[B! xss] youheyã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

youhey id:youhey

xssã«é–¢ã™ã‚‹youheyã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

1åˆ†ã§ã‚ã‹ã‚‹ã€ŒX-ãƒŠãƒ³ãƒˆã‚«ã€HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ - è‘‰ã£ã±æ—¥è¨˜
æœ€è¿‘ã®ãƒ¢ãƒ€ãƒ³ãªWebãƒ–ãƒ©ã‚¦ã‚¶ãŒã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢é€£ã—ãã†ãª X- ãªHTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ãã‚Œä»¥å¤–ã«ã‚‚ã‚ã£ãŸã‚‰æ•™ãˆã¦ãã ã•ã„ã€‚ X-XSS-Protection 0:XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’ç„¡åŠ¹ã«ã™ã‚‹ã€‚ 1:XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’æœ‰åŠ¹ã«ã™ã‚‹ã€‚ XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’æœ‰åŠ¹ã«ã™ã‚‹ã“ã¨ã§ã‚¨ãƒ³ãƒ‰ãƒ¦ãƒ¼ã‚¶ãŒXSSã®è¢«å®³ã«ã‚ã†å¯èƒ½æ€§ãŒä½Žæ¸›ã™ã‚‹ãŒã€ã¾ã‚Œã«èª¤æ¤œçŸ¥ã™ã‚‹ã“ã¨ã§ç”»é¢ã®è¡¨ç¤ºãŒä¹±ã‚Œã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã€‚IE8+ã€Safariã€Chrome(å¤šåˆ†) ã§æœ‰åŠ¹ã€‚IEã§ã¯ã€ŒX-XSS-Protection: 1; mode=blockã€ã¨ã„ã†æŒ‡å®šã‚‚å¯èƒ½ã€‚ 2008/7/2 - IE8 Security Part IV: The XSS FilterBug 27312 â€“ [XSSAuditor] Add support for header X-XSS-Protection X-Content-Ty
youhey 2011/01/08
HTTP

security

xss

IE

browser
ãƒªãƒ³ã‚¯
ï¼»ç„¡è¦–ã§ããªã„ï¼½IEã®Content-Typeç„¡è¦–
ï¼»ç„¡è¦–ã§ããªã„ï¼½IEã®Content-Typeç„¡è¦–ï¼šæ•™ç§‘æ›¸ã«è¼‰ã‚‰ãªã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆ2ï¼‰ï¼ˆ1/2 ãƒšãƒ¼ã‚¸ï¼‰ XSSã«CSRFã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«â€¦â€¦Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ãƒ—ãƒã‚°ãƒ©ãƒžãŒçŸ¥ã£ã¦ãŠãã¹ãè„†å¼±æ€§ã¯ã„ã£ã±ã„ã‚ã‚Šã¾ã™ã€‚ãã“ã§æœ¬é€£è¼‰ã§ã¯ã€ãã®ã‚ˆã†ãªãƒ¡ã‚¸ãƒ£ãƒ¼ãªã‚‚ã®â€œä»¥å¤–â€ã‚‚æŽ˜ã‚Šä¸‹ã’ã¦ã„ãã¾ã™ï¼ˆç·¨é›†éƒ¨ï¼‰ ç„¡è¦–ã§ããªã„IEã®ã€ŒContent-Typeç„¡è¦–ã€å•é¡Œ çš†ã•ã‚“ã“ã‚“ã«ã¡ã¯ã€ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ã§ã™ã€‚ ç¬¬2å›žã§ã¯ã€Internet Explorerï¼ˆä»¥ä¸‹ã€IEï¼‰ã®ä»•æ§˜ã§ã‚‚ç‰¹ã«æ‚ªåé«˜ã„ã€ŒContent-Typeç„¡è¦–ã€ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ IEã®Content-Typeç„¡è¦–å•é¡Œã¯éžå¸¸ã«è¤‡é›‘ã§ã€ç§è‡ªèº«ã‚‚å®Œå…¨ã«èª¬æ˜Žã§ãã‚‹è‡ªä¿¡ã¯ãªã„ã®ã§ã™ãŒã€ãã‚Œã§ã‚‚ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã†ãˆã§é¿ã‘ã¦ã¯é€šã‚Œãªã„å•é¡Œã§ã™ã®ã§ã€å–ã‚Šä¸Šã’ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚
youhey 2011/01/08
IEã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—æ±ºå®šãƒã‚¸ãƒƒã‚¯ã€IEã§Content-typeãŒç„¡è¦–ã•ã‚Œã‚‹ç†ç”±ï¼ã€IEã®Content-Typeç„¡è¦–ãŠã‚ˆã³ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—æ±ºå®šã®å‡¦ç†ã¯éžå¸¸ã«è¤‡é›‘æ€ªå¥‡

