[B! xss] nyubachiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nyubachi id:nyubachi

xssã«é–¢ã™ã‚‹nyubachiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

i-mode2.0ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ¤œè¨Ž: æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§ - å¾³ä¸¸æµ©ã®æ—¥è¨˜(2009-08-05)
_æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€æºå¸¯é›»è©±ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«æè¼‰ã•ã‚ŒãŸJavaScriptã¨ã€Webã‚µã‚¤ãƒˆã®XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€ã„ã‚ã‚†ã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã«å¯¾ã™ã‚‹ä¸æ£ãƒã‚°ã‚¤ãƒ³ã®å¯èƒ½æ€§ã«ã¤ã„ã¦æ¤œè¨Žã™ã‚‹ã€‚ 5æœˆ28ã«ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã«æ›¸ã„ãŸæ—¥è¨˜ã€Œi-mode2.0ã¯å‰é€”å¤šé›£ã€ã«ã¦ã€ä»Šå¹´ã®NTTãƒ‰ã‚³ãƒ¢ã®å¤ãƒ¢ãƒ‡ãƒ«P-07Aã«ã¦JavaScriptæ©Ÿèƒ½ãŒåˆ©ç”¨åœæ¢ã•ã‚ŒãŸã“ã¨ã‚’æŒ‡æ‘˜ã—ãŸã€‚åŒæ—¥ä»˜ã®NTTãƒ‰ã‚³ãƒ¢ç¤¾ã®ãƒªãƒªãƒ¼ã‚¹ã«ã‚ˆã‚‹ã¨ã€ã€Œã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢æ›´æ–°ã«ä¼´ã„ã€é«˜åº¦åŒ–ã—ãŸæ©Ÿèƒ½ã®ä¸€éƒ¨ã‚’ã”åˆ©ç”¨ã„ãŸã ã‘ãªããªã£ã¦ã„ã¾ã™ãŒã€å†ã³ã”åˆ©ç”¨ã„ãŸã ã‘ã‚‹ã‚ˆã†é€Ÿã‚„ã‹ã«å¯¾å‡¦ã„ãŸã—ã¾ã™ã€ã¨ã‚ã£ãŸãŒã€ãã‚Œä»¥æ¥2ãƒ¶æœˆä»¥ä¸ŠãŒçµŒã¤ã‚‚ã®ã®ã€æœªã ã«JavaScriptæ©Ÿèƒ½ã¯åˆ©ç”¨ã§ããªã„çŠ¶æ…‹ã®ã¾ã¾ã ã€‚ å®Ÿã¯ã€NTTãƒ‰ã‚³ãƒ¢ç¤¾ãŒæ…Œã¦ãµãŸã‚ã„ã¦JavaScriptæ©Ÿèƒ½ã‚’æ€¥é½åœæ¢
nyubachi 2009/08/05
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æºå¸¯

