[B! xss] atawiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

atawi id:atawi

xssã«é–¢ã™ã‚‹atawiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Twitterã¸ã®XSSæ”»æ’ƒ--ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ãŒç¤ºã™èª²é¡Œ
ãƒãƒƒã‚«ãƒ¼ãŸã¡ã¯ç±³å›½æ™‚é–“9æœˆ21æ—¥åˆå‰ã€Twitterã‚’ãƒ¯ãƒ¼ãƒ ã®æ¸©åºŠã«ä¸€å¤‰ã•ã›ã€æ™®é€šã¯Appleã®è£½å“ãƒãƒ¼ãƒ³ãƒã§ã‚‚ãªã‘ã‚Œã°ã‚ã‚Šå¾—ãªã„ã‚ˆã†ãªç†±ç‹‚çš„ãªãƒ‹ãƒ¥ãƒ¼ã‚¹å ±é“ã‚’å¼•ãèµ·ã“ã—ãŸã€‚æ€¥é€Ÿã«æ‹¡å¤§ã—ãŸä»Šå›žã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¾µå®³ã¯2ã¤ã®ã“ã¨ã‚’è¨¼æ˜Žã—ã¦ã„ã‚‹ã€‚1ã¤ã¯ã€Twitterã¯ä»Šã‚„é–“é•ã„ãªããƒ¡ã‚¤ãƒ³ã‚¹ãƒˆãƒªãƒ¼ãƒ ã®ã‚µãƒ¼ãƒ“ã‚¹ã ã¨ã„ã†ã“ã¨ã§ã‚ã‚Šã€ã‚‚ã†1ã¤ã¯ã€ãƒãƒƒã‚«ãƒ¼ã®æ¨™çš„ã¨ã„ã†ç‚¹ã§ã€åŒã‚µãƒ¼ãƒ“ã‚¹ãŒå¤§æ‰‹ãƒ†ã‚¯ãƒŽãƒã‚¸ä¼æ¥ã¨è‚©ã‚’ä¸¦ã¹ã‚‹ã‚ˆã†ã«ãªã£ãŸã¨ã„ã†ã“ã¨ã ã€‚ ç±³CNETãŒã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼ã—ãŸè¤‡æ•°ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ã«ã‚ˆã‚‹ã¨ã€Twitterã¯ã“ã‚Œã¾ã§éžå¸¸ã«ã†ã¾ãè‡ªã‚‰ã‚’é˜²å¾¡ã—ã¦ããŸãŒã€ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚¢ã‚°ãƒªã‚²ãƒ¼ã‚·ãƒ§ãƒ³ã‚„ã€ä¼æ¥ã‚µã‚¤ãƒˆä¸Šã§ã®çµ±åˆã¨ã„ã£ãŸç”¨é€”ã€ä¾¿åˆ©ãªå›½éš›çš„ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ„ãƒ¼ãƒ«ã¨ã—ã¦ä¿¡é ¼ã‚’å¾—ãŸã„ã®ã§ã‚ã‚Œã°ã€ä»Šå¾Œã¯ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«é–¢ã—ã¦ã•ã‚‰ã«æ…Žé‡ã«ãªã‚‹å¿…è¦ãŒã‚ã‚‹ã¨ã„ã†ã€‚ Sophosã®ã‚·ãƒ‹ã‚¢è„…å¨ç ”ç©¶è€…ã§ã‚ã‚‹Beth Jonesæ°ã¯ã€Œ
atawi 2010/09/27
twitter

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒ–ãƒã‚°
Twitterã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã«ãªã‚‹ã¨ã€Cookieã®ä½¿ç”¨ ã«åŒæ„ã—ãŸã‚‚ã®ã¨ã¿ãªã•ã‚Œã¾ã™ã€‚Cookieã¯ã‚¢ãƒŠãƒªãƒ†ã‚£ã‚¯ã‚¹ã€ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã€åºƒå‘Šãªã©ã«ä½¿ã‚ã‚Œã¾ã™ã€‚
atawi 2010/09/22
twitter

