[B! UTF-7] hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hasegawayosuke id:hasegawayosuke

UTF-7ã«é–¢ã™ã‚‹hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (16)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

currentStyle ã‚’åˆ©ç”¨ã—ãŸ CSSXSS ã‚‚ IE å´ã§å¯¾ç–æ¸ˆã¿ã‚‰ã—ã„ - miauã®ãƒ–ãƒã‚°
ä»Šã‚„ã£ã¦ã‚‹æ¡ˆä»¶ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–æ–¹é‡ã¿ãŸã„ãªã®ã‚’æ±ºã‚ã¦ã„ã‚‹ã¨ã“ã‚ãªã‚“ã§ã™ãŒã€‚ã„ã‚ã„ã‚èª¿ã¹ã¦ã‚‹ã¨ CSSXSSã‚’æ”¹è‰¯ã—ãŸï¼Ÿæ‰‹æ³•ã§mixiã®post_keyã‚’æŠœãå–ã‚‹ãƒ‡ãƒ¢ã‚’ä½œã‚Šã¾ã—ãŸ - ?D of K ã¨ã„ã†ãƒšãƒ¼ã‚¸ãŒå‡ºã¦ãã¦ã€‚ã“ã‚Œã¯æœ¬è³ªçš„ã«ã¯ IE ã®è„†å¼±æ€§ã«ã¤ã„ã¦ã®è¨€åŠãªã‚“ã§ã™ãŒã€ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ã‚„ã‚³ãƒ¡ãƒ³ãƒˆã‚’è¦‹ã¦ã‚‚ã€ŒMS ã«å ±å‘Šã—ãŸã€ã¨ã‹ã€Œä¿®æ£ã•ã‚ŒãŸã€ã¨ã‹ã„ã†æƒ…å ±ãŒè¦‹å½“ãŸã‚‰ãªãã¦ãšã„ã¶ã‚“æŒ¯ã‚Šå›žã•ã‚Œã¦ã—ã¾ã£ãŸã®ã§ãã®ãŠè©±ã€‚ çµè«–ã¨ã—ã¦ã¯ã€MS10-071 ã§å¯¾ç–æ¸ˆã¿ãªã®ã§ã€ã¡ã‚ƒã‚“ã¨ãƒ‘ãƒƒãƒã‚’å…¨éƒ¨ã‚ã¦ã¦ã„ã‚‹ IE ã§ã¯æ°—ã«ã—ãªãã¦ã„ã„è©±ã®ã‚ˆã†ã§ã™ã€‚ CSSXSS ã«ã¤ã„ã¦ 2006 å¹´ãã‚‰ã„ã«æµè¡Œã£ãŸ IE6 ã®è„†å¼±æ€§ã‚’çªã„ãŸæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚æ¦‚è¦ã¨ã—ã¦ã¯ã€ CSSã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®æƒ…å ±æ¼ãˆã„ã®è„†å¼±æ€§ã€ŒCSSXSSã€ã¨ã¯ âˆ’ ï¼ IT ã“ã¡ã‚‰ãŒå›³ã‚‚è¼‰ã£ã¦ã„ã¦ã‚ã‹ã‚Šã‚„ã™ã„ã§ã™ã€‚ ã“ã®è„†å¼±æ€§ã¯ CSSXSS
hasegawayosuke 2011/08/01
ã‚ã¨ã§

ie

utf-7
ãƒªãƒ³ã‚¯
MFSA 2010-61: object è¦ç´ ã® type å±žæ€§ã‚’ä½¿ã£ã¦ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã®æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚’ä¸Šæ›¸ãã™ã‚‹ã“ã¨ã«ã‚ˆã‚‹ UTF-7 XSS
hasegawayosuke 2010/09/08
Firefox

utf-7
ãƒªãƒ³ã‚¯
HTML | <meta charset="utf-7">+ADwAcwB - UTF-7 - bv2TybT9 - Pastebin.com
hasegawayosuke 2010/04/23
firefox

