[B! xss] perezvonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

perezvon id:perezvon

xssã«é–¢ã™ã‚‹perezvonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (13)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§Markdownã‚’å®‰å…¨ã«å±•é–‹ã™ã‚‹ - è‘‰ã£ã±æ—¥è¨˜
ä¸ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå…¥åŠ›ã—ãŸMarkdownã‚’ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§JavaScriptã‚’ä½¿ã£ã¦HTMLã«å¤‰æ›ã™ã‚‹ã¨ã„ã†å ´é¢ã«ãŠã„ã¦ã¯ã€JavaScriptã§å¤‰æ›ã—ã¦HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã®éƒ½åˆä¸Šã©ã†ã—ã¦ã‚‚DOM-based XSSã®ç™ºç”Ÿã‚’è€ƒãˆãªã„ã‚ã‘ã«ã¯ã„ã‹ãªã„ã€‚ã‹ã¨ã„ã£ã¦ã€Markdownã‚’ãƒ‘ãƒ¼ã‚¹ã—HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã™ã¹ã¦ã‚’XSSãŒå˜åœ¨ã—ãªã„ã‚ˆã†ã«æ³¨æ„ã—ãªãŒã‚‰è‡ªåˆ†ã§æ›¸ãã®ã‚‚å¤§å¤‰ã ã—ã€markedã‚„markdown-jsãªã©ã®æ—¢å˜ã®å¤‰æ›ç”¨ã®JSã‚’æŒã£ã¦ãã¦ã‚‚ãã‚Œã‚‰ãŒXSSã—ãªã„ã‹ã‚’ç¢ºèªã™ã‚‹ã®ã¯çµæ§‹å¤§å¤‰ã ã£ãŸã‚Šã™ã‚‹ã€‚ ãã†ã„ã£ãŸå ´åˆã«ã¯ã€Markdownã‹ã‚‰ç”Ÿæˆã•ã‚ŒãŸHTMLã‚’RickDOMã‚’é€šã™ã“ã¨ã§ã€ä¸‡ãŒä¸€HTMLå†…ã«JavaScriptãŒå«ã¾ã‚Œã¦ã„ãŸã¨ã—ã¦ã‚‚ãã‚Œã‚‰ã‚’é™¤å¤–ã—ã€è¨±å¯ã•ã‚ŒãŸè¦ç´ ã€è¨±å¯ã•ã‚ŒãŸå±žæ€§ã ã‘ã§æ§‹ç¯‰ã•ã‚ŒãŸå®‰å…¨ãªHTMLã«å†æ§‹ç¯‰ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ã•ã‚‰ã«ã€ãã†ã‚„ã£ã¦ç”Ÿæˆ
perezvon 2015/03/08
security

xss

markdown
ãƒªãƒ³ã‚¯
Locking the Throneroom 2.0
This document summarizes Mario Heiderich's presentation titled "Locking the Throne Room - How ES5+ will change XSS and Client Side Security" given at BlueHat, Redmond 2011. The presentation discusses how new features in ECMAScript 5 (ES5), such as Object.defineProperty(), can be used to prevent cross-site scripting (XSS) attacks by locking down access to sensitive DOM properties and methods on the
perezvon 2012/08/05
javascript

security

xss
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
perezvon 2012/07/20
javascript

cookie

security

xss
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
perezvon 2012/07/20
jquery

xss

security
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
perezvon 2012/07/20
jquery

xss

security
ãƒªãƒ³ã‚¯
HTML5 Security Cheatsheet
HTML5 Security CheatsheetWhat your browser does when you look away...
perezvon 2012/02/16
html

security

xss
ãƒªãƒ³ã‚¯
DOM based XSS Prevention - OWASP Cheat Sheet Series
Introduction Index Alphabetical Index ASVS Index MASVS Index Proactive Controls Index Top 10 Cheatsheets DOM based XSS Prevention Cheat SheetÂ¶ IntroductionÂ¶ When looking at XSS (Cross-Site Scripting), there are three generally recognized forms of XSS: Reflected or Stored DOM Based XSS. The XSS Prevention Cheatsheet does an excellent job of addressing Reflected and Stored XSS. This cheatsheet addre
perezvon 2012/02/02
javascript

