[B! xss][web] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

xssã¨webã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Twitterãƒ¯ãƒ¼ãƒ ä½œæˆè€…ã®å°‘å¹´ã€5ç•ªç›®ã®ãƒ¯ãƒ¼ãƒ ã‚’åºƒã‚ã‚‹
å…ˆé€±Twitterã‚’è¥²ã£ãŸãƒ¯ãƒ¼ãƒ ã®ä½œæˆè€…ã ã¨ä¸»å¼µã™ã‚‹10ä»£å°‘å¹´ã«ã‚ˆã‚‹ã¨ã€å½¼ã¯ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºä¼æ¥ã¸ã®å°±è·ã‚’æ±ºã‚ã€ç±³å›½æ™‚é–“4æœˆ17æ—¥ã€Twitterã«5ç•ªç›®ã¨ãªã‚‹ãƒ¯ãƒ¼ãƒ ã‚’è§£ãæ”¾ã£ãŸã¨ã„ã†ã€‚ Twitterã¯å…ˆã€…é€±æœ«ã‹ã‚‰4æœˆ13æ—¥ã«ã‹ã‘ã¦ã€4å›žã«æ¸¡ã‚‹ãƒ¯ãƒ¼ãƒ æ”»æ’ƒã‚’æ’ƒé€€ã—ãŸã€‚ã“ã®ãƒ¯ãƒ¼ãƒ ã¯ã€æ„ŸæŸ“ã—ãŸTwitterã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®æ‰€æœ‰è€…ã®åå‰ã‚„ç”»åƒã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã ã‘ã§ã€ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚‚æ„ŸæŸ“ã—ã¦ã—ã¾ã†ã¨ã„ã†ã‚‚ã®ã ã£ãŸã€‚ã“ã®æ–¹æ³•ã§æ„ŸæŸ“ã‚’æ‹¡å¤§ã—ã€ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ãƒšãƒ¼ã‚¸ã‚’æ”¹ã–ã‚“ã™ã‚‹ã“ã¨ä»¥å¤–ã«ã€ã“ã®ãƒ¯ãƒ¼ãƒ ã«å®³ã¯ãªã„ã‚ˆã†ã ã£ãŸã€‚ ãƒ‹ãƒ¥ãƒ¼ãƒ¨ãƒ¼ã‚¯å·žãƒ–ãƒ«ãƒƒã‚¯ãƒªãƒ³ã«ä½ã‚€17æ³ã®Michael Mooneyå›ã¯CNET Newsã«å¯¾ã—ã€é€€å±ˆã—ã®ãŽã¨ã—ã¦Twitterã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ã®å˜åœ¨ã‚’çŸ¥ã‚‰ã›ã‚ˆã†ã¨æ€ã„ã€ãƒ¯ãƒ¼ãƒ ã‚’ä½œæˆã—ãŸã¨èªžã£ãŸã€‚ Mooneyå›ã¯ã€ã‚ªãƒ¬ã‚´ãƒ³å·žãƒãƒ¢ãƒ³ãƒ‰ã«æ‹ ç‚¹ã‚’ç½®ãExqSoftã®å‰µæ¥è€…ã§ã‚ã‚‹Travi
ockeghem 2009/04/21
ã€Žã—ã‹ã—ã€åƒ•ãŒTwitterã«è„†å¼±æ€§ã‚’ä¿®å¾©ã™ã‚‹ã‚ˆã†ã«ä¿ƒã™ã«ã¯ã€ã“ã†ã™ã‚‹ã—ã‹ãªã‹ã£ãŸã€<ã“ã†ã„ã†è¨€ã„åˆ†ã‚’èªã‚ã‚‹ã¨ã€ãªã‚“ã§ã‚‚ã€Œâ—‹â—‹ã™ã‚‹ã«ã¯â–³â–³ã™ã‚‹ã—ã‹ãªã‹ã£ãŸã€ã¨ã„ã†ã“ã¨ã«/ã“ã‚Œã§æ—¥æœ¬ã®äººãŸã¡ã‚‚XSSã®è„…å¨ã‚’èªè˜ã—ãŸã‹ãª

