[B! xss][google] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

xssã¨googleã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚°ãƒ¼ã‚°ãƒ«ã•ã‚“ã‹ã‚‰ã®ã„ãŸã ãã‚‚ã®ã¾ã¨ã‚ - 2011 - A Plain Old UNIX Programmer
å¤ªã£è…¹ããƒ¼ãã‚‹ã•ã‚“ã‹ã‚‰ä»Šå¹´ï¼‘å¹´é–“é ‚ã„ãŸã‚‚ã®ã¯ã€ 01æœˆ $1,000 Mapsã¨Blogsearchã‚’åŽ»å¹´XSSã£ãŸæ™‚ã®æ®‹ã‚Šã®æŒ¯è¾¼ã€‚ 07æœˆ $500 å†ã³Mapsã§XSSã€‚ 10æœˆ Tã‚·ãƒ£ãƒ„ GDD2011JPå‚åŠ Tã‚·ãƒ£ãƒ„ã¨ã‚¿ãƒ€æ˜¼é£¯ã€‚ 10æœˆ Tã‚·ãƒ£ãƒ„ GDD2011JP DevQuizæº€ç‚¹Tã‚·ãƒ£ãƒ„(å†™çœŸå³)ã¨EXP Hackathonå¾Œã®ã‚¿ãƒ€é…’æ‡‡è¦ªä¼šã€‚ 11æœˆ Tã‚·ãƒ£ãƒ„ Google Code Jam Japan 2011 200ä½ä»¥å†…è³žå“Tã‚·ãƒ£ãƒ„(å†™çœŸå·¦)ã€ã§ï¼Ÿã‚ªãƒ•ä¼šã¯ã©ã†ãªã£ãŸï¼Ÿ ã¨ã„ã†è¨³ã§ããƒ¼ãã‚‹ã•ã‚“ã‹ã‚‰é‡‘å“é ‚ããªã‚‰Vulnerability Reward ProgramãŒä¸€ç•ªåŠ¹çŽ‡ã„ã„ã‚ˆã†ã§ã™ã€‚ è‹¥ã„ã‚³ãƒ¼ãƒ€ãƒ¼ã®çš†ã•ã‚“ã‚‚å¾³ä¸¸æœ¬ã§ã‚‚èªã‚“ã§ãƒãƒ£ãƒ¬ãƒ³ã‚¸ã—ã¦ã¿ã¦ã¯ï¼Ÿ ä½“ç³»çš„ã«å¦ã¶ å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ è„†å¼±æ€§ãŒç”Ÿã¾ã‚Œã‚‹åŽŸç†ã¨å¯¾ç–ã®å®Ÿè·µ ä½œè€…: å¾³ä¸¸æµ©å‡ºç‰ˆç¤¾/ãƒ¡ãƒ¼ã‚«ãƒ¼: SB
ockeghem 2012/01/02
ã€Žè‹¥ã„ã‚³ãƒ¼ãƒ€ãƒ¼ã®çš†ã•ã‚“ã‚‚å¾³ä¸¸æœ¬ã§ã‚‚èªã‚“ã§ãƒãƒ£ãƒ¬ãƒ³ã‚¸ã—ã¦ã¿ã¦ã¯ï¼Ÿã€<www å¾³ä¸¸æœ¬èªã‚“ã ã ã‘ã§ã¯ã€ã¡ã‚‡ã£ã¨é›£ã—ã„ã‹ã‚‚ #wasbook

security

google

xss
ãƒªãƒ³ã‚¯
Researcher Uncovers Twitter, Google Calendar Security Vulnerabilities
ockeghem 2010/01/05
security

