[B! XSS] yuroyoroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

yuroyoro id:yuroyoro

XSSã«é–¢ã™ã‚‹yuroyoroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Masato Kinugawa Security Blog: ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚ãƒ£ãƒ³ãƒ—å…¨å›½å¤§ä¼š2015ã®è³‡æ–™ã‚’å…¬é–‹
2015å¹´8æœˆ11ï½ž15æ—¥ã®é–“è¡Œã‚ã‚ŒãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚ãƒ£ãƒ³ãƒ—å…¨å›½å¤§ä¼š2015ã«ã€ä»Šå¹´ã‚‚è¬›å¸«ã¨ã—ã¦å‚åŠ ã—ã¦ãã¾ã—ãŸã€‚ä½¿ç”¨ã—ãŸè³‡æ–™ã‚’å…¬é–‹ã—ã¾ã™ã€‚ 1. äº‹å‰å¦ç¿’ã¨ã—ã¦ç”¨æ„ã—ãŸã€Œç°¡å˜ã«SOPå‘¨è¾ºã‚’ç†è§£ã™ã‚‹ãƒšãƒ¼ã‚¸ã€ http://vulnerabledoma.in/camp2015_sop/ 2. è¬›ç¾©ã«ä½¿ç”¨ã—ãŸã‚¹ãƒ©ã‚¤ãƒ‰ SecurityCamp2015ã€Œãƒã‚°ãƒãƒ³ãƒ†ã‚£ãƒ³ã‚°å…¥é–€ã€ from Masato Kinugawa 3. ç‰¹åˆ¥ã‚³ãƒ¼ãƒŠãƒ¼ã§ä½¿ç”¨ã—ãŸã‚¹ãƒ©ã‚¤ãƒ‰ CVE-2015-4483è§£èª¬ from Masato Kinugawa 1ã¤ç›®ã®ã‚¹ãƒ©ã‚¤ãƒ‰ã¯ã€è‡ªåˆ†ãŒã‚ãƒ£ãƒ³ãƒ—ã®1æ—¥ç›®ã«æ‹…å½“ã—ãŸã€Œãƒã‚°ãƒãƒ³ãƒ†ã‚£ãƒ³ã‚°å…¥é–€ã€ã¨ã„ã†è¬›ç¾©ã§ä½¿ç”¨ã—ãŸã‚‚ã®ã§ã™ã€‚è¬›ç¾©ã§ã¯ã€è„†å¼±æ€§ã‚’æŽ¢ã™ã¨ãã«ã©ã®ã‚ˆã†ãªç‚¹ã«æ³¨ç›®ã™ã‚Œã°ã„ã„ã®ã‹ã‚’éŽåŽ»ã«ç™ºè¦‹ã—ãŸ/ã•ã‚ŒãŸWebå‘¨è¾ºã®ãƒã‚°ã‚’é€šã—ã¦èª¬æ˜Žã—ã¾ã—ãŸã€‚ é¡Œæã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã¯ã€ã‚µã‚¤ãƒœã‚¦ã‚ºLi
yuroyoro 2015/08/18
security

XSS
ãƒªãƒ³ã‚¯
monoweb.infoÂ -Â ã“ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã¯è²©å£²ç”¨ã§ã™ï¼Â -Â monoweb ãƒªã‚½ãƒ¼ã‚¹ãŠã‚ˆã³æƒ…å ±
ã“ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã¯è²©å£²ç”¨ã§ã™ï¼ monoweb.info ã¯ã€ã‚ãªãŸãŒãŠæŽ¢ã—ã®æƒ…å ±ã®å…¨ã¦ã®æœ€æ–°ã‹ã¤æœ€é©ãªã‚½ãƒ¼ã‚¹ã§ã™ã€‚ä¸€èˆ¬ãƒˆãƒ”ãƒƒã‚¯ã‹ã‚‰ã“ã“ã‹ã‚‰æ¤œç´¢ã§ãã‚‹å†…å®¹ã¯ã€monoweb.infoãŒå…¨ã¦ã¨ãªã‚Šã¾ã™ã€‚ã‚ãªãŸãŒãŠæŽ¢ã—ã®å†…å®¹ãŒè¦‹ã¤ã‹ã‚‹ã“ã¨ã‚’é¡˜ã£ã¦ã„ã¾ã™ï¼
yuroyoro 2013/07/19
ruby

rack

xss

security
ãƒªãƒ³ã‚¯
ãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã¨ãƒ–ãƒã‚°ã¨XSS // Speaker Deck
ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã‚„ãƒ–ãƒã‚°ã®XSSå¯¾ç–ã®äº‹ä¾‹ã‚’ç´¹ä»‹ã—ã¾ã™
yuroyoro 2013/05/14
security