security

twitter

web

xss
ãƒªãƒ³ã‚¯
ã¾ã™ã¾ã™è†¨ã‚‰ã‚€Web 2.0ã®å±é™º
ç±³ã‚¢ãƒƒãƒ—ãƒ«ã‹ã‚‰æºå¸¯AVãƒ—ãƒ¬ãƒ¼ãƒ¤ãƒ¼ã®ã€ŒiPod touchã€ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸã€‚2æœ¬ã®æŒ‡ã§ã‚¿ãƒƒãƒãƒ‘ãƒãƒ«ã‚’æ“ä½œã™ã‚‹ãƒ¦ãƒ‹ãƒ¼ã‚¯ãªãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒ»ã‚¤ãƒ³ã‚¿ãƒ•ã‚§ãƒ¼ã‚¹ã¯ï¼Œå¤šãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®é–¢å¿ƒã‚’é›†ã‚ã¦ã„ã‚‹ã€‚iPod touchã«ã¯ç„¡ç·šLANæ©Ÿèƒ½ã‚‚æè¼‰ã•ã‚Œï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯Webã‚¢ã‚¯ã‚»ã‚¹ã«ã‚‚iPod touchã‚’åˆ©ç”¨ã§ãã‚‹ã€‚ ã“ã†ã—ãŸãƒ‡ãƒã‚¤ã‚¹ã®é€²åŒ–ã«ã‚ˆã£ã¦Webã¯æ—¥å¸¸ç”Ÿæ´»ã«ã¾ã™ã¾ã™æµ¸é€ã™ã‚‹ã®ã ã‚ã†ãŒï¼Œãã‚Œã¯åŒæ™‚ã«ï¼ŒWebçµŒç”±ã®æ”»æ’ƒã®å½±éŸ¿ç¯„å›²ã‚‚åºƒãŒã‚‹ã“ã¨ã‚’æ„å‘³ã™ã‚‹ã€‚WebçµŒç”±ã®æ”»æ’ƒæŠ€è¡“ã¯æ—¥ã€…å·§å¦™åŒ–ã—ï¼ŒWebã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«å«ã¾ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã®ä¿¡æ†‘æ€§ãŒå•ã‚ã‚Œã‚‹å ´é¢ã¯å°‘ãªããªã„ã€‚å…¸åž‹ä¾‹ãŒä»Šå¹´6æœˆã«ä¸–ç•Œçš„ã«è¢«å®³ãŒåºƒãŒã£ãŸMPackã€‚ä¸€èˆ¬ã®Webã‚µã‚¤ãƒˆã«iframeã‚¿ã‚°ãŒåŸ‹ã‚è¾¼ã¾ã‚ŒãŸã€‚ä¸€èˆ¬ã®ãƒ–ãƒã‚°ã‚„SNSï¼ˆsocial networking serviceï¼‰ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚‚ï¼Œå¿…ãšã—ã‚‚ä¿¡é ¼ã§ãã‚‹ã¨ã¯é™ã‚‰ãªã„ã€‚ ã—ã‹ã‚‚è§£æ±ºç–ã¯ä¸ååˆ†ã€‚ã‚¼ãƒãƒ‡ã‚¤æ”»
ockeghem 2007/12/17
XSIOã¯æ”»æ’ƒæ‰‹æ³•ã«ç€ç›®ã—ãŸå‘½åã§ã€åŽŸå› ã¯XSSã¨åŒã˜è¡¨ç¤ºæ™‚ã®ãƒ¡ã‚¿æ–‡å—ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¼ã‚Œã€‚ã¨ã™ã‚‹ã¨ã€XSSã«ã‚ˆã‚‹ç”»é¢æ”¹å¤‰&ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã‚‚åˆ¥ã®åå‰ã«ã—ãªã„ã¨ã„ã‘ãªã„ã“ã¨ã«ãªã‚‹