security

xss
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®é…æ…®
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç– ãƒ¦ãƒ¼ã‚¶å…¥åŠ›ãªã©å†…å®¹ãŒä¸å®šãªã‚‚ã®ãŒãã®ã¾ã¾HTMLã«å‡ºåŠ›ã•ã‚Œã‚‹ã¨ï¼Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆcross-site scriptingï¼ŒXSSï¼‰ã¨ã„ã†è„†å¼±æ€§ãŒèµ·ã“ã‚Šå¾—ã¾ã™ã€‚ ä¾‹ãˆã°ï¼Œç°¡å˜ãªãƒ•ã‚©ãƒ¼ãƒ ã‚’æ”¹æ‚ªã—ãŸç°¡å˜ãªãƒ•ã‚©ãƒ¼ãƒ ï¼ˆæ‚ªã„è¦‹æœ¬ï¼‰ ã§ã¯ï¼Œå…¥åŠ›ãƒã‚§ãƒƒã‚¯ãŒã—ã¦ãªã„ã®ã§ï¼Œãƒšãƒ¼ã‚¸ã®å†…å®¹ã‚’å¤§å¹…ã«æ›¸ãè¶³ã™ã“ã¨ãŒã§ãã¦ã—ã¾ã„ã¾ã™ã€‚ä¾‹ãˆã°æ¬¡ã®ãƒªãƒ³ã‚¯ã‚’è¸ã‚“ã§ã¿ã¦ãã ã•ã„ï¼š http://oku.edu.mie-u.ac.jp/~okumura/php/form-bad.php?onamae=%3Ciframe%20src=security.php%3E%3C/iframe%3E ã•ã‚‰ã«JavaScriptã¨ä½µç”¨ã™ã‚‹ãªã©ã—ã¦ï¼Œã‚¯ãƒƒã‚ãƒ¼ãªã©ã®æƒ…å ±ã‚’ç›—ã‚€ã“ã¨ãŒã§ãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã‚’é˜²ãã«ã¯ï¼ŒHTMLã¸ã®å‡ºåŠ›ã®ç›´å‰ã« htmlspecialchars() ã¨
atawi 2010/02/20
php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢
ã“ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã®èª¬æ˜Žãƒ»æ³¨æ„ãªã© PHP ã¯ã€Apache ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚„ã€CGIã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã¨ã—ã¦ä½¿ç”¨ã§ãã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã§ã™ã€‚ã“ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€ä¸»ã« PHP ã«ãŠã‘ã‚‹ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®å•é¡Œã«ã¤ã„ã¦ã‚ˆãå–ã‚ŠæŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‚‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦èª¿ã¹ãŸã“ã¨ã‚„ã€ã“ã‚Œã‚‰ä»¥å¤–ã§ã‚‚ã€PHP ã«é–¢é€£ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦çŸ¥ã£ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦ãƒ¡ãƒ¢ã—ã¦ãŠãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ã‚¹ãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«) ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã¾ãŸã€PHP ãƒžãƒ‹ãƒ¥ã‚¢ãƒ« : ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚„ã€PHP Security Guide (PHP Security Consortium) ã«ã¯ã€PH
atawi 2009/07/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

