¨ç«‹ â€¢ çµŒé¨“ã—ãŸã“ã¨ â€“ äº¬ã‚»ãƒ©å…¥ç¤¾å½“æ™‚ã¯CADã€è¨ˆç®—å¹¾ä½•å¦ã€æ•°å€¤ã‚·ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãªã©ã‚’æ‹…å½“ â€“ ãã®å¾Œã€ä¼æ¥å‘ã‘ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚½ãƒ•ãƒˆã®ä¼ç”»ãƒ»é–‹ç™ºãƒ»äº‹æ¥åŒ–ã‚’æ‹…å½“ â€“ 1999å¹´ã‹ã‚‰ã€æºå¸¯é›»è©±å‘ã‘ã‚¤ãƒ³ãƒ•ãƒ©ã€ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã®ä¼ç”»ãƒ»é–‹ç™ºã‚’æ‹…å½“ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ç›´é¢ã€ç ”ç©¶ã€ç¤¾å†…å±•é–‹ã€å¯„ç¨¿ãªã© ã‚’é–‹å§‹ â€“
ama-ch 2012/04/25
security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
[ãƒ‡ãƒ–ã‚µãƒŸ2012]è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹
1. Finding Vulnerabilities For Fun And Profit è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹ Feb 16 2012 Yosuke HASEGAWA 2. è‡ªå·±ç´¹ä»‹ ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ ï¶ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ ªå¼ä¼šç¤¾ ç ”ç©¶é–‹ç™ºéƒ¨ ï¶æ ªå¼ä¼šç¤¾ã‚»ã‚ãƒ¥ã‚¢ã‚¹ã‚«ã‚¤ãƒ»ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ æŠ€è¡“é¡§å• ï¶Microsoft MVP for Consumer Security Oct 2005 - ï¶http://utf-8.jp/ ï¶é›£èªåŒ–JavaScriptæ›¸ã„ã¦ã¾ã™ Developers Summit 2012 NetAgent http://www.netagent.co.jp/ 4. è¨˜å·JavaScript JS without alnum $=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:+ +$,$_$$:
ama-ch 2012/02/20
presentation

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SlideShare

ãƒ‡ãƒ–ã‚µãƒŸ2012
ãƒªãƒ³ã‚¯
swfobject.js ãŒã‚¢ãƒ¬ãªè©± - ã»ã‚€ã‚‰ã¡ã‚ƒã»ã‚€ã»ã‚€
ã‚‚ã°ã„ã‚‹å…¨ç››æ„Ÿã®ã‚ã‚‹ä¸–é–“çš„ã«ã¯ä»Šæ›´ï¼ŒFLASH ãªã‚“ã¦ã©ã†ã§ã‚‚ã„ã„ã—ï¼Œswfobject.js è‡ªä½“ 2009å¹´ã‹ã‚‰æ›´æ–°ã•ã‚Œã¦ãªã„ã‹ã‚‰ï¼Œã“ã‚“ãªå¤ã„ã‚‚ã®ã‚’ã¨è¨€ã‚ã‚Œã‹ããªã„ã‚ˆã†ãªè©±ã§ã¯ã‚ã‚‹ã‚‚ã®ã®ï¼Œæ—¥æœ¬èªžã§ã®è¨€åŠã‚’ã‚ã¾ã‚Šè¦‹ã¦ãªã„ã—ï¼Œã¤ã„å…ˆæ—¥ã‚‚ã•ã‚‹é€šä¿¡ã‚ãƒ£ãƒªã‚¢ãŒãƒˆãƒƒãƒ—ãƒšãƒ¼ã‚¸ã§ã‚„ã‚‰ã‹ã—ã¦ã¦å¤šåˆ†çŸ¥ã‚‰ã‚Œã¦ãªã„ã‚“ã ã‚ã†ãªã¨æ€ã£ãŸã®ã§æ›¸ã“ã†ã¨æ€ã£ãŸæ¬¡ç¬¬ï¼Ž swfobject.js ã¨ã¯ä½•ã‹ ã“ã®è¨˜äº‹ã®å¯¾è±¡èªè€…ã«ã¨ã£ã¦ã¯èª¬æ˜Žã™ã‚‹ã¾ã§ã‚‚ãªã„è©±ã¨ã¯ãŠã‚‚ã†ã‘ã©ä¸€å¿œå‰ç½®ãã¨ã—ã¦èª¬æ˜Žã—ã¦ãŠãã¨ï¼Œswfobject.js ã¯ FLASH ã‚’ web ãƒšãƒ¼ã‚¸ã«åŸ‹ã‚è¾¼ã‚€ãŸã‚ã® JavaScript ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªï¼Žã‚¯ãƒã‚¹ãƒ–ãƒ©ã‚¦ã‚¶å¯¾å¿œã—ã¦ãŸã‚Šï¼Œé¢å€’ãª HTML-tag ã®ãŠä½œæ³•ã‚’è¦šãˆãªãã¦ã‚‚è‰¯ããªã£ãŸã‚Šã¨ã§ãƒ‡ãƒ•ã‚¡ã‚¯ãƒˆã‚¹ã‚¿ãƒ³ãƒ€ãƒ¼ãƒ‰ãªæ„Ÿã˜ã®ãƒ¢ãƒŽï¼Ž2007å¹´ã¨ã¡ã‚‡ã„å¤ã„ãŒãƒªã‚¯ãƒ«ãƒ¼ãƒˆMTL ã® SWFObject v2.0 ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆ
ama-ch 2012/01/12
flash

