[B! javascript][ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] wata300ã®ãƒ

wata300 id:wata300

javascriptã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹wata300ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

é«˜æœ¨æµ©å…‰ã•ã‚“ã¸ã€ã—ã£ã‹ã‚Šã—ã¦ãã ã•ã„ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼š
æŠ€è¡“è€…ã¨ã—ã¦ã®è‰¯å¿ƒã«å¾“ã£ã¦ã“ã®è¨˜äº‹ã‚’æ›¸ãã¾ã™ã€‚ä¿ºã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã®äººã§ã¯ãªãã€JavaScriptã¨UIã®äººã§ã‚ã‚‹ã€‚æ³•å¾‹ã®å‹‰å¼·ã ã£ã¦è‡ªåˆ†ã®ç”Ÿæ´»ã¨æ¥å‹™ã«é–¢ã‚ã‚Šã®ã‚ã‚‹ç¯„å›²ã§ã—ã‹ã—ãªã„ã ã‚ã†ã€‚ã—ã‹ã—å°‘ãªãã¨ã‚‚JavaScriptã‚„ãƒ–ãƒ©ã‚¦ã‚¶ãŒçµ¡ã‚€ã‚ˆã†ãªéƒ¨åˆ†ã«ã¤ã„ã¦ã¯ã€ç¢ºå®Ÿã«è‡ªåˆ†ã®ã»ã†ãŒç†è§£ã—ã¦ã„ã‚‹ã¨æ€ã£ã¦ã„ã‚‹ã€‚é«˜æœ¨æµ©å…‰ã•ã‚“ãŒã€ã‚ã‹ã‚‰ã•ã¾ã«é–“é•ã£ãŸã“ã¨ã‚’æ›¸ã„ãŸã‚Šã€ãŠã‹ã—ãªã“ã¨ã‚’æ›¸ã„ã¦ã„ãŸã‚Šã—ã¦ã‚‚ã€å¾ã€…ã«èª°ã‚‚æŒ‡æ‘˜ã—ãªããªã£ã¦ããŸã¨æ€ã†ã€‚ãŠã‹ã—ãªã“ã¨æ›¸ã„ã¦ã„ãŸã¨ã—ã¦ã‚‚ã€éžæŠ€è¡“è€…ã‹ã‚‰è¦‹ãŸã¨ãã«ã€Œå¤šå°‘éŽæ¿€ãªç‰©è¨€ã„ã ã‘ã©ã€ã‚ã®äººã¯å°‚é–€å®¶ã ã‹ã‚‰è¨€ã£ã¦ã„ã‚‹ã“ã¨ã¯æ£è«–ãªã®ã ã‚ã†ã€ã¨ã‹ã€ã‚ã‚‹ã„ã¯æŠ€è¡“è€…ã‹ã‚‰è¦‹ãŸæ™‚ã§ã‚‚ã€å°‚é–€åˆ†é‡ŽãŒé•ãˆã°é–“é•ã£ãŸã“ã¨ãŒæ›¸ã‹ã‚Œã¦ã„ã¦ã‚‚æ°—ä»˜ã‘ãªã„ã¨ã„ã†ã“ã¨ã‚‚ã‚ã‚‹ã ã‚ã†ã€‚ ã‚‚ã†è‡ªåˆ†ã«ã¯åˆ†ã‹ã‚‰ãªããªã£ã¦ã„ã‚‹ã€‚èª°ã«ã§ã‚‚æ¤œè¨¼ã§ãã‚‹ã‚ˆã†ãªäº‹å®Ÿé–¢ä¿‚ã®é–“é•ã„ã€ã‚ã‚‹ã„ã¯ã€æŠ€è¡“çš„ãªé–“é•ã„ãŒå«ã¾ã‚Œã¦ã„
wata300 2012/08/30
ç¢ºã‹ã«ã€Œé«˜æœ¨å…ˆç”Ÿã ã‹ã‚‰ã€ã§æ€è€ƒåœæ¢ã—ã¦ãŸéƒ¨åˆ†ã¯ã‚ã£ãŸã‹ã‚‚ã€‚åçœã€‚

