[B! UTF-7] mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mi1kman id:mi1kman

UTF-7ã«é–¢ã™ã‚‹mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ç¬¬2å›žã€€UTF-7ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒï¼»å¾Œç·¨ï¼½ | gihyo.jp
å‰å›žã«å¼•ãç¶šãã€UTF-7ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã«ã¤ã„ã¦èª¬æ˜Žã—ã¦ã„ãã¾ã™ã€‚ UTF-7ã«ã‚ˆã‚‹XSSã¯ã€æ”»æ’ƒå¯¾è±¡ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒä¸æ˜Žçžãªå ´åˆã«ã€ãã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’è¢«å®³è€…ã®ãƒ–ãƒ©ã‚¦ã‚¶ï¼ˆInternet Explorerï¼‰ã§é–‹ã„ãŸã¨ãã«ã€ãã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒUTF-7ã§ã‚ã‚‹ã¨IEã«èª¤èªã•ã›ã€ã€Œâ +ADw-script+AD4-ã€ã®ã‚ˆã†ãªUTF-7ã®æ–‡å—åˆ—ãŒæœ‰åŠ¹ãªHTMLè¦ç´ ã¨ã—ã¦èªè˜ã•ã‚Œã‚‹ãŸã‚ã«ç™ºç”Ÿã—ã¾ã™ã€‚ ãã—ã¦ã€ã€Œâ æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒä¸æ˜Žçžã€ãªå…·ä½“çš„ãªçŠ¶æ³ã¨ã—ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ãªæ¡ä»¶ã®ã„ãšã‚Œã‹ã«è©²å½“ã™ã‚‹ã¨ã„ã†ã“ã¨ã‚’å‰å›žèª¬æ˜Žã—ã¾ã—ãŸã€‚ ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã€metaè¦ç´ ã®ã©ã¡ã‚‰ã§ã‚‚charsetãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„ charsetã«IEãŒè§£é‡ˆã§ããªã„ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åãŒæŒ‡å®šã•ã‚Œã¦ã„ã‚‹ metaè¦ç´ ã§charsetã‚’æŒ‡å®šã—ã¦ã„ã‚‹ã¨ãã«ã€metaè¦
mi1kman 2009/04/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ–‡å—ã‚³ãƒ¼ãƒ‰

UTF-7

Unicode

ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘

è„†å¼±æ€§

XSS
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± - UTF-8ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFã®æ¤œçŸ¥å›žé¿æŠ€è¡“
UTF-8ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFã®æ¤œçŸ¥å›žé¿æŠ€è¡“ HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ å…¬é–‹æ—¥:2009å¹´3æœˆ23æ—¥ æ¦‚è¦ æœ¬ãƒ¬ãƒãƒ¼ãƒˆã§ã¯ã€ASP.NET(1.1)ã‚’UTF-8æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«ã¦åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã«ãŠã„ã¦ã€ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ©ç”¨ã—ãŸIDS/IPS/WAFå›žé¿ã®å¯èƒ½æ€§ã«ã¤ã„ã¦å ±å‘Šã™ã‚‹ã€‚ èƒŒæ™¯ æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ãŒ2008å¹´10æœˆã«ã€Œã€CSLã€‘CSLç·Šæ€¥æ³¨æ„å–šèµ·ãƒ¬ãƒãƒ¼ãƒˆï½žæ–°æ‰‹ã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’è¡Œä½¿ã™ã‚‹ãƒœãƒƒãƒˆã®ç¢ºèªï½žã€ã¨é¡Œã™ã‚‹ãƒ›ãƒ¯ã‚¤ãƒˆãƒšãƒ¼ãƒ‘ãƒ¼ã‚’ç™ºè¡¨ã—ãŸã€‚ã„ãã¤ã‹ã®æ–°ç¨®ã®æ”»æ’ƒæ‰‹æ³•ãŒèª¬æ˜Žã•ã‚Œã¦ã„ã‚‹ä¸ã§ã€ä¸æ£ãªãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãŸæ¤œçŸ¥å›žé¿ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã«ã¤ã„ã¦è¨€åŠã—ã¦ã„ã‚‹ã€‚å…·ä½“çš„ã«ã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãªæ–¹æ³•ã ã€‚ Active Server Pages(ASP)ã§ã¯ã€ã€ŒDEC%LAREã€ã®ã‚ˆã†ã«ãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆè¨˜å·ã«ç¶šã2æ–‡å—ãŒ16é€²æ•°ã§ãªã„å ´åˆã€ãƒ‘ãƒ¼ã‚»ãƒ³ãƒˆè¨˜å·ã‚’
mi1kman 2009/03/24
ã‚ã‚Œã‚¿ã‚¤ãƒˆãƒ«ç›´ã£ã¦ã‚‹