xsio

security

web

xss
ãƒªãƒ³ã‚¯
Error Messageã«ãŠã‘ã‚‹æœ€ã‚‚ã‚·ãƒ³ãƒ—ãƒ«ãªXSSå›žé¿æ³• : 404 Blog Not Found
2006å¹´12æœˆ02æ—¥04:30 ã‚«ãƒ†ã‚´ãƒªLightweight Languages Error Messageã«ãŠã‘ã‚‹æœ€ã‚‚ã‚·ãƒ³ãƒ—ãƒ«ãªXSSå›žé¿æ³• 404 Blog Not Found:perl+javascript - ã¯ã¦ãƒ–ã¨çŸç¸®URLã®Mashupã®ãƒã‚°ãƒ•ã‚£ãƒƒã‚¯ã‚¹ã€‚ æŠ€è¡“ãƒ¡ãƒ¢å¸³ - dankogaiã•ã‚“ã®ã‚¢ãƒ—ãƒªã®XSS ã‚¨ãƒ©ãƒ¼ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºåŠ›ã™ã‚‹ã¨ãã« HTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒã•ã‚Œã¦ãªã‹ã£ãŸã€‚ è¦‹è½ã¨ã™ã¨ã“ã‚ã ã£ãŸã€‚ã“ã†ã„ã†å ´åˆã¯ã€TBãªã„ã—Commentãªã©ã€å…ƒè¨˜äº‹ã‹ã‚‰ç›´æŽ¥è¦‹ãˆã‚‹å½¢ã§å ±å‘Šã—ã¦æ¬²ã—ã„ã€‚ ãã‚‚ãã‚‚text/htmlã¨ã—ã¦è§£é‡ˆã•ã‚Œã¦ã„ã‚‹ã®ã¯ãŠã‹ã—ã„ã¨æ€ã£ã¦headerã‚’è¦‹ãŸã‚‰ã€ % HEAD 'http://u.dan.co.jp/r.cgi/<script>alert('easy%20xss');</script>' 500 Internal Server Error Co
ockeghem 2007/06/25
ç°¡æ˜“æ³•ã«ãŸã‚ˆã‚‹ã‚ˆã‚Šã€ã¡ã‚ƒã‚“ã¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ãŸã»ã†ãŒçµå±€ã¯æ¥½ãªã‚ˆã†ãªæ°—ãŒã—ã¾ã™ã‘ã©ã

xss

web

security
ãƒªãƒ³ã‚¯
ã€Œæ‹¡å¼µåã§ã¯ãªãã€å†…å®¹ã«ã‚ˆã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãã“ã¨ã€ã®æ‹¡å¼µåã¯ Content-Type ã§ã¯ãªã„ã“ã¨ã«æ³¨æ„ - è‘‰ã£ã±æ—¥è¨˜
å°‘ã—å‰ã« JSONP ãŒ XSS ã‚’å¼•ãèµ·ã“ã™ã‹ã‚‚ã—ã‚Œãªã„ã¨ã„ã†ç‚¹ã«é–¢ã™ã‚‹èˆˆå‘³æ·±ã„è¨˜äº‹ã‚’å¥¥ã•ã‚“ãŒæ›¸ã‹ã‚Œã¦ã„ã¾ã—ãŸã€‚ Kazuho@Cybozu Labs: JSONP - ãƒ‡ãƒ¼ã‚¿æä¾›è€…å´ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ JSONP ã«ãŠã‘ã‚‹ Padding éƒ¨åˆ†(ã ã‘ã§ãªãJSONéƒ¨åˆ†ã‚‚ã€‚4/5è¿½è¨˜)ã«æ”»æ’ƒè€…ãŒ HTML ã¨è§£é‡ˆå¯èƒ½ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’æ³¨å…¥ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€JSONP ãªãƒ‡ãƒ¼ã‚¿ã‚’ç›´æŽ¥ IE ã§é–‹ã„ãŸå ´åˆã« HTML ã¨è§£é‡ˆã•ã‚Œ XSS ãŒç™ºç”Ÿã™ã‚‹ã€ã¨ã„ã†ç‚¹ã«ã¤ã„ã¦æ›¸ã‹ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã“ã§ã€IE ãŒ JSONP ã‚’ HTML ã¨è§£é‡ˆã™ã‚‹ç†ç”±ã¯ä»¥ä¸‹ã®2ç‚¹ã€‚ IEã®ã‚ˆãçŸ¥ã‚‰ã‚ŒãŸæ©Ÿèƒ½ã€Œæ‹¡å¼µåã§ã¯ãªãã€å†…å®¹ã«ã‚ˆã£ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãã“ã¨ã€ã«ã‚ˆã‚Šã€å†…å®¹ãŒ HTML ã£ã½ã„å ´åˆã«ã¯ã€Content-Type: text/javascript ãŒç„¡è¦–ã•ã‚Œ HTML ã¨ã—ã¦è§£é‡ˆã•ã‚Œã‚‹ã€‚ ä¸Šè¿°ã®è¨å®šãŒã€Œç„¡åŠ¹ã€ã«è¨å®š
ockeghem 2007/05/23
json

jsonp

security

web

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1