php

ã¾ã¨ã‚

xss
ãƒªãƒ³ã‚¯
SQLã¨XSSã¯æœ€å‡¶ãƒ„ãƒ¼ãƒˆãƒƒãƒ—ï¼Ÿ - æ¥µæ¥½ã›ãã‚…ã‚ãƒ–ãƒã‚°
ä¸–é–“ã®èªè˜ã¨è„…å¨ãƒ¬ãƒ™ãƒ«ã®ã‚®ãƒ£ãƒƒãƒ—â€•â€•XSSã¯æœ¬å½“ã«å±ãªã„ã‹ï¼Ÿï¼šå·å£æ´‹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ãƒ—ãƒ©ã‚¤ãƒ™ãƒ¼ãƒˆãƒ»ã‚¢ã‚¤ã‚ºï¼ˆ13ï¼‰ - ï¼ IT ã“ã‚Œè‰¯ã„è¨˜äº‹ã ãªã‚ã€‚æœ€è¿‘ãªã‚“ã‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®ã‚ãŠã‚Šã™ãŽãŒé¼»ã«ã¤ãæ°—ãŒã—ã¦ã„ãŸã‚“ã ã‚ˆãã€‚ã¾ã‚ãã®ç‰‡æ£’ã‚’æ€ã„ã£ãã‚Šæ‹…ã„ã§ã„ãŸã‚Šã‚‚ã—ãŸã®ã§ã€ä»Šæ›´ä½•ã‚’ã¨è¨€ã‚ã‚Œã¦ã—ã¾ã†ã ã‚ã†ã‘ã©ã€‚ ã“ã®è¨˜äº‹ã§ã¯ã€å®Ÿéš›ã«å³ã—ãŸãƒªã‚¹ã‚¯ã®åˆ†æžã‚’ã¡ã‚ƒã‚“ã¨ã—ã‚ˆã†ãœã€ã¨ã„ã†ã“ã¨ã‚’è¨€ã£ã¦ã„ã‚‹ã¨æ€ã†ã‚“ã ã‘ã©ã€ãã†ã„ã†ã¨ã“ã‚å¤§äº‹ã£ã™ã‚ˆãã€‚ ãŸã ã€ã‚ã£ã—ã®æ„è¦‹ã¯ã¡ã‚‡ã£ã¨é•ã†ã‹ãªã‚ã€‚ã‚ã£ã—ã¯ã€çµå±€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨XSSã£ã¦ã‚»ãƒƒãƒˆã§è€ƒãˆã‚‹ã¹ããªã‚“ã˜ã‚ƒãªã„ã®ã€ã¨æ€ã£ã¦ã„ãŸã‚Šã—ã¾ã™ã€‚ ãã‚‰ç´°ã‹ãè¦‹ã‚Œã°ã€å¯¾ç–ã™ã‚‹æ–¹æ³•ã‚„å¯¾ç–ãã®ã‚‚ã®ã‚‚ç•°ãªã‚Šã¾ã™ã—ã€ä¾‹ãˆã°ã€ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¯å¯¾ç–ã‚’è¡Œã£ã¦ã€ã‹ã¤XSSã®å¯¾ç–ã¯è¡Œã£ã¦ã„ãªã„ã€ã¨ã„ã†çŠ¶æ³ã«ãªã‚‹å¯èƒ½æ€§ã¯ã‚¼ãƒã§ã¯ãªã„ã§ã—ã‚‡ã†ã€‚ã—ã‹ã—ç¾å®Ÿçš„ã«ã¯ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
atawi 2009/03/19
xss

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ã‚·ãƒ³ã‚°ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆã‚‚ãã¡ã‚“ã¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ - ç´ äººãŒãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚’å‹‰å¼·ã—ã¦ã„ãŸãƒ–ãƒã‚°
è¿½è¨˜2ï¼š2007-10-11 - hoshikuzu | star_dust ã®æ›¸æ–Žã‚’è¦‹ã‚‹ã¨ã€ä¸‹ã«æ›¸ã„ã¦ã‚‹ã‚ˆã†ãªå¯¾ç–ã§ã¯ä¸ååˆ†ãªã‚ˆã†ã ã€‚ è¿½è¨˜ï¼šã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã¹ãæ–‡å—ã¯ã€Re: JavaScriptå†…ï¼ˆæ–‡å—åˆ—ï¼‰ã«ãƒ‡ãƒ¼ã‚¿ã‚’å‡ºåŠ›ã™ã‚‹å ´åˆã®é©åˆ‡ãªã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ‰‹é †ï½œfreeml byGMOãªã©ã‚’å‚è€ƒã«ã€‚ ã‚·ãƒ³ã‚°ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆ(')ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã›ãšXSSã®åŽŸå› ã«ãªã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã‚’ã‘ã£ã“ã†è¦‹ã‹ã‘ãŸã®ã§ã€ã©ã†ã„ã†æ™‚å•é¡Œã«ãªã‚‹ã®ã‹æ›¸ã„ã¦ãŠãã€‚ JavaScriptã®æ–‡å—åˆ—ã‚’å‹•çš„ã«åŸ‹ã‚è¾¼ã‚€å ´åˆã€‚ <script> var q = 'hoge"fuga'; document.getElementById('word').appendChild(document.createTextNode(q + 'ã®æ¤œç´¢çµæžœ')); </script> ã®ã‚ˆã†ã«ã€å¤‰æ•°ã«ä»£å…¥ã™ã‚‹æ–‡å—åˆ—ã‚’å‹•çš„ã«ä½œã£ã¦ã„ã‚‹å ´åˆã€Rubyã®CG
atawi 2008/11/14
javascript

