FRONTEND CONFERENCE 2019( https://2019.kfug.jp )ã§ã‚»ã‚ュリティã€ä¸»ã«XSSã«ã¤ã„ã¦è©±ã‚’ã—ã¾ã—ãŸã€‚ demo: https://shisama.dev/xss-test # Technical Topics - 3 types of XSS ( …
フãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãŸã‚ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç– ~XSSç·¨~ / #frontkansai 2019
FRONTEND CONFERENCE 2019( https://2019.kfug.jp )ã§ã‚»ã‚ュリティã€ä¸»ã«XSSã«ã¤ã„ã¦è©±ã‚’ã—ã¾ã—ãŸã€‚ demo: https://shisama.dev/xss-test # Technical Topics - 3 types of XSS ( …
Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types  | Articles  | web.dev
DOM-based cross-site scripting (DOM XSS) happens when data from a user-controlled source (like a username, or a redirect URL taken from the URL fragment) reaches a sink, which is a function like eval() or a property setter like .innerHTML that can execute arbitrary JavaScript code. DOM XSS is one of the most common web security vulnerabilities, and it's common for dev teams to accidentally introdu
ã“ã‚Œã‹ã‚‰ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã‚»ã‚ュリティ
Frontend Conference Fukuoka 2019
Renamed window.TrustedTypes to window.trustedTypes by koto · Pull Request #205 · w3c/trusted-types
DOM Based XSSã®è‡ªå‹•æ¤œå‡ºã®è©±
Shibuya.XSS#8
Content security policy  | Articles  | web.dev
The web's security model is based on a same-origin policy. For example, code from https://mybank.com must have access to only https://mybank.com's data, and https://evil.example.com must never be allowed access. Each origin is, in theory, kept isolated from the rest of the web, giving developers a safe sandbox to build in. In practice, however, attackers have found several ways to subvert the syst
2018å¹´ å ±å¥¨é‡‘åˆ¶åº¦ã‚’æŒ¯ã‚Šè¿”ã£ã¦ - Cybozu Inside Out | サイボウズエンジニアã®ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€‚Cy-PSIRT(Cybozu Product Security Incident Response Team)ã®ç¦æ°¸ã§ã™ã€‚ 本エントリã§ã¯ 2018å¹´ã«å®Ÿæ–½ã—ãŸå ±å¥¨é‡‘制度ã®çµæžœ å‚åŠ è€…ã‹ã‚‰ã®ã”æ„見 ã«ã¤ã„ã¦ã€ã”紹介ã„ãŸã—ã¾ã™ã€‚ 2018å¹´ã«å®Ÿæ–½ã—ãŸå ±å¥¨é‡‘制度ã®çµæžœ 定é‡æƒ…å ± 2018å¹´ã®è„†å¼±æ€§èªå®šæ•°ã¯155件ã€å ±å¥¨é‡‘支払金é¡ã¯21,055,000円ã§ã—ãŸã€‚*1 ç€ä¿¡æ•°èªå®šæ•°(暫定)å ±å¥¨é‡‘æ”¯æ‰•é‡‘é¡(暫定) 362件155件21,055,000 円 å‰å¹´åº¦ã¨æ¯”較ã—ã¦ã€ç€ä¿¡æ•°ã€èªå®šæ•°ã¨ã‚‚ã«ç´„1.5å€ã«å¢—åŠ ã—ã€å ±å¥¨é‡‘支払金é¡ã®åˆè¨ˆã‚‚å€è¿‘ãã«å¢—ãˆã¾ã—ãŸã€‚2017å¹´7月7æ—¥ã‹ã‚‰é–‹å§‹ã—ãŸã€Œå ±å¥¨é‡‘最大5å€ã‚ャンペーンã€ã‚’ã€2018å¹´ã«ã¯ã€é€šå¹´åŒ–ã—ãŸã“ã¨ãŒä¸»ãªè¦å› ã§ã™ã€‚ 2018å¹´åº¦å ±å¥¨é‡‘ç²å¾—ランã‚ング ç·é¡ãƒ©ãƒ³ã‚ング ç²å¾—ã—ãŸå ±å¥¨é‡‘é¡ã®åˆè¨ˆãŒæœ€ã‚‚多ã‹ã£ãŸã®ã¯ã€è¥¿è°·å®Œå¤ªï¼ˆ@no1zy_sec）