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

UTF-7

ASP.NET

IDS

IPS

WAF

è„†å¼±æ€§

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
ãƒªãƒ³ã‚¯
ç¬¬1å›žã€€UTF-7ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒï¼»å‰ç·¨ï¼½ | gihyo.jp
ã¿ãªã•ã‚“ã€ã¯ã˜ã‚ã¾ã—ã¦ã€‚ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã¨ç”³ã—ã¾ã™ã€‚ æœ€è¿‘ã€æ–‡å—ã‚³ãƒ¼ãƒ‰ã¨é–¢é€£ã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è©±é¡Œã‚’ç›®ã«ã™ã‚‹ã“ã¨ãŒå¢—ãˆã¦ãã¾ã—ãŸã€‚æ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã¯æŠ€è¡“çš„ã«æœªé–‹æ‹“ã¨ã„ã†ã“ã¨ã‚‚ã‚ã‚Šã€å‚è€ƒã¨ãªã‚‹æƒ…å ±ãŒãªã‹ãªã‹è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã€‚ã“ã®é€£è¼‰ã§ã¯ã€æ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒã‚„ãã‚Œã«å¯¾ã™ã‚‹å¯¾ç–ã«ã¤ã„ã¦æ£ã—ã„çŸ¥è˜ã‚’è§£èª¬ã—ã¦ã„ãã¾ã™ã€‚ æ–‡å—ã‚³ãƒ¼ãƒ‰ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒé–¢é€£ã™ã‚‹ã‚‚ã£ã¨ã‚‚å¤§ããªç‚¹ã¯ã€ã‚„ã¯ã‚Šæ–‡å—åˆ—ã®æ¯”è¼ƒã§ã—ã‚‡ã†ã€‚ã€Œâ å±é™ºãªæ–‡å—åˆ—ã®æ¤œå‡ºã€ã€Œâ å®‰å…¨ãªæ–‡å—åˆ—ã§ã‚ã‚‹ã“ã¨ã®ç¢ºèªã€ã¨ã„ã£ãŸæ–‡å—åˆ—ã®æ¯”è¼ƒã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’è€ƒãˆã‚‹ã†ãˆã§é¿ã‘ã¦é€šã‚Œãªã„å‡¦ç†ã ã¨æ€ã„ã¾ã™ã€‚ æ–‡å—åˆ—ã®æ¯”è¼ƒã«ãŠã„ã¦ã¯ã€å˜ç´”ã«ãƒã‚¤ãƒˆåˆ—ã‚’æ¯”è¼ƒã™ã‚‹ã ã‘ã§ã¯ä¸ååˆ†ã§ã€æ–‡å—åˆ—ãŒãƒ¡ãƒ¢ãƒªä¸Šã§ã©ã®ã‚ˆã†ãªãƒã‚¤ãƒˆåˆ—ã¨ã—ã¦æ ¼ç´ã•ã‚Œã¦ã„ã‚‹ã®ã‹ï¼ˆã“ã®ãƒ«ãƒ¼ãƒ«ã‚’ç¬¦å·åŒ–æ–¹å¼ã‚ã‚‹ã„ã¯æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã¨è¨€ã„ã¾ã™ï¼‰ã«æ³¨æ„ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„ã“ã¨ã‚‚ã‚ã‚‹ã§ã—ã‚‡ã†ã€‚æ”»æ’ƒè€…ã¯å·§ã¿ã«æ–‡å—
mi1kman 2009/03/23
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