xss

google
ãƒªãƒ³ã‚¯
JavaScript Hijack/JSON Hijackã®ãœã„å¼±æ€§
ä»Šå›žã§ï¼Œratproxyã§æ¤œå‡ºã§ãã‚‹ç‰¹å¾´çš„ãªãœã„å¼±æ€§ã®è§£èª¬ã¯çµ‚ã‚ã‚Šã§ã™ã€‚æœ€çµ‚å›žã¨ãªã‚‹ä»Šå›žã¯ï¼ŒJavaScript Hijackã«ã¤ã„ã¦ã§ã™ã€‚JavaScript Hijackï¼Œãã—ã¦JSON Hijackã¯ï¼ŒJavaScriptãƒ•ã‚¡ã‚¤ãƒ«ã‚„JSONãƒ‡ãƒ¼ã‚¿å†…ã«å«ã¾ã‚Œã‚‹æƒ…å ±ã‚’ç›—ã‚€æ”»æ’ƒã§ã™ã€‚ratproxyã¯ï¼Œã“ã®æ”»æ’ƒã‚’æˆç«‹ã•ã›ã¦ã—ã¾ã†ãœã„å¼±æ€§ã‚’è¦‹ä»˜ã‘ã‚„ã™ããªã£ã¦ã„ã¾ã™ã€‚ JavaScript Hijack ã¾ãšæœ€åˆã«JavaScript Hijackã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã—ã‚‡ã†ã€‚JavaScript Hijackæ”»æ’ƒã«ãœã„å¼±ã«ãªã‚‹ã®ã¯ï¼Œå€‹äººæƒ…å ±ãªã©ã®æ©Ÿå¯†æƒ…å ±ã‚’å†…å®¹ã¨ã—ã¦å«ã‚€JavaScriptãƒ•ã‚¡ã‚¤ãƒ«ã‚’å‹•çš„ã«ç”Ÿæˆã—ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ã™ã€‚ç†è€…ãŒéŽåŽ»ã®æ¤œæŸ»ã§å®Ÿéš›ã«è¦‹ãŸã‚±ãƒ¼ã‚¹ã«ã¯ï¼Œä»¥ä¸‹ã®ã‚ˆã†ãªã‚‚ã®ãŒã‚ã‚Šã¾ã—ãŸã€‚ ï¼ˆindex.htmlã®ä¸€éƒ¨ï¼‰ <script src="greeting.cgi"></
ockeghem 2008/09/12
security

google

xss

javascript

json

teracc
ãƒªãƒ³ã‚¯
http://code.google.com/webtoolkit/releases/release-notes-1.4.61.html
ockeghem 2007/12/18
"We'd like to thank Daiki Fukumori of Secure Sky Technology, Inc. for reporting this."

security

google

xss

ç¦æ£®å¤§å–œ
ãƒªãƒ³ã‚¯
JVN#75130343: Google Web Toolkit ã«ãŠã‘ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§
Google ãŒæä¾›ã™ã‚‹ Google Web Toolkitï¼ˆGWTï¼‰ã«ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ Google ãŒæä¾›ã™ã‚‹ Google Web Toolkitï¼ˆGWTï¼‰ã¯ã€Ajax ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ Java ãƒ™ãƒ¼ã‚¹ã®ç’°å¢ƒã§é–‹ç™ºã™ã‚‹ãŸã‚ã®ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã§ã™ã€‚ Google Web Toolkit ã® benchmark reporting system ã«ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚
ockeghem 2007/12/18
security

google

xss

ç¦æ£®å¤§å–œ
ãƒªãƒ³ã‚¯
http://japan.internet.com/webtech/20071218/10.html
ockeghem 2007/12/18
ã€Žã“ã‚Œã¯ Gmail ã¾ãŸã¯ Google è£½å“ã«ç‰¹å®šã•ã‚Œã‚‹ã‚‚ã®ã§ã¯ãªã„ã€‚æ‚ªæ„ã‚ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ã€ã‚ˆã‚Šç›´æŽ¥çš„ãªæ–¹æ³•ã€ä¾‹ãˆã°ãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒ¢ãƒ¼ãƒ‰ã®ã‚ãƒ¼ãƒã‚¬ãƒ¼ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ãªã©ã®æ‰‹æ®µã§ã€ã„ãã‚‰ã§ã‚‚å…±æœ‰ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚’æ‚ªç”¨ã§ãã‚‹ã€ç„¶ã‚Š