é«˜æœ¨æµ©å…‰

Javascript

twitter

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
swfobject.js ãŒã‚¢ãƒ¬ãªè©± - ã»ã‚€ã‚‰ã¡ã‚ƒã»ã‚€ã»ã‚€
ã‚‚ã°ã„ã‚‹å…¨ç››æ„Ÿã®ã‚ã‚‹ä¸–é–“çš„ã«ã¯ä»Šæ›´ï¼ŒFLASH ãªã‚“ã¦ã©ã†ã§ã‚‚ã„ã„ã—ï¼Œswfobject.js è‡ªä½“ 2009å¹´ã‹ã‚‰æ›´æ–°ã•ã‚Œã¦ãªã„ã‹ã‚‰ï¼Œã“ã‚“ãªå¤ã„ã‚‚ã®ã‚’ã¨è¨€ã‚ã‚Œã‹ããªã„ã‚ˆã†ãªè©±ã§ã¯ã‚ã‚‹ã‚‚ã®ã®ï¼Œæ—¥æœ¬èªžã§ã®è¨€åŠã‚’ã‚ã¾ã‚Šè¦‹ã¦ãªã„ã—ï¼Œã¤ã„å…ˆæ—¥ã‚‚ã•ã‚‹é€šä¿¡ã‚ãƒ£ãƒªã‚¢ãŒãƒˆãƒƒãƒ—ãƒšãƒ¼ã‚¸ã§ã‚„ã‚‰ã‹ã—ã¦ã¦å¤šåˆ†çŸ¥ã‚‰ã‚Œã¦ãªã„ã‚“ã ã‚ã†ãªã¨æ€ã£ãŸã®ã§æ›¸ã“ã†ã¨æ€ã£ãŸæ¬¡ç¬¬ï¼Ž swfobject.js ã¨ã¯ä½•ã‹ ã“ã®è¨˜äº‹ã®å¯¾è±¡èªè€…ã«ã¨ã£ã¦ã¯èª¬æ˜Žã™ã‚‹ã¾ã§ã‚‚ãªã„è©±ã¨ã¯ãŠã‚‚ã†ã‘ã©ä¸€å¿œå‰ç½®ãã¨ã—ã¦èª¬æ˜Žã—ã¦ãŠãã¨ï¼Œswfobject.js ã¯ FLASH ã‚’ web ãƒšãƒ¼ã‚¸ã«åŸ‹ã‚è¾¼ã‚€ãŸã‚ã® JavaScript ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªï¼Žã‚¯ãƒã‚¹ãƒ–ãƒ©ã‚¦ã‚¶å¯¾å¿œã—ã¦ãŸã‚Šï¼Œé¢å€’ãª HTML-tag ã®ãŠä½œæ³•ã‚’è¦šãˆãªãã¦ã‚‚è‰¯ããªã£ãŸã‚Šã¨ã§ãƒ‡ãƒ•ã‚¡ã‚¯ãƒˆã‚¹ã‚¿ãƒ³ãƒ€ãƒ¼ãƒ‰ãªæ„Ÿã˜ã®ãƒ¢ãƒŽï¼Ž2007å¹´ã¨ã¡ã‚‡ã„å¤ã„ãŒãƒªã‚¯ãƒ«ãƒ¼ãƒˆMTL ã® SWFObject v2.0 ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆ
wata300 2012/01/12
IT

JavaScript

Flash

swf

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
ç§ã¯ã„ã‹ã«ã—ã¦ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ç«¯æœ«60æ©Ÿç¨®ã®JavaScriptã‚’æ¤œè¨¼ã—ãŸã‹ - ockeghem's blog
æ˜¨æ—¥ã®ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ã®éžå…¬å¼JavaScriptå¯¾å¿œã®èª¿æŸ»çµæžœ | å¾³ä¸¸æµ©ã®æ—¥è¨˜ã§å ±å‘Šã—ãŸã‚ˆã†ã«ã€æ˜¨å¹´5æœˆã«ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯60æ©Ÿç¨®ã®æ¤œè¨¼ã‚’è¡Œã„ã€JavaScriptå¯¾å¿œã®çŠ¶æ³ãªã©ã‚’èª¿æŸ»ã—ã¾ã—ãŸã€‚å½“æ™‚ã¯ã¾ã å…¬å¼ãªJavaScriptå¯¾å¿œæ©Ÿç¨®ã¯ãªã„çŠ¶æ…‹ã§ã—ãŸãŒã€æ—¢ã«ã»ã¨ã‚“ã©ã®ç«¯æœ«ãŒ *éžå…¬å¼ã«* JavaScriptã«å¯¾å¿œã—ã¦ã„ã¾ã—ãŸã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€æ¤œè¨¼ã®æ§˜åã‚’å ±å‘Šã—ã¾ã™ã€‚ ãªãœJavaScriptå¯¾å¿œçŠ¶æ³ã‚’èª¿æŸ»ã—ãŸã‹ http://www.hash-c.co.jp/info/20091124.htmlã‚’å…¬è¡¨ã—ãŸå‰å¾Œã«ã€ã¨ã‚ã‚‹æ–¹ï¼ˆã“ã®æ–¹ï¼‰ã‹ã‚‰ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ã®ã‚±ãƒ¼ã‚¿ã‚¤ã§ã‚‚JavaScriptãŒå‹•ä½œã™ã‚‹ã¨ä¼ºã„ã¾ã—ãŸï¼ˆå‚è€ƒã®ã‚„ã‚Šã¨ã‚Šï¼‰ã€‚XMLHttpRequestã‚‚å«ã‚ã¦JavaScrptãŒå‹•ãã¨æ•™ãˆã¦ã„ãŸã ã„ãŸ932SHã‚’ç§ã‚‚è³¼å…¥ã—ã¦èª¿ã¹ãŸã¨ã“ã‚ã€ä»¥ä¸‹ãŒåˆ¤æ˜Žã—ã¾ã—ãŸã€‚ ç¢ºã‹ã«JavaScrip
wata300 2011/07/06
IT

