[B! xss] chanpon0ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

chanpon0 id:chanpon0

xssã«é–¢ã™ã‚‹chanpon0ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

www\.google\.com ã«å˜åœ¨ã™ã‚‹æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰åˆ‡ã‚Šæ›¿ãˆã«ã‚ˆã‚‹Self-XSS - A602
First published Sat Aug 23 23:57:12 2014 +0900 ; substantive revision Sat Feb 14 12:41:39 2015 +0900 Tags : Security XSS ã¾ã¨ã‚ å¯†ã‹ã«ç´°å·¥ã•ã‚ŒãŸãƒšãƒ¼ã‚¸ã‚„Googleã®æ¤œç´¢çµæžœç”»é¢ã§ã€æ–‡å—åŒ–ã‘ã‚’ç›´ã™ãŸã‚ã«ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ‡ã‚Šæ›¿ãˆã‚‹ã¨ãƒã‚°ã‚¤ãƒ³ã—ã¦ã„ã‚‹Googleã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‹ã‚‰æƒ…å ±ãŒæ¼ã‚Œã‚‹è„†å¼±æ€§ãŒã‚ã‚‹ã€‚ Googleã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒ¼ãƒ ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯æ‰‹å‹•ã§ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’åˆ‡ã‚Šæ›¿ãˆã‚‹ã¹ãã§ã¯ãªã„ã¨è€ƒãˆã¦ã„ã‚‹ã®ã§ã€ã“ã®è„†å¼±æ€§ã¯ä¿®æ£ã•ã‚Œãªã„ã€‚ æ¦‚è¦ ä»¥ä¸‹ã®ãƒšãƒ¼ã‚¸ã§ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’Shift_JISã«åˆ‡ã‚Šæ›¿ãˆã‚‹ã¨ www\.google\.co\..* ä¸Šã§XSSãŒç™ºå‹•ã—ã¾ã™ã€‚ PoC 1: Googleãƒžãƒƒãƒ—ã®iframeåŸ‹ã‚è¾¼ã¿ http://www.tsg.ne.jp/n
chanpon0 2014/08/26
google

xss

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

encoding

æ–‡å—åŒ–ã‘
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
chanpon0 2012/12/04
xss

jQuery

JavaScript
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: ãƒ–ãƒ©ã‚¦ã‚¶ã®XSSä¿è·æ©Ÿèƒ½ã‚’ãƒã‚¤ãƒ‘ã‚¹ã™ã‚‹
Chromeã‚„Safariã«ã¯XSS Auditorã€IE 8ä»¥ä¸Šã«ã¯XSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼ã¨ã„ã†ã€XSSã‚’æ¤œçŸ¥ã—ã¦ãƒ–ãƒãƒƒã‚¯ã™ã‚‹æ©Ÿèƒ½ãŒãã‚Œãžã‚Œã‚ã‚Šã¾ã™ã€‚ ä»Šå›žã¯ã€ã“ã‚Œã‚’å›žé¿ã—ã¦ã¿ãŸè¨˜éŒ²ã§ã™ã€‚ ãƒ»Chromeã§ãƒã‚¤ãƒ‘ã‚¹ ã¯ã„ï¼ã¤ã„ãŠã¨ã¨ã„å ±å‘Šã—ãŸã‚„ã¤ã§ã™ï¼ XSS Auditor bypass with U+2028/2029 https://bugs.webkit.org/show_bug.cgi?id=78732 ãªãœã‹Safariã§ã¯ãƒ–ãƒãƒƒã‚¯ã•ã‚Œã‚‹(ä¸ã®äººã‚‚ç†ç”±ãŒã‚ã‹ã‚‰ãªã„ã¨è¨€ã£ã¦ã„ãŸ)ã‚“ã ã‘ã©ã€Chromeã§ã¯å‹•ãã¾ã™ã€‚ä»¥ä¸‹ã§è©¦ã—ã¦ã¿ã¦ãã ã•ã„ã€‚ http://vulnerabledoma.in/char_test?charset=utf-8&xss=1&body=%3Cscript%3E//%E2%80%A8alert(1)%3C/script%3E http://vulnerabled
chanpon0 2012/11/29
xss

security

chrome
ãƒªãƒ³ã‚¯
Google Chromeã®XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³• | MemeTodo
2011å¹´5æœˆ22æ—¥æ—¥æ›œæ—¥ Google Chromeã®XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³• Chromeã«ã¯4ãã‚‰ã„ã‹ã‚‰XSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼(Webkitã§ã¯XSS auditorã¨ã„ã†ã®ãŒæ£å¼åç§°ã£ã½ã„)ãŒã‚ã£ã¦ã€Chrome11ã§ä½œã‚Šç›´ã•ã‚ŒãŸã®ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã‚ªãƒ³ã«ãªã£ã¦ã„ã‚‹ã‚ˆã†ã§ã™ã€‚ Google Chrome gets cranked to 11, improves XSS Auditor - InternetNews:The Blog - Sean Michael Kerner ã§ã€ã“ã®XSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼ã¯ã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã«"Refused to execute a JavaScript script. Source code of script found within request."ã¨åã„ã¦ã€ä»–ã«è¦–è¦šçš„ãªãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºã•ãªã„ã§æ¢ã‚ã‚‹ã®ã§ã€XSSã®æ¤œè¨¼ã¨ã‹ã ã¨é€†ã«é‚ªé”ãã•ã„æ„Ÿã˜ã«ãªã‚Šã¾ã™ã€‚
chanpon0 2012/11/29
Security