security

xss

csrf

google
ãƒªãƒ³ã‚¯
www.google.comã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ãœã„å¼±æ€§ï¼Œç±³WatchfireãŒå ±å‘Š
ç±³Watchfireã¯ï¼Œç±³Googleã®Webã‚µã‚¤ãƒˆã€Œwww.google.comã€ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰æ”»æ’ƒã‚’è¨±ã™ãœã„å¼±æ€§ãŒå˜åœ¨ã—ã¦ã„ãŸã¨ï¼Œç±³å›½æ™‚é–“12æœˆ21æ—¥ã«ç™ºè¡¨ã—ãŸã€‚Watchfireç¤¾ã¯ã€Œãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°æ”»æ’ƒã«ä½¿ã‚ã‚Œã‚‹æã‚ŒãŒã‚ã£ãŸã€ã¨ã—ã¦ã„ã‚‹ã€‚ ã“ã®ãœã„å¼±æ€§ã¯ï¼Œwww.google.comå†…ã®ã‚¨ãƒ©ãƒ¼è¡¨ç¤ºWebãƒšãƒ¼ã‚¸ã‚’æ‚ªç”¨ã™ã‚‹ã¨ï¼Œæ–‡å—ã‚³ãƒ¼ãƒ‰UTF-7ã«ã‚ˆã£ã¦ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã•ã‚ŒãŸã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã§ãã¦ã—ã¾ã†ã¨ã„ã†ã‚‚ã®ã€‚Watchfireç¤¾ãŒ11æœˆ15æ—¥ã«ç™ºè¦‹ã—ã¦Googleç¤¾ã«å ±å‘Šã—ãŸã€‚Googoleç¤¾ã¯12æœˆ1æ—¥ã«ä¿®æ£ã‚’æ–½ã—ï¼Œç¾åœ¨ã¯è§£æ±ºæ¸ˆã¿ã ã€‚ åŒã‚µã‚¤ãƒˆã«ã¯ï¼ŒWebã‚¢ã‚¯ã‚»ã‚¹è¦æ±‚ã‚’ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã™ã‚‹éš›ã«ç™ºç”Ÿã—ãŸã‚¨ãƒ©ãƒ¼ã‚’è¡¨ç¤ºã™ã‚‹ã€ŒForbiddenã€ï¼ˆ403ã‚¨ãƒ©ãƒ¼ï¼‰ãƒšãƒ¼ã‚¸ã¨ï¼Œå˜åœ¨ã—ãªã„Webãƒšãƒ¼ã‚¸ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã«å¯¾ã™ã‚‹ã‚¨ãƒ©ãƒ¼ã‚’è¡¨ç¤ºã™ã‚‹ã€ŒNot Foundã€ï¼ˆ404ã‚¨ãƒ©ãƒ¼ï¼‰ãƒšãƒ¼ã‚¸
ockeghem 2007/03/05
XSS

google

security

UTF-7
ãƒªãƒ³ã‚¯
ã€ŒGoogle Search Applianceã€ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§
ç±³å›½ç«‹æ¨™æº–æŠ€è¡“ç ”ç©¶æ‰€ï¼ˆNISTï¼šNational Institute of Standards and Techno logyï¼‰ã¯ç¾åœ°æ™‚é–“11æœˆ26æ—¥ï¼Œç±³Googleã®æ¤œç´¢ã‚¢ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ã€ŒGoogle Search Applianceã€ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã®è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã“ã¨ã‚’æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºãªã©ã«æ‚ªç”¨ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ã¨ã„ã†ã€‚ Google Search Applianceã¨ã¯ï¼Œãƒãƒ¼ãƒ‰ã‚¦ã‚¨ã‚¢ã¨æ¤œç´¢ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã‚’çµ„ã¿åˆã‚ã›ãŸã‚¢ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹è£½å“ã€‚ã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆã‚„å¤–éƒ¨å‘ã‘Webã‚µã‚¤ãƒˆå†…ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ã‚¤ãƒ³ãƒ‡ãƒƒã‚¯ã‚¹åŒ–ã—ã¦ï¼ŒGoogleã‚µã‚¤ãƒˆã§æä¾›ã•ã‚Œã¦ã„ã‚‹æ¤œç´¢ã‚¨ãƒ³ã‚¸ãƒ³ã¨åŒç‰ã®æ¤œç´¢æ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã€‚ NISTã§ã¯è„†å¼±æ€§ã®è©³ç´°ã‚’æ˜Žã‚‰ã‹ã«ã—ã¦ã„ãªã„ãŒï¼ŒUTF-7ã§ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã•ã‚ŒãŸæ–‡å—ã®å‡¦ç†ã«å•é¡ŒãŒã‚ã‚‹ã¨ã„ã†ã€‚ã“ã®ãŸã‚ï¼Œç´°å·¥ãŒæ–½ã•ã‚ŒãŸãƒªãƒ³ã‚¯ã‚’ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ï¼ŒGo
ockeghem 2006/11/30
XSSè„†å¼±æ€§ã¯ä¸ã€…ãªããªã‚Šã¾ã›ã‚“ãã‡ã€‚ä»Šå›žã®RTF-7ã«ã¾ã¤ã‚ã‚‹XSSã¯ä»¥å‰Googleã‚µã‚¤ãƒˆã§ã‚‚å ±å‘Šã•ã‚ŒãŸã‚‚ã®ã§ã€ãã®çµŒé¨“ãŒæ´»ã‹ã•ã‚Œã¦ãªã„ã®ãŒæ®‹å¿µã§ã™ã€‚XSSæ‚ªç”¨ãƒ‘ã‚¿ãƒ¼ãƒ³ã¨ã—ã¦ã®ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã¯ç±³å›½ã§ã¯å®šç€ã—ã¦ã„ã‚‹ã®ã‹ãªã€‚

Google

UTF-7

XSS
ãƒªãƒ³ã‚¯
1