[B! xss][csrf] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

xssã¨csrfã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¬›ç¿’(7)Same Origin Policy
ã€ŒWebã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ (7)Same Origin Policyã€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã§ç¤¾å†…å‹‰å¼·ä¼šã‚’é–‹å‚¬ã—ã¾ã—ãŸã€‚ä»Šã¾ã§1å›žã‚‚å…¬é–‹ã—ã¦ãªã„ã‚“ã§ã™ãŒã€å®Ÿã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ç¤¾å†…è¬›ç¿’ä¼šã¯7å›žç›®ã§ã™ã€‚è¿‘ã„ã†ã¡ã«æ®‹ã‚Šã®6å›žåˆ†ã‚‚å…¬é–‹ã—ã¾ã™ã€‚ ã¾ã¨ã‚ Same Origin Policy åŒä¸€ãƒ›ã‚¹ãƒˆã ã‘ä¿¡ç”¨ã™ã‚‹ãƒãƒªã‚·ãƒ¼ åŒä¸€ãƒ›ã‚¹ãƒˆã®ã¿åˆ¥URLã®DOMæ“ä½œãŒå¯èƒ½ å´©ã•ã‚Œã‚‹ã¨é–“æŽ¥æ”»æ’ƒã•ã‚Œã‚‹ã®ã¨åŒç‰ã®è„…å¨ ã€Œä¿¡ç”¨ã§ããªã„ãƒ¦ãƒ¼ã‚¶ãŒåŒä¸€ãƒãƒ¼ãƒãƒ£ãƒ«ã‚µãƒ¼ãƒã«JS/HTMLã‚’è¨ç½®ã§ãã‚‹å ´åˆã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£çš„ã«ã‚¢ã‚¦ãƒˆã ã‚ˆã€ã¨ã„ã†ã“ã¨ã‚’å†ç¢ºèªã—ã¾ã—ãŸã€‚ ãƒ ãƒ¼ãƒ“ãƒ¼ ç™ºè¡¨è³‡æ–™ ã‚¹ãƒ©ã‚¤ãƒ‰(PDF) å†…å®¹ã®è£œè¶³ãªã© ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆé€šä¿¡ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã¨ã„ã†ç« ã‚’æ™‚é–“ã®éƒ½åˆã§å‰Šã‚Šã¾ã—ãŸã€‚ã“ã®ã‚ãŸã‚Šã‚‚ã„ãšã‚Œè©±ã—ãŸã„ã¨ã“ã‚ã§ã™ã€‚ å‚è€ƒè³‡æ–™ åŒä¸€ç”Ÿæˆå…ƒãƒãƒªã‚·ãƒ¼ - MDC Mozillaã®æŠ€è¡“ç´¹ä»‹ãƒšãƒ¼ã‚¸ã€‚ document.domainã®æ›¸ãæ›ãˆã¨i
ockeghem 2010/08/07
ã™ã°ã‚‰ã—ã„è§£èª¬

javascript

sop

xss

csrf
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã«3ä»¶ã®è„†å¼±æ€§
ã‚¬ãƒ«ãƒ¼ãƒ³ã‚„Officeã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªãªã©3ä»¶ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã€‚ æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼ˆIPAï¼‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ã¨JPCERTã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ã¯6æœˆ27æ—¥ã€ã‚µã‚¤ãƒœã‚¦ã‚ºã®ã‚°ãƒ«ãƒ¼ãƒ—ã‚¦ã‚§ã‚¢è£½å“ã€Œã‚µã‚¤ãƒœã‚¦ã‚º Officeã€ãªã©ã«3ä»¶ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚ŒãŸã¨ã—ã¦ã€JVN(Japan Vulnerability Notes)ã«æƒ…å ±ã‚’å…¬é–‹ã—ãŸã€‚ ç™ºè¦‹ã•ã‚ŒãŸè„†å¼±æ€§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã¨ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šã®åˆè¨ˆ3ä»¶ã€‚å¯¾è±¡è£½å“ã¯ã€CSRFãŒã‚µã‚¤ãƒœã‚¦ã‚º Office 6ãŠã‚ˆã³ã‚µã‚¤ãƒœã‚¦ã‚º ãƒ‡ãƒ‚ã‚¨ 6.0ï¼ˆ1.0ï¼‰ã‚ˆã‚Šå‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ 2.0.0ï½ž2.1.3ã€‚XSSã¨ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šãŒã‚µã‚¤ãƒœã‚¦ã‚º ã‚¬ãƒ«ãƒ¼ãƒ³ 2.0.0ï½ž2.1.3ã¨ãªã£ã¦ã„ã‚‹ã€‚ CSRFã®è„†å¼±æ€§ã§ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè©²å½“è£½
ockeghem 2008/06/27
cyboz