utf-7
ãƒªãƒ³ã‚¯
J2EEä»•æ§˜ã®å•é¡Œã«ã¤ã„ã¦è€ƒãˆã‚‹ - masa141421356â€™s blog
Windows-31JãŒUTF-7ã«ã‚ˆã‚‹XSSã®è¦å› ã«ãªã‚‹ã“ã¨ã¯ã‚ˆãçŸ¥ã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦æ¥ã¾ã—ãŸãŒã€ä¾ç„¶ã¨ã—ã¦MS932ã‚„Windows-31JãŒä½¿ã‚ã‚Œã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ç”Ÿç”£ã•ã‚Œç¶šã‘ã¦ã„ã¾ã™ã€‚ ãã®åŽŸå› ã®ï¼‘ã¤ã¯J2EEã®ã‚µãƒ¼ãƒ–ãƒ¬ãƒƒãƒˆåŠã³JSPã®APIã®ä»•æ§˜ã®æ¬ é™¥ã«ã‚ã‚‹ã®ã§ã¯ãªã„ã‹ã¨æœ€è¿‘æ€ã†ã‚ˆã†ã«ãªã£ã¦ãã¾ã—ãŸã€‚ javax.servlet.ServletResponse ã‚„ JSP ã®ä»•æ§˜ã§ã¯ã€ æ–‡å—åˆ—â†’ãƒã‚¤ãƒˆåˆ—ã¸ã®å¤‰æ›ã«ä½¿ç”¨ã™ã‚‹å¤‰æ›ãƒ†ãƒ¼ãƒ–ãƒ«å HTTPã®Content-typeãƒ˜ãƒƒãƒ€ã«åŸ‹ã‚è¾¼ã‚“ã§ãƒ–ãƒ©ã‚¦ã‚¶ã«é€ä¿¡ã•ã‚Œã‚‹ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°å ã®ï¼’ã¤ã«åŒã˜ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã‚’ä½¿ã†äº‹ã«ãªã£ã¦ã„ã‚‹ã®ã§ã€ Shift_JIS ã§ç‰¹å®šã®æ–‡å—ãŒæ–‡å—åŒ–ã‘ã—ã¦ã—ã¾ã†ã®ã‚’é˜²ããŸã‚ã« Windows-31J ã«ã‚ˆã‚‹å¤‰æ›ã‚’è¡Œã†æ§˜ã«æŒ‡å®šã™ã‚‹ã«ã¯ã€Content-typeãƒ˜ãƒƒãƒ€ã«åŸ‹ã‚è¾¼ã‚€ã®ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°åã« W
hasegawayosuke 2009/09/14
ã•ã„ãã‚“ã®IEã¯"Windows-31J"ã‚’èªè˜ã™ã‚‹ã‚ˆã†ãªã€‚ã‚ã¨ã§ç¢ºã‹ã‚ã‚‹ã€‚// å‡ã£ãŸå¯¾ç–ã®ãƒ•ã‚£ãƒ«ã‚¿ã¯å®‰ç›´ã«ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’æ›¸ãæ›ãˆã§ãŠï½‹

xss

utf-7
ãƒªãƒ³ã‚¯
Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection
If you donâ€™t rem ember, there was an important XSS vulnerability reported in all major browsers a while ago â€“ IE7, Firefox and Opera. More Information is available in theÂ SecuniaÂ advisoriesÂ here. The vulnerability was that if you donâ€™t specify a charset in your application page, then it is susceptible to inherit the charset in the parent page via iframes. So, if you accidently land on an evil site,
hasegawayosuke 2009/05/13
IE8ã ã¨åŒä¸€ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ãªã„ã¨iframeã®charsetã‚’ç¶™æ‰¿ã—ãªã„ã‘ã©ã€åframeãŒå¤–ã«302ã—ãŸã¨ãã¯çµæžœçš„ã«ãƒ‰ãƒ¡ã‚¤ãƒ³ãŒç•°ãªã£ã¦ã‚‚charsetãŒç¶™æ‰¿ã•ã‚Œã‚‹ã€‚ã£ã¦ã“ã¨ï¼Ÿ ã‚ã¨ã§è©¦ãã†ã€‚

ie8

UTF-7

xss
ãƒªãƒ³ã‚¯
Inline UTF-7 E4X javascript hijacking
Inline UTF-7 E4X javascript hijacking Tuesday, 24 February 2009 I finally get to talk about this because Yosuke Hasegawa has already disclosed the IE/FF variant with JSON data. I also discovered the UTF-7 JSON hacking independently but I wasnâ€™t aware it was public so I didnâ€™t blog about it. Just in case you havenâ€™t, you should check out his presentation itâ€™s awesome! Anyway onto E4X I just love it
hasegawayosuke 2009/02/26
ã“ã®æ‰‹æ³•ã¯ç§˜å¯†ã«ã—ã¦ãŸã®ã«ã€ã°ã‚Œã¦ã—ã¾ã£ãŸï½—

e4x

utf-7

javascript
ãƒªãƒ³ã‚¯
a threadless kite - ç³¸ã®åˆ‡ã‚ŒãŸå‡§
ã“ã“ã¯ã€ç®¡ç†äººyamagataãŒæ–¹é‡æœªå®šã®ã¾ã¾ã€ä½•ã¨ãªãƒ¼ãæ€ã„ã¤ã„ãŸã“ã¨ã‚’æ€ã„ã¤ã„ãŸã¾ã¾ã«ã ã‚‰ã ã‚‰ã¨æ›¸ãä»˜ã‘ã‚‹æ—¥è¨˜å¸³ã§ã™ã€‚ãµã‚“ã‚ã‚Šã»ã‚“ã‚ã‹ãªæ„Ÿã˜ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚
hasegawayosuke 2009/02/16
charset