xss
ãƒªãƒ³ã‚¯
XSSã®è„†å¼±æ€§ã‚’é™ã‚Šãªããªãã™æ–¹æ³•
XSSã®è„†å¼±æ€§ã‚’é™ã‚Šãªããªãã™æ–¹æ³• XSSãŒã¯ã‚„ã£ã¦ã„ã‚‹ã®ã§ä¾¿ä¹—ã—ã¦ãŠãã¾ã™ã€‚ ç§ãŒã‚ˆãä½¿ã†æ–¹æ³•ãªã‚“ã§ã™ãŒã€ã“ã®æ–¹æ³•ã‚’åˆ©ç”¨ã™ã‚‹ã¨XSSã®è„†å¼±æ€§ã‚’é™ã‚Šãªããªãã™ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚ å¯¾å¿œæ–¹æ³•ã¯ã€PHPãƒ•ã‚¡ã‚¤ãƒ«ã®æœ€åˆã«ä»¥ä¸‹ã®ã‚³ãƒ¼ãƒ‰ã‚’æŒ¿å…¥ã™ã‚‹ã ã‘ã€‚ foreach($_GET as $key => $value){ $_GET[$key] = htmlspecialchars(htmlspecialchars_decode($value,ENT_QUOTES),ENT_QUOTES); } foreach($_POST as $key => $value){ $_POST[$key] = htmlspecialchars(htmlspecialchars_decode($value,ENT_QUOTES),ENT_QUOTES); } ã“ã‚Œã§è‡ªå‹•çš„ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å‡¦ç†ã‚’è¡Œã£ã¦ãã‚Œã¾ã™ã€‚ é€šå¸¸ã®XSSå¯¾
nyubachi 2008/10/25
php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
XSSã‚’ä¿®æ£ã—ãªã„ã¨ã„ã†äº‹ (Kanasansoft Web Lab.)
ä»Šèªã¿è¿”ã™ã¨ã€ã‚ã¡ã“ã¡ã«å¤‰ãªæ—¥æœ¬èªžãŒæ··ã˜ã£ã¦ã„ã¾ã™ãã€‚ è¨‚æ£ã™ã‚‹ã®ã‚‚å«Œã‚‰ã—ã„ã®ã§ãã®ã¾ã¾ã«ã—ã¦ãŠãã¾ã™ã€‚ ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã¨ã„ã†ã‚µãƒ¼ãƒ“ã‚¹ã§ã€å½“ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã«å¯¾ã—ã¦ã¤ã„ãŸã‚³ãƒ¡ãƒ³ãƒˆã«è¿”ä¿¡ã—ã¦ã„ãã¾ã™ã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã«ã¯ã€ã€ŒXSSã®å±é™ºæ€§ã‚’ã‚ã‹ã£ã¦ã„ãªã„äººã«ç†è§£ã—ã¦ã‚‚ã‚‰ã†ã€ã¨ã„ã†ã®ãŒå‰æã¨ã—ã¦ã‚ã‚Šã¾ã—ãŸã€‚ ãã—ã¦ã€ã€ŒæŠ€è¡“ã®ç–Žã„äººã«ã‚‚ç†è§£ã—ã¦å‹•ã„ã¦ã‚‚ã‚‰ã†ã€ã¨ã„ã†é¡˜ã„ã‚‚ã‚ã‚Šã¾ã—ãŸã€‚ ã“ã®ãŸã‚ã«ã€ã€Œå¤šå°‘ã®èª¤è§£ã‚’ä¸ŽãˆãŸã¨ã—ã¦ã‚‚ãªã‚“ã¨ãªãç†è§£ã—ã¦ã‚‚ã‚‰ã†ã€äº‹ã‚’é‡è¦è¦–ã—ã¦ã„ã¾ã™ã€‚ ã“ã‚Œã‚’è¸ã¾ãˆã¦ä»¥ä¸‹è¨˜è¿°ã—ã¾ã™ã€‚ ã€Œ#ã€ã§ã¯ã˜ã¾ã‚‹ã®ãŒã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã®ã‚³ãƒ¡ãƒ³ãƒˆã§ã™ã€‚ #2008å¹´10æœˆ24æ—¥Â g616blackheartÂ ã‚¬ãƒ¼ãƒ‰ãŒå …ã„ã¨è¨€ã‚ã‚ŒãŸâ€¦â€¦ã©ã†ã—ã¦ã ã‚ã†ï¼Ÿ #2008å¹´10æœˆ24æ—¥Â anigokaÂ ãªã‚“ã‹ã‚¬ãƒ¼ãƒ‰ãŒå …ã„ã¦è¨€ã‚ã‚Œã¡ã‚ƒã£ãŸã‚“ã ã‘ã©ã€ãªã«,ã‚ªãƒ¬ãŒéžã‚³ãƒŸãƒ¥ã ã£ã¦è¨€ã„ãŸã„ã®ï¼ï¼Ÿ ç”³ã—è¨³ãªã„ã§ã™ã€‚
nyubachi 2008/10/25
javascript

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
å€‹äººã ã‹ã‚‰ç”˜ã„ã®ã‹ãª - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã‚ã‚‰ã‚ã‚‰äºˆå‘ŠinãŒXSSã‚„ã‚‰ã‚Œã¡ã‚ƒã£ãŸã‚‰ã—ã„ã§ã™ãï¼ ä½¿ã„å¤ã•ã‚ŒãŸæ‰‹æ³•ï¼Ÿ ã„ã¾ã©ãã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‰ã—ã¦ãªãã¦ãƒ€ã‚µã„ï¼Ÿ é–¢é€£ã®è¨˜äº‹ã«å¯¾ã—ã¦ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã§ã‚‚è‰²ã€…è¨€ã‚ã‚Œã¦ã„ãŸã‚Šã€ http://b.hatena.ne.jp/t/%E4%BA%88%E5%91%8A.in?threshold=1 ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚µã‚¤ãƒˆã§ã‚‚ã€ã“ã‚“ãªç…½ã‚Šè¨˜äº‹ã‚’æ›¸ã‹ã‚Œã¦ã„ãŸã‚Šã™ã‚‹ã‘ã‚Œã©â€¦ ä»Šå›žã®ä»¶ã«ã¤ã„ã¦ITä¼æ¥ã«å‹¤ã‚ã‚‹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã«èžã„ã¦ã¿ã‚‹ã¨ã€ ã€Œã“ã‚Œã¯åˆæ©ä¸ã®åˆæ©ã€‚XSSã‚³ãƒ¼ãƒ‰æ›¸ã„ãŸæ–¹ã‚‚10åˆ†ã‚‚æŽ›ã‹ã£ã¦ãªã„ã‚ˆã€‚ãã‚Œã‚’äº‹å‰ã«å¯¾ç–ã—ã¦ãªã‹ã£ãŸäºˆå‘Šinã«ã¯ã‚‚ã£ã¨ãƒ“ãƒƒã‚¯ãƒªã ã‘ã©ã€ã€ã€ç´ äººãªã®ï¼Ÿã€ ã¨èªžã‚‹ã€‚ äºˆå‘Šinã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’ç‹™ã£ãŸã‚³ãƒ¼ãƒ‰!?ã€€ã€Œäºˆå‘Šiné–‹ç™ºè€…ã¯ç´ äººã€ http://news.livedoor.com/article/detail/3759632/ ãã‚Œã£ã¦ã©ã†ã ã‚ã†ãã€‚ Googleã‚„Amazo
nyubachi 2008/08/04
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¯ã¾ã¡ã¡ã‚ƒã‚“