xss

csrf

session fixation

security
ãƒªãƒ³ã‚¯
è«¸å›ã€€ç§ã¯è„†å¼±æ€§ãŒå¥½ãã
è«¸å›ã€€ç§ã¯è„†å¼±æ€§ãŒå¥½ãã è«¸å›ã€€ç§ã¯è„†å¼±æ€§ãŒå¤§å¥½ãã PHPãŒå¥½ãã XSSãŒå¥½ãã SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒå¥½ãã CSRFãŒå¥½ãã UTF-7ãŒå¥½ãã expressionãŒå¥½ãã ã‚·ã‚§ã‚¢ã‚¦ã‚§ã‚¢ã§ Webã§ Googleã§ ã‚¹ãƒšã‚·ãƒ£ãƒ«ãã“ã¾ã‚“ã¾ã§ LiveHTTPã§ Filemonã§ Regmonã§ OllyDbgã§ Perlã§ ã“ã®åœ°ä¸Šã«å˜åœ¨ã™ã‚‹ã‚ã‚Šã¨ã‚ã‚‰ã‚†ã‚‹è„†å¼±æ€§ãŒå¤§å¥½ãã ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã—ã¦å£ã†ã‚‹ã•ãè¨€ã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã®è„†å¼±æ€§ã‚’ã„ã¨ã‚‚ç°¡å˜ã«è¦‹ã¤ã‘ã‚‹ã®ãŒå¥½ãã å¤§ä¼æ¥ã®ã‚µã‚¤ãƒˆãŒGoogleã«ã‚ˆã£ã¦è„†å¼±æ€§ã‚’ç™ºè¦‹ã•ã‚ŒãŸæ™‚ãªã©å¿ƒãŒè¸Šã‚‹ GoogleãŒã‚ã£ã‘ãªãè„†å¼±æ€§ã‚’è¦‹ã¤ã‘ã¦ã—ã¾ã†ã®ãŒå¥½ãã Perlã‚’é¦¬é¹¿ã«ã—ã¦ã„ãŸå¥´ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’ä¹—ã£å–ã£ãŸæ™‚ãªã©èƒ¸ãŒã™ãã‚ˆã†ãªæ°—æŒã¡ã ã£ãŸ ç²˜ã‚Šå¼·ã„åŒæ¥è€…ãŒMS Officeã®ã‚·ãƒªã‚¢ãƒ«èªè¨¼ã¨æ ¼é—˜ã—ã¦ã„ã‚‹æ§˜ãŒå¥½ãã PHPè¦šãˆãŸã¦ã®é‡ŽéƒŽå…±ãŒç¶šã€…ã¨è„†å¼±æ€§ã‚’ä½œ
ockeghem 2008/03/15
ã€Žè«¸å›ã€€ç§ã¯è„†å¼±æ€§ãŒå¤§å¥½ãã /PHPãŒå¥½ãã /XSSãŒå¥½ãã /SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãŒå¥½ãã /CSRFãŒå¥½ãã ã€<PHPã¯è„†å¼±æ€§ã®ç†é ã§ã™ã‹

neta

php

xss

csrf

å¢—ç”°

security
ãƒªãƒ³ã‚¯
http://japan.internet.com/webtech/20071218/10.html
ockeghem 2007/12/18
ã€Žã“ã‚Œã¯ Gmail ã¾ãŸã¯ Google è£½å“ã«ç‰¹å®šã•ã‚Œã‚‹ã‚‚ã®ã§ã¯ãªã„ã€‚æ‚ªæ„ã‚ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ã€ã‚ˆã‚Šç›´æŽ¥çš„ãªæ–¹æ³•ã€ä¾‹ãˆã°ãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒ¢ãƒ¼ãƒ‰ã®ã‚ãƒ¼ãƒã‚¬ãƒ¼ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ãªã©ã®æ‰‹æ®µã§ã€ã„ãã‚‰ã§ã‚‚å…±æœ‰ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚’æ‚ªç”¨ã§ãã‚‹ã€ç„¶ã‚Š