æŠ€è¡“

ä»•äº‹

ãƒ“ã‚¸ãƒã‚¹

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

JavaScript

ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯
ãƒªãƒ³ã‚¯
XSSã®æ”»æ’ƒæ‰‹æ³•ã„ã‚ã„ã‚ - ã†ãªã®æ—¥è¨˜
html5securityã®ã‚µã‚¤ãƒˆã«ã€XSSã®å„ç¨®æ”»æ’ƒæ‰‹æ³•ãŒã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ã‚‹ã®ã‚’ç™ºè¦‹ã›ã‚Š!ã¨ã„ã†ã“ã¨ã§ã€å€‹äººçš„ã«ã€ŒãŠ!ã€ã¨æ€ã£ãŸæ”»æ’ƒã‚’ã‚µãƒ³ãƒ—ãƒ«ã¤ãã§ã”ç´¹ä»‹ã—ã¾ã™ã€‚ 1. CSS Expression IE7ä»¥å‰ã«ã¯ã€ŒCSS Expressionsã€ã¨ã„ã†æ‹¡å¼µæ©Ÿèƒ½ãŒã‚ã‚Šã€CSSå†…ã§JavaScriptã‚’å®Ÿè¡Œã§ããŸã‚Šã—ã¾ã™ã€‚ <div style="color:expression(alert('XSS'));">a</div> ç¢ºèª @IT -ï¼»æŸ”è»Ÿã™ãŽã‚‹ï¼½IEã®CSSè§£é‡ˆã§èµ·ã“ã‚‹XSS ã§è©³ã—ãè§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€CSSã®è§£é‡ˆãŒæŸ”è»Ÿãªã“ã¨ã¨ã‚‚ã‚ã„ã¾ã£ã¦è‡ªå‰ã§ç„¡å®³åŒ–ã™ã‚‹ã®ã¯ãªã‹ãªã‹å›°é›£ã€‚ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã§ã‚‚ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ <div style="color:expr/* ã‚³ãƒ¡ãƒ³ãƒˆã®æŒ¿å…¥ */ession(alert('XSS'));">a</div> ç¢ºèª <div s
wata300 2010/06/20
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

