[B! xss] yuichi0613ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yuichi0613 id:yuichi0613

xssã«é–¢ã™ã‚‹yuichi0613ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€ãƒ¬ãƒãƒ¼ãƒˆã€‘ã¤ã„ã«Twitterã§å¤§è¦æ¨¡ãªãƒ¯ãƒ¼ãƒ è¢«å®³ã€ãã®å½±éŸ¿ã¯? - ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° | ãƒ‘ã‚½ã‚³ãƒ³ | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
21æ—¥ã€æ—¥æœ¬å›½å†…ã§ã‚‚æ§˜ã€…ãªãƒ„ã‚¤ãƒ¼ãƒˆã§ã€Œã†ã‚ã£! ãªã‚“ã ã€ã“ã‚Œ!ã€ã¨ã„ã£ãŸTwitterã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«Webã‚µã‚¤ãƒˆä¸Šã§ã®ç•°å¤‰ãŒå ±å‘Šã•ã‚ŒãŸã€‚å…¬å¼Twitterã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’é€šã˜ã¦ã€ŒXSS(ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°)ã«ã‚ˆã‚‹æ”»æ’ƒã‚’å—ã‘ã¦ã„ã‚‹ã€ã¨ã®æƒ…å ±ãŒã‚‚ãŸã‚‰ã•ã‚ŒãŸãŒã€ç†è€…ãŒãƒ•ã‚©ãƒãƒ¼ã—ã¦ã„ã‚‹äººã€…ã®ãªã‹ã«ã¯ãã®è¢«å®³ã«ã‚ã‚ã‚ŒãŸæ–¹ã‚‚ã„ãŸã€‚ ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚°ã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹æƒ…å ±ã‹ã‚‰ã€"ã“ã‚Œã¯!"ã¨å”¸ã‚‹ã‚ˆã†ãªãƒˆãƒ”ãƒƒã‚¯ã‚’ä¸å¿ƒã«ç´¹ä»‹ã—ã¦ã„ã‚‹ç‰¹åˆ¥ä¼ç”»ã‚‚ä½µã›ã¦ãƒã‚§ãƒƒã‚¯! JavaScriptã‚’ç”¨ã„ãŸXSSè„†å¼±æ€§ã‚’çªã„ãŸæ”»æ’ƒãŒãã®æ£ä½“ ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ç ”ç©¶æ‰€ã®ãƒŸãƒƒã‚³ãƒ»ãƒ’ãƒƒãƒãƒãƒ³ãŒãƒã‚¹ãƒˆã—ãŸã€ŒTwitter.comã«æ”¾ãŸã‚ŒãŸãƒ¯ãƒ¼ãƒ ã€ã«ã‚ˆã‚‹ã¨ã€"onMouseOver"ã‚’å·§ã¿ã«æ“ã‚Šãƒžã‚¦ã‚¹ã‚«ãƒ¼ã‚½ãƒ«ã‚’æ‚ªæ„ã‚ã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆä¸Šã«å‹•ã‹ã™ã ã‘ã§ã€æ‚ªæ„ã‚ã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’è¢«å®³è€…è‡ªèº«ã®ãƒ•ã‚©ãƒãƒ¯ãƒ¼ã«é€ä¿¡ã—ã¦ã—ã¾ã†ãƒ¯ãƒ¼ãƒ ã¨ã®ã“ã¨ã€‚
yuichi0613 2010/09/22
twitter

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒãƒƒãƒˆ

è„†å¼±æ€§

ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«

xss
ãƒªãƒ³ã‚¯
Togetter - ã€Œä»Šæ—¥Twitterã«ã€ŽRainbowTwtrã€ãŒã“ã‚“ã«ã¡ã¯ï¼ï¼ã—ãŸçµŒç·¯ã€
ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒç”Ÿã¾ã‚Œã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã¾ã¨ã‚ãƒ„ãƒ¼ãƒ«
yuichi0613 2010/09/22
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Togetter