swfobject

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£Cookieã®æ´å²ã¨ç¾çŠ¶ Part1 å‰æçŸ¥è˜ã®å…±æœ‰ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼š
Webé–‹ç™ºè€…ã®ãŸã‚ã®ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£Cookieã‚„ã‚‰ãƒˆãƒ©ãƒƒã‚ãƒ³ã‚°ã‚„ã‚‰ã®å•é¡Œç‚¹ã«ã¤ã„ã¦ä¸‰å›žãã‚‰ã„ã«åˆ†ã‘ã¦æ›¸ãã¾ã™ã€‚ ã“ã®æ–‡ç« ã¯å€‹äººçš„ã«æ›¸ã„ã¦ã„ã¾ã™ã®ã§ã€ãŠã„ã€ãŠå‰ã®ã¨ã“ã‚ã®ã‚µãƒ¼ãƒ“ã‚¹ãŒã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£Cookieã«ä¾å˜ã—ã¦ã‚‹ã˜ã‚ƒããƒ¼ã‹ã¨ã„ã†ãƒ„ãƒƒã‚³ãƒŸãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œãªã„ãŒã€ãã†ã„ã†ã“ã¨ã‚’æ°—ã«ã—ã¦ã„ã‚‹ã¨ã„ã¤ã¾ã§çµŒã£ã¦ã‚‚å…¬é–‹ã§ããªã„ã¨ã„ã†å•é¡ŒãŒå‡ºã¦ã—ã¾ã†ã®ã§ã€ãã‚“ãªã“ã¨ã¯ãŠæ§‹ã„ãªã—ã«æ›¸ãã€‚ã¡ãªã¿ã«ä¾‹å¤–ãªãè‡ªç¤¾ã‚µãƒ¼ãƒ“ã‚¹ã«å¯¾ã—ã¦ã‚‚ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£Cookieã«ä¾å˜ã™ã‚‹ãªæ»ãã¨è¨€ã£ã¦ã„ã‚‹ã€‚ã“ã‚Œã¯Webãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼è¦³ç‚¹ã§ã€è‡ªåˆ†ãŒã‚µãƒ¼ãƒ“ã‚¹é–‹ç™ºã«é–¢ã‚ã‚‹ä¸Šã§çŸ¥ã£ã¦ãŠã‹ãã°ãªã‚‰ãªã„ã ã‚ã†çŸ¥è˜ã¨ã—ã¦åæ•°å¹´é–“ã ã‚‰ã ã‚‰ã¨Webã‚’è¦‹ã¦ã„ã¦è‡ªç„¶ã«çŸ¥ã£ã¦ã„ãŸã‚‚ã®ã¨ã€ã‚ã‚‹ã„ã¯èˆˆå‘³ã‚’æŒã£ã¦çŽ‡å…ˆã—ã¦èª¿ã¹ãŸã‚‚ã®ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã€‚ã‚°ã‚°ãƒƒã¦ç›´ãã«åˆ†ã‹ã‚‹ç¨‹åº¦ã®ç”¨èªžã®å®šç¾©çš„ãªã“ã¨ã¯æ›¸ã‹ãªã„ã€‚ã‚ãã¾ã§Webã‚µã‚¤ãƒˆåˆ¶ä½œè€…å´ã‹ã‚‰ã®è¦³ç‚¹ãªã®ã§ã€ãƒ–ãƒ©ã‚¦ã‚¶é–‹ç™ºé–¢ä¿‚
ama-ch 2011/11/28
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ–ãƒ©ã‚¦ã‚¶