javascript

ã‚¹ã‚¯ãƒªãƒ—ãƒˆ

IT

æŠ€è¡“
ãƒªãƒ³ã‚¯
ke-tai.org > Blog Archive > Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ã®ä¸€éƒ¨ç«¯æœ«ã«ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã‚’è¨±ã™å•é¡ŒãŒã‚ã‚‹ã¨ã®ã“ã¨ã§ã™
Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ã®ä¸€éƒ¨ç«¯æœ«ã«ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã‚’è¨±ã™å•é¡ŒãŒã‚ã‚‹ã¨ã®ã“ã¨ã§ã™ Tweet 2010/5/24 æœˆæ›œæ—¥ matsui Posted in SoftBank, ãƒ‹ãƒ¥ãƒ¼ã‚¹, è¨˜äº‹ç´¹ä»‹ãƒ»ãƒªãƒ³ã‚¯ | 5 Comments Â» ä»¥å‰ã€ãƒ‰ã‚³ãƒ¢ã®iãƒ¢ãƒ¼ãƒ‰ãƒ–ãƒ©ã‚¦ã‚¶2.0ã®JavaScriptæ©Ÿèƒ½ã¨DNSãƒªãƒã‚¤ãƒ³ãƒ‡ã‚£ãƒ³ã‚°ã¨ã‚’çµ„ã¿åˆã‚ã›ã¦ã€ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³èªè¨¼ã§æˆã‚Šã™ã¾ã—ã‚’è¡Œã†ã¨ã„ã†è„†å¼±æ€§ã‚’ç™ºè¡¨ã—ãŸHASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ã§ã™ãŒã€ä»Šå›žã¾ãŸã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ã®ä¸€éƒ¨ç«¯æœ«ã§ã‚‚åŒæ§˜ã®å•é¡ŒãŒèµ·ãã‚‹ã¨ã„ã†æƒ…å ±ã‚’å…¬é–‹ã—ãŸã‚ˆã†ã§ã™ã€‚ â†’ã€€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ã€€Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ã®ä¸€éƒ¨ç«¯æœ«ã«ã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ãªã‚Šã™ã¾ã—ã‚’è¨±ã™å•é¡Œ [hash-c.co.jp] å½±éŸ¿ãŒã‚ã‚‹æ©Ÿç¨®ã¯2006å¹´å†¬ãƒ¢ãƒ‡ãƒ«ä»¥é™ã¨ãªã£ã¦ã„ã‚‹ã®ã§ã™ãŒã€ãã®å¤šãã¯ã‚µãƒ¼ãƒã‚„ã‚¢ãƒ—ãƒªã§Hostãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã“ã¨ã§
wata300 2010/05/25
Javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æºå¸¯

ãƒ–ãƒ©ã‚¦ã‚¶

ãƒ‹ãƒ¥ãƒ¼ã‚¹
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ã€ŒNoScriptã€ã‚’ã‚„ã‚ã¦ã€ŒRequestPolicyã€ã«ã—ãŸ
â– ã€ŒNoScriptã€ã‚’ã‚„ã‚ã¦ã€ŒRequestPolicyã€ã«ã—ãŸ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å±‹ãŒã€Firefoxãƒ¦ãƒ¼ã‚¶ã«ã€ŒNoScriptã€ã®ä½¿ç”¨ã‚’æŽ¨å¥¨ã™ã‚‹ã“ã¨ãŒã—ã°ã—ã°ã‚ã‚‹ãŒã€ç§ã¯è³›åŒã—ãªã„ã€‚ JPCERT/CCã€æŠ€è¡“ãƒ¡ãƒ¢ã€Œå®‰å…¨ãªWebãƒ–ãƒ©ã‚¦ã‚¶ã®ä½¿ã„æ–¹ã€ã‚’å…¬é–‹, INTERNET Watch, 2008å¹´11æœˆ4æ—¥ *1 æŠ€è¡“ãƒ¡ãƒ¢ âˆ’ å®‰å…¨ãªWebãƒ–ãƒ©ã‚¦ã‚¶ã®ä½¿ã„æ–¹, JPCERT/CC, 2008å¹´11æœˆ4æ—¥ IV. å„ Web ãƒ–ãƒ©ã‚¦ã‚¶ã«å…±é€šã™ã‚‹è¨å®šä¸Šã®æ³¨æ„äº‹é … 1. ã‚¹ã‚¯ãƒªãƒ—ãƒˆç‰ã®å®Ÿè¡Œã‚’åˆ¶é™ã™ã‚‹ JavaScript ç‰ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚„ï¼ˆç•¥ï¼‰ã¯ï¼ˆç•¥ï¼‰Ajax ã«ä»£è¡¨ã•ã‚Œã‚‹ã‚¤ãƒ³ã‚¿ãƒ©ã‚¯ãƒ†ã‚£ãƒ–ãªã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ãŒå®Ÿç¾ã§ãã‚‹ãªã©ã€é«˜ã„åˆ©ä¾¿æ€§ãŒå¾—ã‚‰ã‚Œã¾ã™ã€‚åé¢ã€PC ä¸Šã®é‡è¦ãªãƒ•ã‚¡ã‚¤ãƒ«ã‚’å‰Šé™¤ãƒ»å¤‰æ›´ã™ã‚‹ãªã©ã€æ‚ªæ„ã‚’æŒã£ãŸå‡¦ç†ãŒè¡Œã‚ã‚Œã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚Šã¾ã™ã€‚å¾“ã£ã¦ç„¡åˆ¶é™ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆç‰ã‚’å®Ÿè¡Œã§ãã‚‹ã‚ˆã†ã«ã—ã¦ãŠãã®ã¯
wata300 2009/05/31
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Firefox

Javascript

web
ãƒªãƒ³ã‚¯
1