chrome

xss
ãƒªãƒ³ã‚¯
X-Content-Type-Options: nosniff ã¤ã‹ã‚ãªã„ã‚„ã¤ã¯æ»ãã°ã„ã„ã®ã«! - è‘‰ã£ã±æ—¥è¨˜
2011-01-06: IE8ã¨ã„ã†ã“ã¨ã‚’è¿½è¨˜ & ã¡ã‚‡ã£ã¨é–“é•ã„ã‚’ä¿®æ£ã€‚ã‚ã‘ã¾ã—ã¦ãŠã‚ã§ã¨ã†ã”ã–ã„ã¾ã™ã€‚ å¹´æ˜Žã‘æ—©ã€…ã§ã™ãŒã€Internet Explorerã®è©±é¡Œã§ã™ã€‚IEã¯ã”å˜ã˜ã®é€šã‚Šã€Content-Type ã ã‘ã§ãªãã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®å†…å®¹ãªã©ã‚‚ sniff ã™ã‚‹ã“ã¨ã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã‚’æ±ºå®šã—ã¦ã„ã‚‹ãŸã‚ã€ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã‚„ãƒ†ã‚ã‚¹ãƒˆãƒ•ã‚¡ã‚¤ãƒ«ã‚’HTMLã¨åˆ¤å®šã—ã¦ã—ã¾ã„ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒæ˜”ã‹ã‚‰ãŸã³ãŸã³å ±å‘Šã•ã‚Œã¦ã„ã¾ã—ãŸ*1ã€‚ç¾åœ¨ã¯å¹¾åˆ†ãƒžã‚·ã«ãªã£ãŸã¨ã¯ã„ãˆã€IEã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚¿ã‚¤ãƒ—ã®åˆ¤å®šã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã¯éžå¸¸ã«é›£è§£ã§ã‚ã‚Šã€ç¾åœ¨ã§ã‚‚çŠ¶æ³ã«ã‚ˆã£ã¦ã¯Webã‚µã‚¤ãƒˆé‹å–¶è€…ã®ã¾ã£ãŸãæ„å›³ã—ã¦ã„ãªã„ã‹ãŸã¡ã§ã®XSSãŒç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ãŒã‚ã£ãŸã‚Šã—ã¾ã™ã€‚ãã†ã„ã†ã‚ã‘ã§ã€IEãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ sniff ã—ã¦HTMLä»¥å¤–ã®ã‚‚ã®ã‚’HTMLæ‰±ã„ã—ã¦ã—ã¾ã†ã“ã¨ã‚’é˜²ããŸã‚ã«ã€å‹•çš„ã«ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆã«
chanpon0 2012/11/27
Content-Type-Options: nosniff ã«ã¤ã„ã¦ã€‚ãµã‚€ãƒ¼ã€‚

html

xss
ãƒªãƒ³ã‚¯
| çª“ã®ãã™ã‚Šç®±
chanpon0 2011/03/07
IE

xss

webé–‹ç™º

ä»•äº‹
ãƒªãƒ³ã‚¯
XSS/ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç† | PHPå‹‰å¼·ã—ã‚‹ã‚ˆ
ä¸€å®šæœŸé–“æ›´æ–°ãŒãªã„ãŸã‚åºƒå‘Šã‚’è¡¨ç¤ºã—ã¦ã„ã¾ã™
chanpon0 2010/12/20
xss

html

escape

security

smarty
ãƒªãƒ³ã‚¯
PHPã§ç°¡å˜ã«é…åˆ—ã®å€¤ã‚’ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‹æ–¹æ³• - ã·ãŽãŒã½ãŽ
PHPã¨ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã‚’ç™ºç”Ÿã—ãªã„ã‚ˆã†ã«ã™ã‚‹ã«ã¯å‡ºåŠ›æ™‚ã«é©åˆ‡ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã•ã›ã‚‹ã¨ã„ã†ã®ã¯ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹äººãŸã¡ã«ã¨ã£ã¦ã¯ä»Šã¯å¸¸è˜ã¨ãªã£ã¦ã„ã¾ã™ã€‚ ã—ã‹ã—ã€PHPã®ã‚ˆã†ã«ã€HTMLã«åŸ‹ã‚è¾¼ã‚“ã§åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ãªè¨€èªžã§ã¯ã¤ã„ã€Œã†ã£ã‹ã‚Šã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã‚’å¿˜ã‚Œã¦ã—ã¾ã„XSSãŒ..ã¨ã„ã†ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ CakePHPã‚„symfonyãªã©ã®ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚’ä½¿ã£ã¦ã„ã‚Œã°ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯å´ã§é©åˆ‡ã«å‡¦ç†ã•ã›ã‚‹äº‹ãŒå¯èƒ½ã§ã™ãŒã€ãã†ã„ã£ãŸãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚’ä½¿ã£ã¦ã„ãªã„ã¨ãã«ã§ãã‚‹ã ã‘ç°¡å˜ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‹æ–¹æ³•ã®ï¼‘ã¤ã‚’ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ æœ€çµ‚çš„ãªã‚µãƒ³ãƒ—ãƒ« ã©ã†ã‚„ã£ã¦å®Ÿç¾ã™ã‚‹ã‹ã¯å¾Œã«ã—ã¦å®Ÿéš›ã®ã‚µãƒ³ãƒ—ãƒ«ã§ã©ã®ã‚ˆã†ãªå‹•ä½œã«ãªã‚‹ã‹ã‚’ã¿ã¦ã¿ã¾ã—ã‚‡ã†ã€‚ <?php $str = '<script>alert("test")</script>'; $t
chanpon0 2010/12/18
é…åˆ—ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—

ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—

php

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss
ãƒªãƒ³ã‚¯
1