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
CSSXSSã‚’æ”¹è‰¯ã—ãŸï¼Ÿæ‰‹æ³•ã§mixiã®post_keyã‚’æŠœãå–ã‚‹ãƒ‡ãƒ¢ã‚’ä½œã‚Šã¾ã—ãŸ - ?D of K:
IDã‚’æŠœãå–ã‚‹æ–¹æ³•ãŒæ€ã„ã¤ã‹ãªã‹ã£ãŸã®ã§ã€ã€Œã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ã®æ›¸ãè¾¼ã¿ã®äºŒå¹´æ¥ã®å†æ¥ã¨ã¯ã„ãã¾ã›ã‚“ãŒã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ãƒ›ãƒ¼ãƒ«ã ã¨æ€ã†ã®ã§ã€æ—©ã‚ã«æ›¸ã„ã¦ãŠãã¾ã™ã€‚ï¼ˆä¿®æ£æ¸ˆã¿ã§ã™ï¼‰ å®Ÿè¨¼ã‚³ãƒ¼ãƒ‰ http://k75.s321.xrea.com/cssxss/mixi.html ãƒ‘ãƒƒãƒæ¸ˆã¿ã®IE6ã§mixiã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ãŸå ´åˆã€post_keyã®å–å¾—ã‚’ç¢ºèªã§ãã‚‹ã¨æ€ã„ã¾ã™ã€‚å‹˜é•ã„ã ã£ãŸã‚‰ã™ã¿ã¾ã›ã‚“ã€‚ãã®éš›ã€åƒ•ã®mixiã®ã‚ã—ã‚ã¨ã«æ®‹ã‚‹ã®ã§ãã®ç‚¹ã®ã¿æ³¨æ„ã—ã¦ãã ã•ã„ã€‚ æ‰‹æ³• CSSã®èªã¿è¾¼ã¿ ã„ã‚ã‚†ã‚‹CSSXSSã¨åŒã˜ã‚ˆã†ã«linkã‚’ä½¿ã£ã¦ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿è¾¼ã¿ã¾ã™ã€‚æ—§æ¥ã®æ‰‹æ³•ã§ã¯ä¸æ‹¬å¼§ãŒã‚ã‚‹ã“ã¨ã§CSSã¨èª¤èªè˜ã•ã›ã€css Textã§å–å¾—ã—ã¾ã—ãŸãŒã€ä»Šå›žã¯æ–‡ä¸ã«ã€Œ}selector{property:ã€ã¨ã„ã†æ–‡å—åˆ—ã‚’åŸ‹ã‚è¾¼ã‚“ã§ã€selectorã«è©²å½“ã™ã‚‹è¦ç´ ã®currentStyle.property
atawi 2008/11/12
mixi