UTF-7

XSS

æ–‡å—ã‚³ãƒ¼ãƒ‰

ã‚ã¨ã§èªã‚€

ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘
ãƒªãƒ³ã‚¯
Namazu: ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹è€ƒå¯Ÿ
åŸºæœ¬æ–¹é‡ æœ€æ–°ç‰ˆã¯ãŠãã‚‰ãå®‰å…¨ã ã¨ã¯æ€ã„ã¾ã™ãŒã€ç¢ºå®Ÿã¨ã¯è¨€ãˆã¾ã›ã‚“ã€‚ Namazu ã¯å®Œå…¨ã«ç„¡ä¿è¨¼ã§ã™ã€‚ã™ã¹ã¦ã‚ãªãŸã®è²¬ä»»ã®ã‚‚ã¨ã«é‹ç”¨ã— ã¦ãã ã•ã„ã€‚ãŸã ã—ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å•é¡Œã«ã¯ã§ãã‚‹é™ã‚Šå¯¾å¿œã™ã‚‹ ã¤ã‚‚ã‚Šã§ã™ã€‚ã¾ãšã„ç‚¹ã‚’è¦‹ã¤ã‘ãŸã‚‰é€£çµ¡ã—ã¦ãã ã•ã„ã€‚ æ—¢çŸ¥ã®å•é¡Œ 2.0.20 ã¾ãŸã¯ 2.0.20 ã‚ˆã‚Šå¤ã„ãƒ´ã‚¡ãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¯ã€ IE6,7ã®è„†å¼±æ€§å¯¾ç–ãŒã§ãã¦ã„ã¾ã›ã‚“ã€‚ ã“ã®ãŸã‚ Namazu 2.0.21 ä»¥é™ã‚’åˆ©ç”¨ã™ã‚‹ã“ã¨ã‚’æŽ¨å¥¨ã—ã¾ã™ã€‚ 2.0.19 ã¾ãŸã¯ 2.0.19 ã‚ˆã‚Šå¤ã„ãƒ´ã‚¡ãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¯ã€ ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ©ãƒ³ã®è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ 2.0.17 ã¾ãŸã¯ 2.0.17 ã‚ˆã‚Šå¤ã„ãƒ´ã‚¡ãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¯ã€ Web ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰è‡ªå‹•èªè˜ã®èª¤èªã«ã‚ˆã‚‹ UTF-7 ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã•ã‚ŒãŸæ¤œç´¢å¼ã®è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ 2.0.15 ã¾ãŸã¯ 2.0.15 ã‚ˆã‚Šå¤ã„ãƒ´ã‚¡ãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¯ã€ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆ
mi1kman 2008/03/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Namazu

UTF-7

XSS
ãƒªãƒ³ã‚¯
2008-01-18 - hoshikuzu | star_dust dairy - about UTF-7 XSS Cheat Sheet
ãŠãã‚Œã°ã›ãªãŒã‚‰ä¸‹è¨˜ã‚’æ‹è¦‹ã—ã¾ã—ãŸã€‚ UTF-7 XSS Cheat Sheet Specify charset clearly (HTTP header is recommended) Don't place the text attacker can control before <meta> Specify recognizable charset name by browser. ä¸Šè¨˜ã®ã‚ˆã†ãªå¯¾ç–ã‚’å¿…è¦ã¨ã™ã‚‹ã‚µã‚¤ãƒˆã§ã¯æ”¾ç½®ã—ã¦ãŠã‘ã°UTF-7ç³»ã®XSSä»¥å¤–ã§ã‚‚XSSã®å±é™ºæ€§ã¯å˜åœ¨ã—ã†ã‚‹ã¨æ€ã‚ã‚Œã¾ã™ã€‚ã§ã™ã®ã§â€¦ ã‚ã¨ã€ãƒ¤ãƒžã‚¬ã‚¿ã•ã‚“ã®åå¿œã‚’èªã¿ãªãŒã‚‰æ€ã£ãŸã‚“ã§ã™ãŒã€ä¸€èˆ¬çš„ãªXSSå¯¾ç–ã§ã€Œ<ã€ã€Œ>ã€ãªã©ã‚’ã€Œ<ã€ã€Œ>ã€ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã‚ˆã†ã«ã€æ©Ÿæ¢°çš„ã«ã€Œ+ã€ã‚’ã€Œ+ã€ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¦ã‚„ã‚Œã°ã€ä¸‡ãŒä¸€ã®ã¨ãã§ã‚‚UTF-7ã«ã‚ˆã‚‹XSSã‚’é˜²ã’ã‚‹ã‚ˆã†ãªæ°—ã‚‚ã—ãŸã‚“ã§ã™ã‘ã©ã€ã‚ã¾ã‚Šæ·±ã
mi1kman 2008/01/19
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

XSS

UTF-7

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
UTF-7 XSS Cheat Sheet
Countermeasures against XSS with UTF-7 are: Specify charset clearly (HTTP header is recommended) Don't place the text attacker can control before <meta> Specify recognizable charset name by browser. For more information about UTF-7 trick, see "Cross-site scripthing with UTF-7". These XSS patterns are tested on IE6 and IE7. Yosuke HASEGAWA <[email protected]> Last modified: 2008-01
mi1kman 2008/01/11
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