IE

xss

security
ãƒªãƒ³ã‚¯
X-Content-Type-Options: nosniff ã¤ã‹ã‚ãªã„ã‚„ã¤ã¯æ»ãã°ã„ã„ã®ã«! - è‘‰ã£ã±æ—¥è¨˜
2011-01-06: IE8ã¨ã„ã†ã“ã¨ã‚’è¿½è¨˜ & ã¡ã‚‡ã£ã¨é–“é•ã„ã‚’ä¿®æ£ã€‚ã‚ã‘ã¾ã—ã¦ãŠã‚ã§ã¨ã†ã”ã–ã„ã¾ã™ã€‚ å¹´æ˜Žã‘æ—©ã€…ã§ã™ãŒã€Internet Explorerã®è©±é¡Œã§ã™ã€‚IEã¯ã”å˜ã˜ã®é€šã‚Šã€Content-Type ã ã‘ã§ãªãã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®å†…å®¹ãªã©ã‚‚ sniff ã™ã‚‹ã“ã¨ã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã‚’æ±ºå®šã—ã¦ã„ã‚‹ãŸã‚ã€ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã‚„ãƒ†ã‚ã‚¹ãƒˆãƒ•ã‚¡ã‚¤ãƒ«ã‚’HTMLã¨åˆ¤å®šã—ã¦ã—ã¾ã„ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒæ˜”ã‹ã‚‰ãŸã³ãŸã³å ±å‘Šã•ã‚Œã¦ã„ã¾ã—ãŸ*1ã€‚ç¾åœ¨ã¯å¹¾åˆ†ãƒžã‚·ã«ãªã£ãŸã¨ã¯ã„ãˆã€IEã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã®åˆ¤å®šã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã¯éžå¸¸ã«é›£è§£ã§ã‚ã‚Šã€ç¾åœ¨ã§ã‚‚çŠ¶æ³ã«ã‚ˆã£ã¦ã¯Webã‚µã‚¤ãƒˆé‹å–¶è€…ã®ã¾ã£ãŸãæ„å›³ã—ã¦ã„ãªã„ã‹ãŸã¡ã§ã®XSSãŒç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ãŒã‚ã£ãŸã‚Šã—ã¾ã™ã€‚ãã†ã„ã†ã‚ã‘ã§ã€IEãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ sniff ã—ã¦HTMLä»¥å¤–ã®ã‚‚ã®ã‚’HTMLæ‰±ã„ã—ã¦ã—ã¾ã†ã“ã¨ã‚’é˜²ããŸã‚ã«ã€å‹•çš„ã«ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆã«
youhey 2011/01/08
IEãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ sniff ã—ã¦HTMLä»¥å¤–ã®ã‚‚ã®ã‚’HTMLæ‰±ã„ã—ã¦ã—ã¾ã†ã“ã¨ã‚’é˜²ããŸã‚ã«ã€å‹•çš„ã«ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆã«ã¯ã€ã¨ã«ã‹ãã‚ã‚‰ã‚†ã‚‹ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã« X-Content-Type-Options: nosniff ã‚’ä»˜ä¸Žã™ã‚‹ã‚ˆã†ã«ã—

HTML

IE

xss

security
ãƒªãƒ³ã‚¯
XSS (Cross Site Scripting) Cheat Sheet
XSS (Cross Site Scripting) Cheat Sheet Esp: for filter evasion By RSnake Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to
youhey 2010/05/11
XSSã®å…·ä½“çš„ãªå®Ÿä¾‹ã‚µãƒ³ãƒ—ãƒ«é›†

Security

xss

cheatsheet
ãƒªãƒ³ã‚¯
1