security

xss
ãƒªãƒ³ã‚¯
ãƒ„ãƒƒã‚³ãƒŸ hideden (2009-08-06 12:45) - å¾³ä¸¸æµ©ã®æ—¥è¨˜ - i-mode2.0ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æ¤œè¨Ž - æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã¯ãŠã™ã¿ã§ã™ã‹? é–‹ç™ºé–‹å§‹æ™‚ç‚¹ã‹ã‚‰ã®ã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°ã‹ã‚‰ã€å…¬é–‹æ¸ˆã¿Webã‚µã‚¤ãƒˆã®è„†å¼±æ€§æ¤œæŸ»ã€ è„†å¼±æ€§ç™ºè¦‹å¾Œã®é©åˆ‡ãªå¯¾ç–ã¾ã§ â—æºå¸¯JavaScriptã¨XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã®å¯èƒ½æ€§ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€æºå¸¯é›»è©±ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«æè¼‰ã•ã‚ŒãŸJavaScriptã¨ã€Webã‚µã‚¤ãƒˆã®XSSã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€ã„ã‚ã‚†ã‚‹ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã«å¯¾ã™ã‚‹ä¸æ£ãƒã‚°ã‚¤ãƒ³ã®å¯èƒ½æ€§ã«ã¤ã„ã¦æ¤œè¨Žã™ã‚‹ã€‚ 5æœˆ28ã«ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã«æ›¸ã„ãŸæ—¥è¨˜ã€Œi-mode2.0ã¯å‰é€”å¤šé›£ã€ã«ã¦ã€ä»Šå¹´ã®NTTãƒ‰ã‚³ãƒ¢ã®å¤ãƒ¢ãƒ‡ãƒ«P-07Aã«ã¦JavaScriptæ©Ÿèƒ½ãŒåˆ©ç”¨åœæ¢ã•ã‚ŒãŸã“ã¨ã‚’æŒ‡æ‘˜ã—ãŸã€‚åŒæ—¥ä»˜ã®NTTãƒ‰ã‚³ãƒ¢ç¤¾ã®ãƒªãƒªãƒ¼ã‚¹ã«ã‚ˆã‚‹ã¨ã€ã€Œã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢æ›´æ–°ã«ä¼´ã„ã€é«˜åº¦åŒ–ã—ãŸæ©Ÿèƒ½ã®ä¸€éƒ¨ã‚’ã”åˆ©ç”¨ã„ãŸã ã‘ãªããªã£ã¦ã„ã¾ã™ãŒã€å†ã³ã”åˆ©ç”¨ã„ãŸã ã‘ã‚‹ã‚ˆã†é€Ÿã‚„ã‹ã«å¯¾å‡¦ã„ãŸã—ã¾ã™ã€ã¨ã‚ã£ãŸãŒã€ãã‚Œä»¥
perezvon 2009/08/06
mobile

security

xss

javascript

docomo
ãƒªãƒ³ã‚¯
IE8ã®XSSãƒ•ã‚£ãƒ«ã‚¿ãŒè£ç›®ã«å‡ºã‚‹ä¾‹ - 2009-06-22 - T.Teradaã®æ—¥è¨˜
IE8ã®XSSãƒ•ã‚£ãƒ«ã‚¿ã¯ã€Webã‚¢ãƒ—ãƒªã«XSSè„†å¼±æ€§ãŒã‚ã£ãŸã¨ã—ã¦ã‚‚ã€ãã‚ŒãŒç™ºå‹•ã™ã‚‹å¯èƒ½æ€§ã‚’æ¸›ã‚‰ã—ã¦ãã‚Œã‚‹ã‚‚ã®ã§ã™ã€‚ ã—ã‹ã—ã€ãã®XSSãƒ•ã‚£ãƒ«ã‚¿ãŒè£ç›®ã«å‡ºã‚‹ã‚ˆã†ãªã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ ä¾‹ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªé™çš„ãªHTMLãƒ•ã‚¡ã‚¤ãƒ«ï¼ˆtest.htmlï¼‰ã‚’ä½œã£ã¦Webã‚µãƒ¼ãƒã«ãŠãã¾ã™ã€‚ <h3>ie8 test</h3>  <script> var u=document.URL; </script>  <script> u=u.replace(/&/g,'&').replace(/</g,'<'); </script>  <script> document.write('URL:'+u); </script> ä¸Šã®ãƒšãƒ¼ã‚¸ã¯é™çš„ãªãƒšãƒ¼ã‚¸ã§ã€DOM Based XSSã®è„†å¼±æ€§ã‚‚ã‚ã‚Šã¾ã›ã‚“ã€‚ã§ã™ãŒã€è¢«å®³è€…ã®ãƒ¦ãƒ¼ã‚¶ãŒIE8ã‚’ä½¿ã£ã¦ã„ã‚‹
perezvon 2009/06/22
security