XSS
ãƒªãƒ³ã‚¯
åœ°ç„ã®JavaScriptã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
TopicsPlaceHolder SectionTitlePlaceHolder TIME rest time current/total en
yuroyoro 2012/11/19
javascript

security

XSS
ãƒªãƒ³ã‚¯
The SQL Injection Knowledge Base
Examples: SELECT * FROM Articles WHERE id = '1'''; SELECT 1 FROM dual WHERE 1 = '1'''''''''''''UNION SELECT '2'; Notes: You can use as many apostrophes and quotations as you want as long as they pair up. It is also possible to continue the statement after the chain of quotes. Quotes escape quotes.
yuroyoro 2012/07/10
security

XSS
ãƒªãƒ³ã‚¯
Kazuho@Cybozu Labs: XSSã«å¼·ã„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ä½œã‚‹ â€“ ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³ã®é¸å®šåŸºæº–ã¨ã‚¹ãƒ‹ãƒšãƒƒãƒˆã®ç”Ÿæˆæ‰‹æ³• (ç¬¬ï¼‘å›žç¥žæ³‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹‰å¼·ä¼šç™ºè¡¨è³‡æ–™)
ç™ºè¡¨è³‡æ–™ã¯ä»¥ä¸‹ã®ã¨ãŠã‚Šã€‚æ˜¥å±±æ§˜ã¯ã˜ã‚ECãƒŠãƒ“ã®çš†æ§˜ã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚ XSSã«å¼·ã„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ä½œã‚‹ â€“ ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ³ã®é¸å®šåŸºæº–ã¨ã‚¹ãƒ‹ãƒšãƒƒãƒˆã®ç”Ÿæˆæ‰‹æ³•View more presentations from kazuho.
yuroyoro 2010/10/27
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼å¿…è¦‹ï¼WEBè„†å¼±æ€§åŸºç¤ŽçŸ¥è˜æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ç‡ˆæ˜Žæ—¥è¨˜
ä»¥ä¸‹ã¯ã€WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ç”¨ã®WEBè„†å¼±æ€§ã®åŸºç¤ŽçŸ¥è˜ã®ä¸€è¦§ã§ã™ã€‚ WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®äººã¯ã“ã‚Œã‚’èªã‚ã°WEBè„†å¼±æ€§ã®åŸºç¤Žã‚’ãƒžã‚¹ã‚¿ãƒ¼ã—ã¦WEBãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æ›¸ãã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã§ã™ã€‚ ã¾ãŸã€WEBè„†å¼±æ€§ã®ç°¡æ˜“ãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã¨ã—ã¦ã‚‚å°‘ã—åˆ©ç”¨ã§ãã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã«ã¯ã€é–‹ç™ºè¦ä»¶æ›¸ã‚„ãƒ—ãƒã‚°ãƒ©ãƒ ä»•æ§˜æ›¸é€šã‚Šã«é–‹ç™ºã™ã‚Œã°è‰¯ã„ã¨ã„ã†ã‚ã‘ã«ã¯ã„ãã¾ã›ã‚“ã€‚ ãã†ã€WEBè„†å¼±æ€§ã‚’ç‹™ã†æ‚ªæ„ã®ãƒ¦ãƒ¼ã‚¶ã«ã‚‚å¯¾å‡¦ã—ãªã„ã¨ã„ã‘ãªã„ã®ã§ã™ã€‚ ä»Šå›žã€WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã«ã‚ãŸã£ã¦ã®WEBè„†å¼±æ€§ã‚’ã€ä»¥ä¸‹ã®ä¸€è¦§ã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ã“ã®ã¾ã¨ã‚ãŒWEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã®å‚è€ƒã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ»ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚„èªå¯åˆ¶å¾¡ã®æ¬ è½ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(Directory Traversal) CSRFï¼ˆ
yuroyoro 2010/05/10
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
1