security

xss

csrf

google
ãƒªãƒ³ã‚¯
ã“ã‚Œã¯ CSRF ã§ã™ã‹? | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä¸ã«ã¯ï¼Œã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’æ ¼ç´ã—ãŸã‚¯ãƒƒã‚ãƒ¼ã‚’ç™ºè¡Œã™ã‚‹ã‚‚ã®ãŒã‚ã‚‹ã€‚ä¾‹ãˆã°SNSã®ã‚ˆã†ãªä¼šå“¡åˆ¶ã‚µãƒ¼ãƒ“ã‚¹ï¼ŒWebãƒ¡ãƒ¼ãƒ«ï¼Œã‚ªãƒ³ãƒ©ã‚¤ãƒ³ãƒ»ã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ãªã©ã§ã‚ˆãä½¿ã‚ã‚Œã‚‹ã€‚ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã¯èªè¨¼æ¸ˆã¿ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å¯¾ã—ã¦ç™ºè¡Œã•ã‚Œã‚‹ãŸã‚ï¼Œã“ã‚Œã‚’å¥ªã„å–ã‚‰ã‚Œã‚‹ã¨ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹ãªã‚Šã™ã¾ã—ã‚’è¨±ã—ã¦ã—ã¾ã†ã€‚ã“ã‚Œã‚’ç‹™ã£ã¦ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ°—ä»˜ã‹ãªã„ã†ã¡ã«ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ã€Œä¹—ã£å–ã‚‹ã€ã®ãŒï¼ŒCSRFã®ãœã„å¼±æ€§ã‚’çªãæ”»æ’ƒã§ã‚ã‚‹ã€‚ ãˆãƒ¼ã£ã€‚ã¡ãŒã†ã‚ˆã€å…¨ç„¶ã¡ãŒã†ã‚ˆ! ã“ã®èª¬æ˜Žã¯å˜ãªã‚‹ Cookie å¥ªå–ã«ã‚ˆã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã§ã€CSRF ã§ã¯ãªã„ã¨æ€ã„ã¾ã™ã€‚ã‚€ã—ã‚ã€ŒCookie ã®å¥ªå–ãŒå¿…è¦ãªã„ã€ã¨ã„ã†ã®ãŒ CSRF ã®ãƒã‚¤ãƒ³ãƒˆã ã¨æ€ã„ã¾ã™ã—ã€‚ å›³ã‚‚ã‚„ã‚„å¾®å¦™ã§ã™ãâ€¦â€¦ã€‚å›³ã® 4ç•ªã§ CSRF æ”»æ’ƒã«ã‚ˆã‚‹ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å¤‰æ›´ãŒè¡Œã‚ã‚ŒãŸå¾Œã€5ç•ªã§ã¯ãã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦æ”»æ’ƒè€…ãŒã‚¢ã‚¯ã‚»ã‚¹ã—ã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯ã“ã‚Œã§é–“é•ã£ã¦ã¯ã„ãªã„ã®ã§
ockeghem 2007/12/18
ç©¶æ¥µã®XSS/CSRFæ··åŒãƒ–ãƒ¼ãƒ ã€çµ¶è³›ç¶™ç¶šä¸ã‹/XSSã¨æ–è¨€ã™ã‚‹ã®ã‚‚èª¤ã‚Šã ãŒ/todo:CSRFã®æ£æ”»æ³•ã®èª¬æ˜Žã‚’æ›¸ã

security

xss

csrf

ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒ

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
ã‚¯ã‚¤ã‚º:XSSã¨CSRFã¯ã©ã“ã«ã‚ã‚Šã¾ã™ã‹? - ockeghem's blog
å…ˆã®æ—¥è¨˜(XSSã¯ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ãã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå‹•ã - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜)ã¯ã€ä»•è¾¼ã‚“ã ãƒã‚¿ãŒã‚ãŸã£ã¦å¤šãã®æ–¹ã«èªã‚“ã§ã„ãŸã ã„ãŸã€‚ç´°ã‹ã„å†…å®¹ã«ã¤ã„ã¦ã¯ã€é ‚æˆ´ã—ãŸæ‰¹åˆ¤ã‚„åçœã‚‚ã‚ã‚‹ãŒã€ã“ã®ãƒ†ãƒ¼ãƒžã«å¯¾ã—ã¦å¤šãã®é–¢å¿ƒã‚’é›†ã‚ã‚‹ã“ã¨ãŒã§ããŸã®ã¯è‰¯ã‹ã£ãŸã¨æ€ã†ã€‚ä»Šå›žã‚‚ã€æ‰‹ã‚’å¤‰ãˆå“ã‚’å¤‰ãˆã¦ã€XSSã¨CSRFã®é•ã„ã‚’èª¬æ˜Žã—ã‚ˆã†ã€‚ã¨ã„ã†ã“ã¨ã§ã€ä»Šå›žã¯ã‚¯ã‚¤ã‚ºä»•ç«‹ã¦ã«ã—ã¦ã¿ãŸã€‚ ã¨ã„ã£ã¦ã‚‚ã€éžå¸¸ã«ç°¡å˜ãªã‚¯ã‚¤ã‚ºã ã€‚ èªè¨¼ã‚’å¿…è¦ã¨ã™ã‚‹ä¼šå“¡åˆ¶ã‚µã‚¤ãƒˆmaitter.comã§ã€å€‹äººæƒ…å ±ã‚’å…¥åŠ›ã™ã‚‹ç”»é¢ãŒã‚ã‚‹ã€‚å…¸åž‹çš„ãªã€å…¥åŠ›(A)-ç¢ºèª(B)-ç™»éŒ²(C)ã¨ã„ã†ç”»é¢é·ç§»ï¼ˆä¸‹å›³ï¼‰ã‚’æƒ³å®šã—ãŸå ´åˆã€ XSSãŒç™ºç”Ÿã—ã‚„ã™ã„ç”»é¢ã‚’ä¸€ã¤ã‚ã’ã‚ˆ CSRFãŒç™ºç”Ÿã—ã‚„ã™ã„ç”»é¢ã‚’ä¸€ã¤ã‚ã’ã‚ˆ ã¨ã„ã†ã‚‚ã®ã (å…¥åŠ›ç”»é¢ã¯åˆæœŸå…¥åŠ›ã®ã¿æƒ³å®š)ã€‚ã‚¨ãƒ©ãƒ¼æ™‚ã®æŒ™å‹•ãªã©ã¯æŒ‡å®šã•ã‚Œã¦ã„ãªã„ã®ã§æƒ³å®šã—ãªã„ã‚‚ã®ã¨ã™ã‚‹ã€‚ è§£
ockeghem 2007/12/05
ã‚»ãƒ«ã‚¯ãƒž