xss

javascript

ie
ãƒªãƒ³ã‚¯
ç¬¬7å›žâ– æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒç”Ÿã¿å‡ºã™ãœã„å¼±æ€§ã‚’çŸ¥ã‚‹
æ–‡å—ã‚³ãƒ¼ãƒ‰ã«é–¢ã™ã‚‹å•é¡Œã¯å¤§åˆ¥ã™ã‚‹ã¨æ–‡å—é›†åˆã®å•é¡Œã¨æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®å•é¡Œã«åˆ†é¡žã§ãã‚‹ã€‚å‰å›žã¯æ–‡å—é›†åˆã®å–ã‚Šæ‰±ã„ã«èµ·å› ã™ã‚‹ãœã„å¼±æ€§ã«ã¤ã„ã¦èª¬æ˜Žã—ãŸã®ã§ã€ä»Šå›žã¯æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«èµ·å› ã™ã‚‹ãœã„å¼±æ€§ã«ã¤ã„ã¦èª¬æ˜Žã—ã‚ˆã†ã€‚ æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«ä¾å˜ã™ã‚‹å•é¡Œã‚’ã•ã‚‰ã«åˆ†é¡žã™ã‚‹ã¨2ç¨®é¡žã‚ã‚‹ã€‚ï¼ˆ1ï¼‰æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã¨ã—ã¦ä¸æ£ãªãƒ‡ãƒ¼ã‚¿ã‚’ç”¨ã„ã‚‹ã¨æ”»æ’ƒãŒæˆç«‹ã—ã¦ã—ã¾ã†ç‚¹ã¨ï¼Œï¼ˆ2ï¼‰æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®å‡¦ç†ãŒä¸ååˆ†ãªãŸã‚ã«ãœã„å¼±æ€§ãŒç”Ÿã˜ã‚‹ã“ã¨ãŒã‚ã‚‹ç‚¹ã ã€‚ ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ï¼ˆ1ï¼‰â€•â€•å†—é•·ãªUTF-8ç¬¦å·åŒ–å•é¡Œ ã¾ãšï¼Œï¼ˆ1ï¼‰ã®ä¸æ£ãªæ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã®ä»£è¡¨ã¨ã—ã¦ï¼Œå†—é•·ãªUTF-8ç¬¦å·åŒ–å•é¡Œã‹ã‚‰èª¬æ˜Žã—ã‚ˆã†ã€‚å‰ã€…å›žã«è§£èª¬ã—ãŸUTF-8ã®ãƒ“ãƒƒãƒˆãƒ»ãƒ‘ã‚¿ãƒ¼ãƒ³ï¼ˆè¡¨1ã«å†æŽ²ï¼‰ã‚’è¦‹ã‚‹ã¨ï¼Œã‚³ãƒ¼ãƒ‰ãƒ»ãƒã‚¤ãƒ³ãƒˆã®ç¯„å›²ã”ã¨ã«ãƒ“ãƒƒãƒˆãƒ»ãƒ‘ã‚¿ãƒ¼ãƒ³ãŒå‰²ã‚Šå½“ã¦ã‚‰ã‚Œã¦ã„ã‚‹ãŒï¼Œãƒ“ãƒƒãƒˆãƒ»ãƒ‘ã‚¿ãƒ¼ãƒ³ä¸Šã¯ï¼Œã‚ˆã‚Šå¤šãã®ãƒã‚¤ãƒˆæ•°ã‚’ä½¿ã£ã¦ã‚‚åŒã˜ã‚³ãƒ¼
perezvon 2009/03/03
xss

security

charset
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
perezvon 2007/12/03
security

csrf

xss
ãƒªãƒ³ã‚¯
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
perezvon 2006/09/25
security

xss
ãƒªãƒ³ã‚¯
Google Sites: Sign-in
Not your computer? Use a private browsing window to sign in. Learn more about using Guest mode
perezvon 2006/09/25
xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1