cookie
ãƒªãƒ³ã‚¯
DOMãƒ™ãƒ¼ã‚¹XSSã®æ¤œå‡ºãƒ„ãƒ¼ãƒ«
(Last Updated On: )ä¹…ã—ã¶ã‚Šã«ãƒ–ãƒã‚°ã‚’æ›´æ–°ã™ã‚‹ã¨è‰²ã€…æ›¸ããŸããªã‚‹ã‚‚ã®ã§ã™ãã€‚ã¨ã„ã†ã“ã¨ã§ã¾ã ã“ã®ãƒ–ãƒã‚°ã§ã¯ç´¹ä»‹ã—ãŸã“ã¨ãŒãªã„DOMãƒ™ãƒ¼ã‚¹XSSã®ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ„ãƒ¼ãƒ«ã€DOMinatorã‚’ç´¹ä»‹ã—ã¾ã™ã€‚æœ€è¿‘ã®å•†ç”¨ãƒ„ãƒ¼ãƒ«ã‚‚é¡žä¼¼ã®æ©Ÿèƒ½ã‚’ã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã¾ã™ã€‚ http://code.google.com/p/dominator/ DOMãƒ™ãƒ¼ã‚¹XSSï¼š Javascriptã¯DOMã‚’åˆ©ç”¨ã—ã¦HTMLã‚’å‹•çš„ã«å¤‰æ›´ã§ãã¾ã™ã€‚ã“ã®æ©Ÿèƒ½ã‚’åˆ©ç”¨ã™ã‚‹ã¨ãƒ–ãƒ©ã‚¦ã‚¶å´ã®Javascriptã§å‹•çš„ã«å¤‰åŒ–ã™ã‚‹Webã‚µã‚¤ãƒˆã‚’æ§‹ç¯‰ã§ãã¾ã™ã€‚HTMLãªã©ã‚’ä¿®æ£ã™ã‚‹ã¨ãƒ‡ãƒ¼ã‚¿ã«ãƒ¦ãƒ¼ã‚¶ãŒå…¥åŠ›ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ãƒ—ãƒã‚°ãƒ©ãƒžãŒæ„å›³ã—ãªã„JavascriptãŒå®Ÿè¡Œã§ãã¾ã™ã€‚ è¦ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã®Javascriptã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã®äº‹ã§ã™ã€‚ Javascriptã¯éžå¸¸ã«æŸ”è»Ÿãªè¨€èªžã§ä¾¿åˆ©ãªåé¢ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ãŒéžå¸¸
ama-ch 2011/11/07
xss

javascript

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

DOM

tool
ãƒªãƒ³ã‚¯
PHPã®ã‚¤ã‚¿ã„å…¥é–€æ›¸ã‚’èªã‚“ã§Ajaxã®XSSã«ã¤ã„ã¦æ¤œè¨Žã—ãŸ(3)ï½žJSONç‰ã®æƒ³å®šå¤–èªã¿å‡ºã—ã«ã‚ˆã‚‹æ”»æ’ƒï½ž - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã®ç¶šãã§ã€Ajaxã«å›ºæœ‰ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦æ¤œè¨Žã—ã¾ã™ã€‚ä»Šå›žã¯JSONç‰ã®æƒ³å®šå¤–èªã¿å‡ºã—ã«ã‚ˆã‚‹æ”»æ’ƒã§ã™ã€‚ã“ã‚Œã‚‰æ”»æ’ƒæ‰‹æ³•ã¯æœ¬æ¥ãƒ–ãƒ©ã‚¦ã‚¶å´ã§å¯¾å¿œã™ã¹ãã‚‚ã®ã§ã€ã‚„ã‚€ã‚’å¾—ãšWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å´ã§å¯¾å¿œã™ã‚‹ä¸Šã§ã€ã¾ã å®šç•ªã¨ãªã‚‹å¯¾ç–ãŒãªã„ã‚ˆã†ã«æ€ãˆã¾ã™ã€‚ã“ã®ãŸã‚ã€è¤‡æ•°ã®å€™è£œã‚’ç¤ºã™ã‚‹ã“ã¨ã§è°è«–ã®ãã£ã‹ã‘ã«ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ã¾ãšã€ä½œã‚ŠãªãŒã‚‰åŸºç¤Žã‹ã‚‰å¦ã¶PHPã«ã‚ˆã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å…¥é–€XAMPP/jQuery/HTML5ã§ä½œã‚‹ã‚¤ãƒžãƒ‰ã‚ã®Weã‹ã‚‰ã€Ajaxã‚’åˆ©ç”¨ã—ãŸã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æ¦‚å¿µå›³ã‚’å¼•ç”¨ã—ã¾ã™ï¼ˆåŒæ›¸P20ã®å›³1-23ï¼‰ã€‚ å‰å›žã€å‰ã€…å›žã¯ã€(5)ã®HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ã®å‰å¾Œã§ã€JSONç‰ã®ãƒ‡ãƒ¼ã‚¿ä½œæˆï¼ˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ï¼‰ã«èµ·å› ã™ã‚‹evalã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚„ã€(5)ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’å—ã‘å–ã£ãŸå¾Œã®HTMLãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã®éš›ã®XSSã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã—ãŸã€‚ ã—ã‹ã—ã€å•é¡Œã¯ã“ã‚Œã ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚æ£å¸¸
ama-ch 2011/09/08
Ajax

xss

json

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1