CWE-79
解説 解説è¦ç´„ ã“ã®è„†å¼±æ€§ã®å˜åœ¨ã™ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ã€ãƒ¦ãƒ¼ã‚¶ã‹ã‚‰ã®å…¥åŠ›ã«å¯¾ã™ã‚‹ç„¡å®³åŒ–ã‚’é©åˆ‡ã«è¡Œã‚ãªã„ã¾ã¾ã€ä»–ã®ãƒ¦ãƒ¼ã‚¶ã«æä¾›ã™ã‚‹Â Web ページã®å‡ºåŠ›ã«å«ã‚ã¾ã™ã€‚ 詳細ãªè§£èª¬ クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング (XSS) ã®è„†å¼±æ€§ã¯ã€ä»¥ä¸‹ã®æ§˜ã«ç™ºç”Ÿã—ã¾ã™ã€‚ 1.Â ä¿¡é ¼ã§ããªã„データãŒï¼ˆä¸€èˆ¬çš„ã«Â Web リクエストã‹ã‚‰ï¼‰Web アプリケーションã«å…¥åŠ›ã•ã‚Œã€ 2. Web アプリケーションãŒã€ã“ã®ä¿¡é ¼ã§ããªã„データをå«ã‚€Â Web ページを動的ã«ç”Ÿæˆã—ã¾ã™ã€‚ 3. ãã®éš›Â Web アプリケーションã¯ã€ä¿¡é ¼ã§ããªã„データã«å«ã¾ã‚Œã‚‹Â Web ブラウザã§å®Ÿè¡Œå¯èƒ½ãªã‚³ãƒ³ãƒ†ãƒ³ãƒ„ (JavaScriptã€HTML タグã€HTML アトリビュートã€ãƒžã‚¦ã‚¹ã‚¤ãƒ™ãƒ³ãƒˆã€Flashã€Â ActiveX ç‰) を排除ã—ã¾ã›ã‚“。 4. 一般ユーザãŒã€Web ブラウザを介ã—ã¦ç”Ÿæˆã•ã‚ŒãŸãƒšãƒ¼ã‚¸ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¾ã™ã€‚ã“ã®Â Web ページã«ã¯
XSS Auditor ãŒæœ‰åŠ¹ã«ãªã£ã¦ã„ã‚‹ã‹ãƒã‚§ãƒƒã‚¯ã™ã‚‹ãŸã‚ã®ãƒšãƒ¼ã‚¸ã‚’作りã¾ã—ãŸ
Security XSS Auditor ãŒæœ‰åŠ¹ã«ãªã£ã¦ã„ã‚‹ã‹ãƒã‚§ãƒƒã‚¯ã™ã‚‹ãŸã‚ã®ãƒšãƒ¼ã‚¸ã‚’作りã¾ã—ãŸâ€»å½“サイトã«ã¯ãƒ—ãƒãƒ¢ãƒ¼ã‚·ãƒ§ãƒ³ãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ 1. XSS ã¨ã¯ï¼ŸXSS (Cross-site Scripting) ã¨ã¯ã€Webサイト上ã§è¡Œã‚れる攻撃ã®1ã¤ã§ã™ã€‚ ã„ã‚ã„ã‚ãªç¨®é¡žãŒã‚ã‚‹ã®ã§ã™ãŒã€å˜ç´”ãªä¾‹ã‚’ã‚ã’ã‚‹ã¨ä»¥ä¸‹ã®ã‚·ãƒŠãƒªã‚ªã§ä»»æ„ã® JavaScriptコードを実行ã•ã›ã‚‹æ”»æ’ƒãŒ XSS ã§ã™ã€‚ 掲示æ¿ã‚µã‚¤ãƒˆãŒã‚ã‚‹ã¨ã—ã¾ã™ã€‚投稿欄㫠JavaScriptコードを入力ã—ã¦æŠ•ç¨¿ã—ã¾ã™ã€‚投稿ã—ãŸå†…容㯠Webページ上ã«è¡¨ç¤ºã•ã‚Œã¾ã™ãŒã€HTML ã¨ã—ã¦å‡ºåŠ›ã•ã‚Œã‚‹ä¸ã« JavaScriptコードãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ã€ãã®ã¾ã¾ã“ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã„ã¾ã™ï¼ˆæœ¬æ¥ã¯é©åˆ‡ãªã‚¨ã‚¹ã‚±ãƒ¼ãƒ—処ç†ãŒå¿…è¦ã§ã™ï¼‰ã€‚Webサイトã«ã‚ˆã£ã¦é•ã„ã¾ã™ãŒã€JavaScript を使ã†ã¨å€‹äººæƒ…å ±ã‚„ãã‚Œã«ç´ã¥ãæƒ…å ±ã‚’åˆ¥ã®ã‚µãƒ¼ãƒãƒ¼ã«é€
The 7 Main XSS Cases Everyone Should Know - Brute XSS