xss
ãƒªãƒ³ã‚¯
PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢
ã“ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã®èª¬æ˜Žãƒ»æ³¨æ„ãªã© PHP ã¯ã€Apache ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚„ã€CGIã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã¨ã—ã¦ä½¿ç”¨ã§ãã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã§ã™ã€‚ã“ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€ä¸»ã« PHP ã«ãŠã‘ã‚‹ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®å•é¡Œã«ã¤ã„ã¦ã‚ˆãå–ã‚ŠæŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‚‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦èª¿ã¹ãŸã“ã¨ã‚„ã€ã“ã‚Œã‚‰ä»¥å¤–ã§ã‚‚ã€PHP ã«é–¢é€£ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦çŸ¥ã£ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦ãƒ¡ãƒ¢ã—ã¦ãŠãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ã‚¹ãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«) ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã¾ãŸã€PHP ãƒžãƒ‹ãƒ¥ã‚¢ãƒ« : ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚„ã€PHP Security Guide (PHP Security Consortium) ã«ã¯ã€PH
nyubachi 2008/02/03
php

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
ï¼ ITï¼šã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç–ã®åŸºæœ¬
æœ€è¿‘Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å˜åœ¨ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒæ³¨ç›®ã‚’æµ´ã³ã¦ã„ã‚‹ã€‚ãã®ä¸ã§ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ãŒæœ‰åã§ã‚ã‚‹ãŒã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã«ã¤ã„ã¦æ£ç¢ºã«ç†è§£ã—ã¦ã„ã‚‹äººãŒä¾ç„¶ã¨ã—ã¦å°‘ãªã„ã¨æ„Ÿã˜ã‚‹ã€‚ æœ¬ç¨¿ã§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã¯ã©ã®ã‚ˆã†ãªè„†å¼±æ€§ã§ã‚ã‚‹ã®ã‹ã€ã“ã®è„†å¼±æ€§ã‚’æŒã£ãŸã‚µã‚¤ãƒˆãŒæ”»æ’ƒã•ã‚Œã‚‹ã¨ã©ã®ã‚ˆã†ãªè¢«å®³ãŒèµ·ãå¾—ã‚‹ã®ã‹ã€ãªãœãã®ã‚ˆã†ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒä½œã‚Šè¾¼ã¾ã‚Œã¦ã—ã¾ã†ã®ã‹ã€ã©ã®ã‚ˆã†ã«å¯¾ç–ã‚’ã™ã‚Œã°ã‚ˆã„ã®ã‹ã‚’è§£èª¬ã—ã¦ã„ãã€‚ â€»ä»¥ä¸‹æœ¬æ–‡ä¸ã§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã®ã“ã¨ã‚’ã€ŒXSSã€ã¨è¡¨è¨˜ã™ã‚‹ã€‚ã€ŒCross Site Scriptingã€ã®ç•¥ã§ã‚ã‚‹ã‹ã‚‰ã€ŒCSSã€ã¨è¡¨è¨˜ã—ã¦ã„ã‚‹è¨˜äº‹ã‚‚ã‚ã‚‹ãŒã€ã€ŒCascading Style Sheetsã€ã®ç•¥ã‚‚ã€ŒCSSã€ã¨ãªã‚Šç´›ã‚‰ã‚ã—ã„ãŸã‚ã€ã€ŒXSSã€ã¨è¡¨è¨˜ã™ã‚‹å ´åˆãŒå¤šããªã£ã¦ãã¦ã„ã‚‹ã€‚æœ¬ç¨¿ã§
nyubachi 2008/02/03
xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
printenv at xss-quiz.int21h.jp
printenv at xss-quiz.int21h.jp Your IP address: 133.242.243.6 () NameValue HTTP_ACCEPT*/* HTTP_CACHE_CONTROLno-cache HTTP_CONNECTIONclose HTTP_HOSTxss-quiz.int21h.jp HTTP_USER_AGENTHatenaBookmark/4.0 (Hatena::Bookmark; Analyzer) QUERY_STRING REMOTE_ADDR133.242.243.6 REQUEST_METHODGET REQUEST_SCHEMEhttp REQUEST_URI/
nyubachi 2008/02/01
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
1