xss

csrf
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
ockeghem 2007/12/03
â†‘id:Hamachiya2<ã†ã‚ã£ã€æœ¬ç‰©ãŒæ¥ãŸã‹ã¨æ€ã£ã¦ã‚ˆãè¦‹ãŸã‚‰ã‚¹ãƒšãƒ«ãŒé•ã„ã¾ã—ãŸww/ã‚‚ã£ã¨åˆ†ã‹ã‚Šã‚„ã™ã„èª¬æ˜Žã‚’è€ƒãˆã¾ã™(_ _)

ã‚»ãƒ«ã‚¯ãƒž

security

xss

csrf

DKç¥ã‚Š
ãƒªãƒ³ã‚¯
CSRF ã¨ Cookie æ¼æ´©ã¯é–¢ä¿‚ãªã„ | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
ãã—ã¦cookieã‚’å¥ªã†ã®ãŒã©ã‚Œã»ã©ç°¡å˜ã‹ã¨ã„ã†ã®ã¯ã€CSRFã®äº‹ä¾‹ãŒå¾Œã‚’ãŸãŸãªã„ã“ã¨ã‹ã‚‰ã‚‚ä¼ºã„çŸ¥ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ ã†ãƒ¼ã‚€ã€CSRFã®ç†è§£ã£ã¦çµæ§‹æµ¸é€ã—ã¦ããŸã¨æ€ã£ã¦ã„ãŸã®ã§ã™ãŒã€ãã†ã§ã‚‚ãªã„ã‚ˆã†ã§â€¦â€¦ã€‚ CSRF ã¯ Cookie ã‚’å¥ªå–ã—ã¦ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ã™ã‚‹ã‚ˆã†ãªæ”»æ’ƒã§ã¯ãªãã€æ”»æ’ƒè€…ã¯ Cookie ã®å€¤ã‚’çŸ¥ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã›ã‚“ã€‚ã¾ãŸã€CSRF æ”»æ’ƒã«ã‚ˆã£ã¦æ”»æ’ƒè€…ãŒ Cookie ã‚’å¥ªå–ã™ã‚‹ã“ã¨ã‚‚ã§ãã¾ã›ã‚“ã€‚ã‚‚ã¡ã‚ã‚“ã€åˆ¥é€” XSS ãŒã‚ã£ãŸã‚Šã™ã‚Œã° Cookie ã‚’å¥ªå–ã§ãã‚‹ä½™åœ°ãŒã‚ã‚Šã¾ã™ãŒã€ãã‚Œã¯ XSS ã«ã‚ˆã‚‹æ¼æ´©ã¨ã„ã†ã“ã¨ã«ãªã‚‹ã§ã—ã‚‡ã†ã€‚ ãã‚Œã‹ã‚‰ã€User-Agent ã®ä¸€è‡´ãƒã‚§ãƒƒã‚¯ã¯å¯¾ç–ã¨ã—ã¦ã¯ä¸ååˆ†ã§ã™ã€‚ã¨ã„ã†ã®ã‚‚ã€CSRF ã§ã¯åŽŸç†ä¸Š User-Agent ãŒä¸€è‡´ã™ã‚‹ã«æ±ºã¾ã£ã¦ã„ã¾ã™ã—ã€Cookie å¥ªå–ã‚’æƒ³å®šã™ã‚‹ãªã‚‰ã€æ”»æ’ƒè€…ãŒ User-Agent ã‚’ä¸€è‡´ã•ã›ã‚‹ã“
ockeghem 2007/12/01
ã¾ã“ã¨ã«ãã®é€šã‚Š

security

xss

csrf

cookie

password
ãƒªãƒ³ã‚¯
1