When reading material on XSS subject we usually see the classical <script>alert(1)</script> as an demonstration of such vulnerability (PoC – Proof of Concept). While very true, it doesn’t go much beyond this, making the novice in this field to look for more in order to deal with real world scenarios. So here are the 7 cases everyone should know to be able to exploit the vast majority of XSS flaws
最近ã®JavaScriptフレームワークã§ã®XSS
所謂ã€æœ€è¿‘æµè¡Œã£ã¦ã„ã‚‹JavaScriptフレームワークã§ã®XSSã®ä¾‹ã‚’ã„ãã¤ã‹æŒ™ã’よã†ã¨æ€ã†ã€‚ 最近ã®JavaScriptフレームワークã¯è³¢ã„ã®ã§ã€ãƒ‡ãƒ¼ã‚¿ã‚’ãƒã‚¤ãƒ³ãƒ‰ã™ã‚‹éš›ã«HTMLエスケープã—ã¦ãã‚Œã¦XSSã‹ã‚‰ä¿è·ã—ã¦ãれる。 ã—ã‹ã—ãªãŒã‚‰ã€ä¿è·ãŒé©ç”¨ã•ã‚Œãªã„ケースもã‚ã‚‹ãŸã‚ã€éŽåº¦ã«ãƒ•ãƒ¬ãƒ¼ãƒ ワークã«ä¿¡é ¼ã—ã¦ã„ã‚‹ã¨XSSを作り込んã§ã—ã¾ã†ã€‚ ã“ã“ã§ã¯Reactã¨Vue.jsã§ãã®ä¾‹ã‚’ã„ãã¤ã‹æŒ™ã’よã†ã¨æ€ã†ã€‚ ã‚ãã¾ã§ã€Œã‚„ã£ã¦ã—ã¾ã†ã‹ã‚‚ã—ã‚Œãªã„例ã€ã¨ã„ã†ã ã‘ã§ã€Reactã‚„Vue.jsã®å›ºæœ‰ã®å•é¡Œã¨ã„ã†ã‚ã‘ã§ã¯ãªã„ã§ã™ã€‚ React javascript:スã‚ームaã‚¿ã‚°ã®href属性ã«javascript:ã‚„data:text/htmlãªã©ã®ä»»æ„ã®ã‚¹ã‚ームをユーザーãŒè¨å®šã§ãã‚‹å ´åˆã€XSSãŒç”Ÿã˜ã‚‹ã€‚ ã“ã‚Œã¯Reactã«é™ã£ãŸè©±ã§ã¯ãªãã€å¤ãã‹ã‚‰ã‚る手法ã ãŒã€æœªã ã«ãŸã¾ã«è¦‹ã‚‹ã€‚ import
JavaScript ã¨HTML5ã®ã‚»ã‚ュリティ対ç–
1. 基礎知è˜ç™ºç”Ÿã—ã‚„ã™ã„脆弱性DOM based XSS (Cross-Site Scripting)Stored DOM based XSS (Cross-Site Scripting)window.localStorage を経由ã™ã‚‹, etc.Client-side Open Redirect （クライアントå´ã®ã‚ªãƒ¼ãƒ—ンリダイレクト）CSRF (クãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ»ãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª)アクセス制御やèªå¯åˆ¶å¾¡ã®æ¬ è½Ajaxデータã®æ¼ãˆã„etc.ä¿¡é ¼ã§ããªã„値ã¯ã©ã“ã‹ã‚‰ãã‚‹ã®ã‹ï¼Ÿï¼ˆã‚½ãƒ¼ã‚¹ï¼‰windowオブジェクトやdocumentオブジェクトã®ãƒ—ãƒãƒ‘ティコンテンツをãƒãƒ¼ãƒ‰ã—ãŸéš›ã®URIã®æ§‹æˆè¦ç´ document.URL *document.location.pathname *document.location.search *document.location.hashdocumen
DOM ベース XSS 対ç–ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆ - OWASP
クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング (XSS) ã¯ã€ä¸€èˆ¬ã«æ¬¡ã® 3 種類ã«åˆ†é¡žã•ã‚Œã¾ã™ã€‚ åå°„åž‹ã€æ ¼ç´åž‹ã€ãŠã‚ˆã³ DOM ベース㮠XSS ã§ã™ã€‚åå°„åž‹ XSS ã¨æ ¼ç´åž‹ XSS ã«ã¤ã„ã¦ã¯ã€XSS 対ç–ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã§è©³ã—ãå–り上ã’ã¦ã„ã¾ã™ã€‚ã“ã®ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã§ã¯ã€ãƒ‰ã‚ュメントオブジェクトモデル (DOM) ベース㮠XSS ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ã“ã®ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã¯ã€XSS 