[B! è„†å¼±æ€§] norinicoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

norinico id:norinico

è„†å¼±æ€§ã«é–¢ã™ã‚‹norinicoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
norinico 2012/10/22
è„†å¼±æ€§

xss

csrf
ãƒªãƒ³ã‚¯
https://www.jpcert.or.jp/at/2011/at110009.txt
norinico 2011/04/18
Adobe

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Windowsã«æ–°ãŸãªè„†å¼±æ€§â€•â€•ä¸æ£ãªã‚µãƒ ãƒã‚¤ãƒ«ã§æ‚ªç”¨ã®æã‚Œ
Windowsã®ã‚°ãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚¹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã‚¨ãƒ³ã‚¸ãƒ³ã«æœªä¿®æ£ã®è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã€‚Windows Vistaã‚„XPãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã€‚ ç±³Microsoftã¯1æœˆ4æ—¥ã€Windowsã«æ–°ãŸãªè„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã¨ã—ã¦ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªãƒ¼ã‚’å…¬é–‹ã—ãŸã€‚å•é¡Œã‚’ä¿®æ£ã™ã‚‹ãŸã‚ã®æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ã¾ã ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ãªã„ã€‚ åŒç¤¾ã«ã‚ˆã‚‹ã¨ã€è„†å¼±æ€§ã¯Windowsã®ã‚°ãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚¹ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã‚¨ãƒ³ã‚¸ãƒ³ã«å˜åœ¨ã™ã‚‹ã€‚OSã¯Windows Vistaï¼Server 2003ï¼Windows XPãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã€‚ä¸€æ–¹ã€Windows 7ã¨Windows Server 2008 R2ã¯å½±éŸ¿ã‚’å—ã‘ãªã„ã¨ã„ã†ã€‚ æ”»æ’ƒæ–¹æ³•ã¨ã—ã¦ã¯ã€ç´°å·¥ã‚’æ–½ã—ãŸã‚µãƒ ãƒã‚¤ãƒ«ç”»åƒã‚’Wordãƒ•ã‚¡ã‚¤ãƒ«ã‚„PowerPointãƒ•ã‚¡ã‚¤ãƒ«ã«ä»•è¾¼ã‚“ã§é›»åãƒ¡ãƒ¼ãƒ«ã§é€ã‚Šã¤ã‘ãŸã‚Šã€ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ãªã©ã‚’é€šã˜ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«é–²è¦§ã•ã›ãŸã‚Šã™ã‚‹æ‰‹å£ãŒè€ƒãˆã‚‰ã‚Œã‚‹ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã“ã‚Œã‚’è¦‹ã¦ã—ã¾ã†ã¨ã€æ”»
norinico 2011/01/05
Windows

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
IEã«æœªä¿®æ£ã®è„†å¼±æ€§ã€MicrosoftãŒã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªãƒ¼å…¬é–‹
æ‚ªè³ªãªã‚³ãƒ¼ãƒ‰ã‚’ä»•è¾¼ã‚“ã Webã‚µã‚¤ãƒˆã‚’é–²è¦§ã™ã‚‹ã¨ã€ãƒªãƒ¢ãƒ¼ãƒˆã§ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ã€‚Microsoftã®ãƒ‘ãƒƒãƒã¯æº–å‚™ä¸ã ã€‚ Internet Explorerï¼ˆIEï¼‰ã«æ–°ãŸãªè„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã€ç±³MicrosoftãŒ12æœˆ22æ—¥ä»˜ã§ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªãƒ¼ã‚’å…¬é–‹ã—ãŸã€‚ åŒç¤¾ã«ã‚ˆã‚‹ã¨ã€ã“ã®è„†å¼±æ€§ã¯IEã§CSSã‚’å‡¦ç†ã™ã‚‹éš›ã«ã€åˆæœŸåŒ–ã•ã‚Œãªã„ãƒ¡ãƒ¢ãƒªãŒç”Ÿæˆã•ã‚Œã‚‹ã“ã¨ã«èµ·å› ã™ã‚‹ã€‚å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã¯IE 6ï½ž8ã®å…¨ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€‚æ”»æ’ƒè€…ã¯ç‰¹å®šã®çŠ¶æ³ä¸‹ã§ã“ã®å•é¡Œã‚’æ‚ªç”¨ã—ã¦ã€æ‚ªè³ªãªã‚³ãƒ¼ãƒ‰ã‚’ä»•è¾¼ã‚“ã Webã‚µã‚¤ãƒˆã‚’ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«é–²è¦§ã•ã›ã€ãƒªãƒ¢ãƒ¼ãƒˆã§ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã§ãã¦ã—ã¾ã†æã‚ŒãŒã‚ã‚‹ã€‚ ã“ã®å•é¡Œã‚’çªãã‚³ãƒ³ã‚»ãƒ—ãƒˆå®Ÿè¨¼ï¼ˆPoCï¼‰ã‚³ãƒ¼ãƒ‰ã¯å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ãŒã€å®Ÿè³ªçš„ãªæ”»æ’ƒã®ç™ºç”Ÿã¯ç¾æ™‚ç‚¹ã§ã¯ç¢ºèªã•ã‚Œã¦ã„ãªã„ã¨ã„ã†ã€‚ è„†å¼±æ€§ã‚’è§£æ±ºã™ã‚‹ãŸã‚ã®æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ç¾åœ¨æº–å‚™ä¸ã ãŒã€ç¾æ™‚ç‚¹ã§è‡¨æ™‚ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’ãƒªãƒªãƒ¼ã‚¹ã™ã‚‹åŸºæº–ã«ã¯é”ã—ã¦ã„ãªã„ã¨ã„ã†
norinico 2010/12/24
ã—ã°ã‚‰ãIEã¯ä½¿ã‚ãªã„æ–¹ãŒã„ã„ã¨æ€ã†ã‚“ã ã€‚

IE

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Archived MSDN and TechNet Blogs
If you were looking for MSDN or Tech Net blogs, please know that MSDN and Tech Net blog sites have been retired, and blog content has been migrated and archived here. How to use this site Archived blogs are grouped alphabetically by the initial letter of the blog name. Select the initial letter from the TOC to see the full list of the blogs. You can also type the name of the blog or the title of the
norinico 2010/11/04
Microsoft

ie

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãŒ5æœˆã®æœˆä¾‹ãƒ‘ãƒƒãƒ2ä»¶ã‚’å…¬é–‹ã€ãƒ¡ãƒ¼ãƒ«ã¨VBAã«é–¢ã™ã‚‹ä¿®æ£ã€€
norinico 2010/05/12
è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Gumblarã‚‚æ‚ªç”¨ã™ã‚‹PDFæ”»æ’ƒåž‹ã‚¦ã‚¤ãƒ«ã‚¹ã€G DataãŒæ³¨æ„å–šèµ·ã€€
norinico 2010/05/12
è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Googleã¸ã®æ”»æ’ƒã«IEã®ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã€MSãŒã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã‚’å…¬é–‹ã€€
norinico 2010/01/16
IE6ã¯ã©ã†ã™ã‚Œã°ã„ã„ã®ã‹ãƒ»ãƒ»ã€€ã²ã¨ã¾ãšã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã«å¾“ã£ã¦8ä½¿ã£ã¦ãŠã“ã†ã€‚

IE

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
1