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

css
ãƒªãƒ³ã‚¯
XSSã¯ãã®ã‚µã‚¤ãƒˆã‚’ä¿¡é ¼ã—ã¦ã„ã‚‹äººãŒå¤šã„ã»ã©è„…å¨ã«ãªã‚Šã†ã‚‹ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼(Hatena)
ã¯ã„ï¼ ã“ã‚“ã«ã¡ã¯ï¼ ä»Šæ—¥ã¯çã—ãã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ä¸€è¨€ã§ã™ï¼ ã‚¿ã‚¤ãƒˆãƒ«ã«ã‚ã‚‹é€šã‚Šã€ XSSã¯ãã®ã‚µã‚¤ãƒˆã‚’ä¿¡é ¼ã—ã¦ã„ã‚‹äººãŒå¤šã„ã»ã©è„…å¨ã«ãªã‚Šã†ã‚‹ ã£ã¦ã“ã¨ãªã‚“ã ã‘ã©â€¦ã€‚ã“ã‚Œã ã‘ã ã¨ã€ã‚ãŸã‚Šã¾ãˆã£ã½ã„ã‚ˆãã€‚ ã¾ãšXSSè„†å¼±æ€§ã£ã¦ãªã«ï¼Ÿ ã£ã¦äººã®ãŸã‚ã«ç°¡å˜ã«èª¬æ˜Žã—ã¡ã‚ƒã†ã¨ã€ã“ã‚Œ ã‚µã‚¤ãƒˆã‚’ä½œã£ãŸäººä»¥å¤–ã®äººã§ã‚‚ã€å¥½ããªã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã§ãã¡ã‚ƒã†çŠ¶æ…‹ ã£ã¦ã“ã¨ãªã‚“ã ã‚ˆãã€‚ ã§ã‚‚ã‚ˆãè€ƒãˆã¦ã¿ã¦ã»ã—ã„ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã§ãã‚‹ã€‚ã¸ã‚“ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¡ã‚ƒã†ã‹ã‚‚ã—ã‚Œãªã„ãƒšãƒ¼ã‚¸ã€‚ ã“ã‚Œã£ã¦åˆ¥ã«ã€ã€Œãµã¤ã†ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨±å¯ã•ã‚Œã¦ã„ã‚‹ã€ãã“ã‚‰ã¸ã‚“ã®ãƒ–ãƒã‚°ã‚„ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã¨åŒã˜ã€ã˜ã‚ƒãªã„ï¼Ÿ ã„ã‚„ã€å¾®å¦™ã«é•ã†ã‹ãªã€‚ é•ã†ç‚¹ã¯ã²ã¨ã¤ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚ã‚‹ã®ãŒã€Œã‚µã‚¤ãƒˆã®ç®¡ç†è€…ã‚ªãƒ³ãƒªãƒ¼ã€ãªã®ã‹ã€Œèª°ã§ã‚‚ã€ãªã®ã‹ã®é•ã„ãŒã‚ã‚‹ã‚“ã ã‚ˆãã€‚ â€¦ ã˜ã‚ƒã‚ã€ã€Œåã‚‚ãªãã‚µã‚¤ãƒˆã®ç®¡ç†è€…ã€ã¨ã€Œèª°ã§ã‚‚ã€ã®é•ã„ã£ã¦ãªã‚“ã ã‚ã†ï¼Ÿ ãªã‚“ã ã‚
atawi 2008/10/03
xss

ã¯ã¾ã¡ã¡ã‚ƒã‚“

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å€‹äººã ã‹ã‚‰ç”˜ã„ã®ã‹ãª - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã‚ã‚‰ã‚ã‚‰äºˆå‘ŠinãŒXSSã‚„ã‚‰ã‚Œã¡ã‚ƒã£ãŸã‚‰ã—ã„ã§ã™ãï¼ ä½¿ã„å¤ã•ã‚ŒãŸæ‰‹æ³•ï¼Ÿ ã„ã¾ã©ãã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‰ã—ã¦ãªãã¦ãƒ€ã‚µã„ï¼Ÿ é–¢é€£ã®è¨˜äº‹ã«å¯¾ã—ã¦ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã§ã‚‚è‰²ã€…è¨€ã‚ã‚Œã¦ã„ãŸã‚Šã€ http://b.hatena.ne.jp/t/%E4%BA%88%E5%91%8A.in?threshold=1 ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚µã‚¤ãƒˆã§ã‚‚ã€ã“ã‚“ãªç…½ã‚Šè¨˜äº‹ã‚’æ›¸ã‹ã‚Œã¦ã„ãŸã‚Šã™ã‚‹ã‘ã‚Œã©â€¦ ä»Šå›žã®ä»¶ã«ã¤ã„ã¦ITä¼æ¥ã«å‹¤ã‚ã‚‹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã«èžã„ã¦ã¿ã‚‹ã¨ã€ ã€Œã“ã‚Œã¯åˆæ©ä¸ã®åˆæ©ã€‚XSSã‚³ãƒ¼ãƒ‰æ›¸ã„ãŸæ–¹ã‚‚10åˆ†ã‚‚æŽ›ã‹ã£ã¦ãªã„ã‚ˆã€‚ãã‚Œã‚’äº‹å‰ã«å¯¾ç–ã—ã¦ãªã‹ã£ãŸäºˆå‘Šinã«ã¯ã‚‚ã£ã¨ãƒ“ãƒƒã‚¯ãƒªã ã‘ã©ã€ã€ã€ç´ äººãªã®ï¼Ÿã€ ã¨èªžã‚‹ã€‚ äºˆå‘Šinã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’ç‹™ã£ãŸã‚³ãƒ¼ãƒ‰!?ã€€ã€Œäºˆå‘Šiné–‹ç™ºè€…ã¯ç´ äººã€ http://news.livedoor.com/article/detail/3759632/ ãã‚Œã£ã¦ã©ã†ã ã‚ã†ãã€‚ Googleã‚„Amazo
atawi 2008/08/05
ã¯ã¾ã¡ã¡ã‚ƒã‚“