対ç–ãƒãƒ¼ãƒˆã‚·ãƒ¼ãƒˆã®å»¶é•·ã§ã‚ã‚Šã€ãã®å†…容ã®ç†è§£ã‚’å‰æã¨ã—ã¦ã„ã¾ã™ã€‚ DOM ベース㮠XSS ã‚’ç†è§£ã™ã‚‹ã«ã¯ã€DOM ベース㮠XSS ã¨åå°„åž‹ãŠã‚ˆã³æ ¼ç´åž‹ XSS ã¨ã®åŸºæœ¬çš„ãªé•ã„を知る必è¦ãŒã‚ã‚Šã¾ã™ã€‚最も大ããªé•ã„ã¯ã€æ”»æ’ƒãŒã©ã“ã§ã‚¢ãƒ—リケーションã«æŒ¿å…¥ã•ã‚Œã‚‹ã‹ã§ã™ã€‚åå°„åž‹ XSS ã¨æ ¼ç´åž‹ XSS ãŒã‚µãƒ¼ãƒãƒ¼å´ã§ã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å•é¡Œã§ã‚ã‚‹ã®ã«å¯¾ã—ã€DOM ベース㮠XSS ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆ (ブラウザー) å´ã§ã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·
Cross-Site Scripting (XSS) Cheat Sheet - 2024 Edition | Web Security Academy
Cross-site scripting (XSS) cheat sheet This cross-site scripting (XSS) cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector. You can download a PDF version of the XSS cheat sheet. This is a PortSwigger Research project. Follow us on Twitter to receive updates. Downloaded
色んãªXSS – nootropic.me
2015/4/16(木)：ページã®ä¸€ç•ªä¸‹ã«è¿½è¨˜ã‚’記述ã—ã¾ã—ãŸã€‚ ãã®æ˜”ã€ãªã‚“ã¨ã‹ã‚ャンプã¨ã„ã†ã‚»ã‚ュリティã®ã‚¤ãƒ™ãƒ³ãƒˆã«å‚åŠ ã—ãŸæ™‚「アウトプットãŒå¤§äº‹ã€ã¨è¨€ã‚ã‚ŒãŸã®ã‚’æ€ã„出ã—ã¾ã—ãŸã€‚ ã§ã‚‚ã€æ™®é€šè‡ªåˆ†ã®è¦‹ã¤ã‘ãŸçŸ¥è˜ã¯å¾Œç”Ÿå¤§äº‹ã«æŠ±ãˆã¦ãŠããŸã„ã‚‚ã‚“ã ã¨æ€ã„ã¾ã™ã€‚ ãã“ã§ä»Šå›žã¯ãã†ã„ã£ãŸä½•ã‹ã—ょーもãªã„ã‚‚ã®ã‚’æ¨ã¦ã‚‹ã¹ãã€æºœã‚込んã 色んãªXSSã®PoCã‚’å°‘ã—書ã出ã—ã¦ã¾ã¨ã‚ã¾ã—ãŸã€‚ 今ã¾ã§è‡ªåˆ†ã§è¦‹ã¤ã‘ãŸã‚‚ã®ã‚„海外ã®Security Researcheré”ã‹ã‚‰åŽé›†ã—ãŸã‚‚ã®ã‚‚ã‚ã‚Šã¾ã™ã€‚ ã•ã¦ã€ä»Šå›žãƒªã‚¹ãƒˆã‚¢ãƒƒãƒ—ã—ãŸPoCã®è¦‹æ–¹ã§ã™ãŒã„ãã¤ã‹ã®é …ç›®ãŒã‚ã‚Šã¾ã™ã€‚ 一番上ã®ã€Œæ‰‹æ³•ã€ã¯ã‚¿ã‚¤ãƒˆãƒ«ã¿ãŸã„ãªã‚‚ã®ã ã¨æ€ã£ã¦ä¸‹ã•ã„。 二番目ã®ã€ŒPoCã€ã¯ã‚¹ã‚¯ãƒªãƒ—トを実行ã™ã‚‹ç‚ºã®ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚殆ã©ãŒã‚¢ãƒ©ãƒ¼ãƒˆãŒå‡ºã‚‹ã ã‘ã®ã‚¹ã‚¯ãƒªãƒ—トã®ç‚ºå±é™ºãªã‚³ãƒ¼ãƒ‰ã¯ç„¡ã„ã¤ã‚‚ã‚Šã§ã™ãŒã”自分ã®ãƒ–ラウザã§å®Ÿè¡Œã™ã‚‹éš›ã¯è‡ªå·±è²¬ä»»ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚リンクをクリッ
メンテナンス
ãŠçŸ¥ã‚‰ã›
障害
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
84% of all websites are impacted by jQuery XSS vulnerabilities | Snyk
ウェブサイトã®è„†å¼±æ€§å±Šå‡ºã€å¤§åŠãŒã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティングã§200件超　2019年第3å››åŠæœŸIPAå ±å‘Š
Top Ten Vulnerabilities | HackerOne
Browser's XSS Filter Bypass Cheat Sheet
Excess XSS: A comprehensive tutorial on cross-site scripting
{{#tags}}- {{label}}
{{/tags}}