twitter

XSS

javascript
ãƒªãƒ³ã‚¯
Twitterã®è„†å¼±æ€§çªãã‚³ãƒ¼ãƒ‰ãŒæ‹¡æ•£ã€€Webãƒ–ãƒ©ã‚¦ã‚¶ã§ã®ã‚¢ã‚¯ã‚»ã‚¹è‡ªç²›å‘¼ã³æŽ›ã‘
21æ—¥23:10è¿½è¨˜ Twitterå…¬å¼ãƒ–ãƒã‚°ãŒè„†å¼±æ€§ã®ä¿®æ£ã‚’å ±å‘Šï¼ˆè‹±æ–‡ï¼‰ã€‚ã ãŒå…¨Twitterã‚µãƒ¼ãƒã«ä¿®æ£ãŒåæ˜ ã•ã‚Œã‚‹ã¾ã§æ™‚é–“ãŒã‹ã‹ã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚‹ãŸã‚ã€å½“åˆ†ã¯è¦æ³¨æ„ã€‚ Twitterã®è„†å¼±æ€§ã‚’ä½¿ã£ãŸã‚³ãƒ¼ãƒ‰ãŒæ€¥é€Ÿã«æ‹¡æ•£ã—ã€æ„å›³ã—ãªã„ãƒ„ã‚¤ãƒ¼ãƒˆã‚’ã—ã¦ã—ã¾ã†ã‚±ãƒ¼ã‚¹ãªã©ãŒå¤šç™ºã—ã¦ã„ã‚‹ã€‚å½“é¢ã®å¯¾ç–ã¨ã—ã¦ã€Webãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰Twitterå…¬å¼ãƒ›ãƒ¼ãƒ ç”»é¢ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãªã„ãªã©ã®å¯¾ç–ã‚’ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ã‚½ãƒ•ãƒˆä¼šç¤¾ã‚„ãƒ¦ãƒ¼ã‚¶ãƒ¼æœ‰å¿—ãŒå‘¼ã³æŽ›ã‘ã¦ã„ã‚‹ã€‚ Kaspersky Labã®ãƒ–ãƒã‚°ã«ã‚ˆã‚‹ã¨ã€Twitterã«å˜åœ¨ã™ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã®è„†å¼±æ€§ãŒåŽŸå› ã€‚ãƒ„ã‚¤ãƒ¼ãƒˆã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’åŸ‹ã‚è¾¼ã‚“ã ã‚Šã€å¤–éƒ¨ã‚µã‚¤ãƒˆã‹ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å‘¼ã³å‡ºã™ãªã©ã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ãŒå¯èƒ½ã«ãªã£ã¦ã„ã‚‹ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ãƒ„ã‚¤ãƒ¼ãƒˆã‚’é€£éŽ–ã•ã›ã‚‹ã‚³ãƒ¼ãƒ‰ã‚‚å‡ºå›žã£ã¦ãŠã‚Šã€æ€¥é€Ÿã«åºƒãŒã£ã¦ã„ã‚‹ã‚‚ã‚ˆã†ã ã€‚ ã‚³ãƒ¼ãƒ‰ã«ã‚ˆã£ã¦ã¯ã€ãƒã‚°ã‚¤ãƒ³çŠ¶æ…‹ã§Webãƒ–ãƒ©ã‚¦ã‚¶
yuichi0613 2010/09/22
Twitter

security

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒãƒƒãƒˆ

ITmedia
ãƒªãƒ³ã‚¯
twitterã§XSSè„†å¼±æ€§ç™ºç”Ÿ:ãƒãƒ ã‚¹ã‚¿ãƒ¼é€Ÿå ± - ãƒ©ã‚¤ãƒ–ãƒ‰ã‚¢ãƒ–ãƒã‚°
twitterã§XSSè„†å¼±æ€§ç™ºç”Ÿ ã‚«ãƒ†ã‚´ãƒªãƒ‹ãƒ¥ãƒ¼ã‚¹ 1 ï¼š çµµæœ¬ä½œå®¶(catv?)ï¼š2010/09/21(ç«) 20:48:54.40 ID:N9k777o3iâ— ?BRZ(10000) ã‚½ãƒ¼ã‚¹ http://twitter.com/Hamachiya http://twitter.com/hapinano/status/25102437219 Webä»¥å¤–ã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¯å•é¡Œãªã— document.bodyã®ãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ã‚‚å½“ç„¶å¯èƒ½ãªã®ã§ãƒã‚°ã‚¢ã‚¦ãƒˆæŽ¨å¥¨ 3 ï¼š æ¯ç§‘åŒ»å¸«(é–¢è¥¿åœ°æ–¹)ï¼š2010/09/21(ç«) 20:49:22.57 ID:6PM295IO0 ã¤ã¾ã‚Šã©ã†ãªã‚‹ã‚“ã ã‚ˆï¼Ÿ 7 ï¼š å…¬å‹™å“¡(æ±äº¬éƒ½)ï¼š2010/09/21(ç«) 20:50:10.15 ID:6XnlGTOm0 tiwtterçµ‚äº†ã®ãŠçŸ¥ã‚‰ã› 8 ï¼š å¹¼ç¨šåœ’ã®å…ˆç”Ÿ(ã‚¢ãƒ©ãƒãƒžå·ž)ï¼š2010/09/21
yuichi0613 2010/09/22
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