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
ã‚¯ã‚¤ã‚º:XSSã¨CSRFã¯ã©ã“ã«ã‚ã‚Šã¾ã™ã‹? - ockeghem's blog
å…ˆã®æ—¥è¨˜(XSSã¯ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ãã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ã - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜)ã¯ã€ä»•è¾¼ã‚“ã ãƒã‚¿ãŒã‚ãŸã£ã¦å¤šãã®æ–¹ã«èªã‚“ã§ã„ãŸã ã„ãŸã€‚ç´°ã‹ã„å†…å®¹ã«ã¤ã„ã¦ã¯ã€é ‚æˆ´ã—ãŸæ‰¹åˆ¤ã‚„åçœã‚‚ã‚ã‚‹ãŒã€ã“ã®ãƒ†ãƒ¼ãƒžã«å¯¾ã—ã¦å¤šãã®é–¢å¿ƒã‚’é›†ã‚ã‚‹ã“ã¨ãŒã§ããŸã®ã¯è‰¯ã‹ã£ãŸã¨æ€ã†ã€‚ä»Šå›žã‚‚ã€æ‰‹ã‚’å¤‰ãˆå“ã‚’å¤‰ãˆã¦ã€XSSã¨CSRFã®é•ã„ã‚’èª¬æ˜Žã—ã‚ˆã†ã€‚ã¨ã„ã†ã“ã¨ã§ã€ä»Šå›žã¯ã‚¯ã‚¤ã‚ºä»•ç«‹ã¦ã«ã—ã¦ã¿ãŸã€‚ ã¨ã„ã£ã¦ã‚‚ã€éžå¸¸ã«ç°¡å˜ãªã‚¯ã‚¤ã‚ºã ã€‚ èªè¨¼ã‚’å¿…è¦ã¨ã™ã‚‹ä¼šå“¡åˆ¶ã‚µã‚¤ãƒˆmaitter.comã§ã€å€‹äººæƒ…å ±ã‚’å…¥åŠ›ã™ã‚‹ç”»é¢ãŒã‚ã‚‹ã€‚å…¸åž‹çš„ãªã€å…¥åŠ›(A)-ç¢ºèª(B)-ç™»éŒ²(C)ã¨ã„ã†ç”»é¢é·ç§»ï¼ˆä¸‹å›³ï¼‰ã‚’æƒ³å®šã—ãŸå ´åˆã€ XSSãŒç™ºç”Ÿã—ã‚„ã™ã„ç”»é¢ã‚’ä¸€ã¤ã‚ã’ã‚ˆ CSRFãŒç™ºç”Ÿã—ã‚„ã™ã„ç”»é¢ã‚’ä¸€ã¤ã‚ã’ã‚ˆ ã¨ã„ã†ã‚‚ã®ã (å…¥åŠ›ç”»é¢ã¯åˆæœŸå…¥åŠ›ã®ã¿æƒ³å®š)ã€‚ã‚¨ãƒ©ãƒ¼æ™‚ã®æŒ™å‹•ãªã©ã¯æŒ‡å®šã•ã‚Œã¦ã„ãªã„ã®ã§æƒ³å®šã—ãªã„ã‚‚ã®ã¨ã™ã‚‹ã€‚ è§£
atawi 2007/12/05
xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
atawi 2007/12/03
xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1