UTF-7

XSS

å‚è€ƒã«ãªã‚‹

CheatSheet
ãƒªãƒ³ã‚¯
a threadless kite - ç³¸ã®åˆ‡ã‚ŒãŸå‡§
ã“ã“ã¯ã€ç®¡ç†äººyamagataãŒæ–¹é‡æœªå®šã®ã¾ã¾ã€ä½•ã¨ãªãƒ¼ãæ€ã„ã¤ã„ãŸã“ã¨ã‚’æ€ã„ã¤ã„ãŸã¾ã¾ã«ã ã‚‰ã ã‚‰ã¨æ›¸ãä»˜ã‘ã‚‹æ—¥è¨˜å¸³ã§ã™ã€‚ãµã‚“ã‚ã‚Šã»ã‚“ã‚ã‹ãªæ„Ÿã˜ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚
mi1kman 2008/01/11
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

XSS

æ–‡å—ã‚³ãƒ¼ãƒ‰

UTF-7

å‚è€ƒã«ãªã‚‹
ãƒªãƒ³ã‚¯
Atom ã‚„ RDF ã‚’åˆ©ç”¨ã—ãŸXSS - è‘‰ã£ã±æ—¥è¨˜
Internet Explorer ã®æ‚ªåé«˜ã„ Content-Type: ç„¡è¦–ã¨ã„ã†ä»•æ§˜ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€Atom ã‚„ RDF/RSS ã‚’åˆ©ç”¨ã—ã¦XSSã‚’ç™ºç”Ÿã§ãã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚æ¡ä»¶çš„ã«å¯¾è±¡ã¨ãªã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯å¤šãã¯ãªã„ã¨æ€ã„ã¾ã™ãŒã€ãã‚Œã§ã‚‚ã„ãã¤ã‹è©²å½“ã™ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒå®Ÿåœ¨ã™ã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã—ãŸã€‚ä»¥ä¸‹ã®ä¾‹ã§ã¯ Atom ã®å ´åˆã«ã¤ã„ã¦æ›¸ã„ã¦ã„ã¾ã™ãŒ RDF/RSS ã§ã‚‚åŒæ§˜ã§ã™ã€‚ ä¾‹ãˆã°ã€http://example.com/search.cgi?output=atom&q=abcd ã¨ã„ã† URL ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€ã€Œabcdã€ã¨ã„ã†æ–‡å—åˆ—ã®æ¤œç´¢çµæžœã‚’ Atom ã¨ã—ã¦è¿”ã™CGIãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ GET /search.cgi?output=atom&q=abcd Host: example.com HTTP/1.1 200 OK Content-Type: ap
mi1kman 2007/08/01
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

XSS

UTF-7

IE

å‚è€ƒã«ãªã‚‹
ãƒªãƒ³ã‚¯
è‘‰ã£ã±æ—¥è¨˜ - ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã® HKCRï¿¥MIMEï¿¥Databaseï¿¥charset ä»¥ä¸‹ã«å®šç¾©ã•ã‚Œã¦ã„ã¾ã™ã€‚
UTF-7ã‚’åˆ©ç”¨ã—ãŸXSSã¯ã€charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã«ç™ºç”Ÿã™ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€å°‘ãªãã¨ã‚‚ Internet Explorer ã«ãŠã„ã¦ã¯ã€ã“ã‚Œã¯å¤§ããªé–“é•ã„ã§ã™ã€‚æ£ã—ãã¯ã€Internet Explorer ãŒèªè˜ã§ãã‚‹ charset ãŒæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã§ã‚ã‚Šã€charsetãŒä»˜åŠ ã•ã‚Œã¦ã„ã¦ã‚‚ã€IEãŒèªè˜ã§ããªã„æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã§ã‚ã‚‹å ´åˆã«ã¯XSSãŒç™ºç”Ÿã—ã¾ã™ã€‚ ä¾‹ãˆã°ã€æ¬¡ã®ã‚ˆã†ãª HTML ã¯(HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§ charset ãŒæ˜Žç¤ºã•ã‚Œã¦ã„ãªã„å ´åˆ)IEãŒæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã‚’æ£ã—ãèªè˜ã§ããªã„ãŸã‚ã€ãã®å†…å®¹ã‹ã‚‰UTF-7ã¨è§£é‡ˆã•ã‚Œã‚‹ãŸã‚ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ä½œã—ã¾ã™ã€‚"utf8"ã¨ã„ã†è¡¨è¨˜ã¯UTF-8ã®æ…£ç”¨çš„ãªè¡¨ç¾ã§ã¯ã‚ã‚Šã¾ã™ãŒã€ãƒã‚¤ãƒ•ãƒ³ãŒæŠœã‘ã¦ãŠã‚Šæ£ã—ã„è¡¨è¨˜ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ <html> <head> <meta http-equiv="Co
mi1kman 2007/07/17
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

XSS

UTF-7

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
1