twitter

security

ãƒãƒƒãƒˆ

xss
ãƒªãƒ³ã‚¯
ãƒ–ãƒã‚°
Twitterã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã«ãªã‚‹ã¨ã€Cookieã®ä½¿ç”¨ ã«åŒæ„ã—ãŸã‚‚ã®ã¨ã¿ãªã•ã‚Œã¾ã™ã€‚Cookieã¯ã‚¢ãƒŠãƒªãƒ†ã‚£ã‚¯ã‚¹ã€ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã€åºƒå‘Šãªã©ã«ä½¿ã‚ã‚Œã¾ã™ã€‚
yuichi0613 2010/09/22
twitter

XSS

JavaScript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒãƒƒãƒˆ
ãƒªãƒ³ã‚¯
2010 å¹´ 9 æœˆ 21 æ—¥ç¾åœ¨ã®ãƒ„ã‚¤ãƒƒã‚¿ãƒ¼ã®ãƒã‚°(è„†å¼±æ€§)ã«ã¤ã„ã¦
ã€ãŠçŸ¥ã‚‰ã›ã€‘ 9 æœˆ 21 æ—¥åˆå¾Œ 11 æ™‚é ƒã€å…¬å¼ã‚µã‚¤ãƒ‰ã‹ã‚‰è„†å¼±æ€§ãŒä¿®æ£ã•ã‚ŒãŸã¨ã®ç™ºè¡¨ãŒã‚ã‚Šã¾ã—ãŸã€‚ ã¯ã˜ã‚ã« 2010 å¹´ 9 æœˆ 21 æ—¥ã€ãƒ„ã‚¤ãƒƒã‚¿ãƒ¼ã§æ·±åˆ»ãªè„†å¼±æ€§(ãœã„ã˜ã‚ƒãã›ã„)ãŒç™ºè¦‹ã•ã‚Œã€è¢«å®³ãŒåºƒãŒã£ã¦ã„ã¾ã™ã€‚ã“ã‚ŒãŒä½•ãªã®ã‹ã€ç°¡å˜ã«èª¬æ˜Žã—ã¾ã™ã€‚ JavaScript ã¨ãƒžã‚¦ã‚¹ã‚ªãƒ¼ãƒãƒ¼ã‚¤ãƒ™ãƒ³ãƒˆ ã¾ãšã€ä¸‹ã®ãƒ”ãƒ³ã‚¯è‰²ã®æž å†…ã«ãƒžã‚¦ã‚¹ã‚«ãƒ¼ã‚½ãƒ«ã‚’ã™ã¹ã‚‰ã›ã¦ã¿ã¦ãã ã•ã„ã€‚ ã“ã®æž ã®ä¸ã‚’ãƒžã‚¦ã‚¹ã‚«ãƒ¼ã‚½ãƒ«ã§è§¦ã£ã¦! ã©ã†ã§ã—ãŸã‹ã€‚ã€Œè§¦ã£ã¦ãã‚Œã¦ã‚ã‚ŠãŒã¨ã†!ã€ã¨ã„ã†ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãŒè¡¨ç¤ºã•ã‚Œã¾ã—ãŸãã€‚ ã“ã®ã‚ˆã†ã«ã€ã‚¦ã‚§ãƒ–ãƒšãƒ¼ã‚¸ã«ã¯ç°¡å˜ãªãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ä»•è¾¼ã‚€ã“ã¨ãŒã§ãã¾ã™ã€‚ã©ã®ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼(çš†ã•ã‚“ãŒã‚¦ã‚§ãƒ–ã‚’è¦‹ã‚‹æ™‚ã«ä½¿ã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¨ã‚¯ã‚¹ãƒ—ãƒãƒ¼ãƒ©ãƒ¼ãªã©)ã§ã‚‚å…±é€šã§ä½¿ãˆã‚‹ã€ŒJavaScript (ã‚¸ãƒ£ãƒã‚¹ã‚¯ãƒªãƒ—ãƒˆ)ã€ã¨ã„ã†è¨€èªžãŒä¸€èˆ¬çš„ã«ä½¿ã‚ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå›žã¯ã€ãƒšãƒ¼ã‚¸ä¸Šã®ã‚ã‚‹éƒ¨åˆ†ã«ãƒžã‚¦ã‚¹ã‚«ãƒ¼ã‚½
yuichi0613 2010/09/22
ç´ æ™´ã‚‰ã—ã„ã¾ã¨ã‚ã§ã™ã€‚

twitter

Javascript

xss

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

ãƒãƒƒãƒˆ
ãƒªãƒ³ã‚¯
1