waf

xss

utf-7
ãƒªãƒ³ã‚¯
RFC 2060: Internet Message Access Protocol - Version 4rev1
Network Working Group M. Crispin Request for Comments: 2060 University of Washington Obsoletes: 1730 December 1996 Category: Standards Track INTERNET MESSAGE ACCESS PROTOCOL - VERSION 4rev1 Status of this Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the
hasegawayosuke 2009/01/25
RFC

imap

UTF-7
ãƒªãƒ³ã‚¯
RFC 2152: UTF-7 A Mail-Safe Transformation Format of Unicode
hasegawayosuke 2009/01/25
RFC

Unicode

UTF-7
ãƒªãƒ³ã‚¯
UTF-7ã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã•ã›ã‚‹XSSã«ã¤ã„ã¦
IEã§UTF-7ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’iframeã®ä¸ã«è¡¨ç¤ºã™ã‚‹ã¨XSSãŒç™ºç”Ÿã™ã‚‹ãƒ¡ãƒ¢ã§ã™ã€‚ ã‚ã‚“ã¾ã‚Šã“ã®è©±ã«ã¯è©³ã—ããªã„ã®ã§ã€ä»Šå¾Œã®èª¿æŸ»ææ–™ã¨ã—ã¦æ®‹ã—ã¨ãã¾ã™ã€‚ ï¼ˆâ€»ä¸€å¿œæ‚ªç”¨åŽ³ç¦ã§ã‚ã‚Šã¾ã™ï¼ï¼‰ iframeå†…ã®ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ãŒæ£ã—ãæŒ‡å®šã•ã‚Œã¦ã„ãªã„å ´åˆã¯ã€ãã®iframeã®è¦ªã«ã‚ãŸã‚‹éƒ¨åˆ†ã®ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ãŒè‡ªå‹•çš„ã«é©ç”¨ã•ã‚Œã‚‹ã¨ã„ã†IEã®ãƒã‚°ãŒã‚ã‚‹ã¿ãŸã„ã€‚ ä»Šå›žã¯ãã‚Œã®ã¡ã‚‡ã“ã£ã¨ã—ãŸæ¤œè¨¼ï¼ 1ç•ªåˆã‚ã«å‘¼ã°ã‚Œã‚‹htmlï¼ˆâ‘ .htmlï¼‰ <html> <head> <title> </title> </head> <body> <script type="text/javascript"> window.onload = function(){ var iframe = document.createElement('iframe'); iframe.src = '/utf7XSS/utf7XSS'; docu
hasegawayosuke 2008/11/10
æ”»æ’ƒã™ã‚‹äººä»¥å¤–ã¯ç´°ã‹ãªã“ã¨è€ƒãˆãšã€ã¨ã«ã‹ããƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§charset=utf-8 or EUC-JP ã‚’æ˜Žè¨˜ã™ã‚Œã°ã„ã„ã€‚

xss

UTF-7
ãƒªãƒ³ã‚¯
http://kazuhooku.com/~kazuho/decodeutf7.user.js
hasegawayosuke 2008/08/27
utf-7

neta
ãƒªãƒ³ã‚¯
Files â‰ˆ Packet Storm
apache-utf7xss.txt Posted May 9, 2008 Authored by Yaniv Miron, Yossi Yakubov Apache versions 2.2.x and 1.3.x suffer from a cross site scripting vulnerability leveraging UTF-7 encoding on 403 forbidden pages. tags | exploit, xss SHA-256 | 8fffd3a81ffabcbd3507f0163054297820bd7db26ac5b1589bffae4cacbe171d Download | Favorite | View
hasegawayosuke 2008/05/17
xss

UTF-7
ãƒªãƒ³ã‚¯
http://openmya.hacker.jp/hasegawa/public/20071107/s6/h6.html?file=datae.txt
hasegawayosuke 2007/11/28
è‹±èªžã§æ›¸ã‘ã¨ã‹å‰ã«è¨€ã‚ã‚Œã¦ãŸã‚ˆã†ãªæ°—ãŒã™ã‚‹ã®ã§æ›¸ã„ã¦ã¿ãŸã€‚ã‘ã©ã€è‹±èªžå…¨ç„¶ãƒ€ãƒ¡ã orz

XSS

ã‚»ãƒ«ã‚¯ãƒž

UTF-7
ãƒªãƒ³ã‚¯
NVD - CVE-2007-5415
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
hasegawayosuke 2007/10/17
Firefoxã®gopherã§UTF-7ã‚’ä½¿ã£ã¦XSS

gopher

XSS

UTF-7
ãƒªãƒ³ã‚¯
Apache 2.2.5 Undefined Charset UTF-7 XSS Vulnerability - CXSecurity.com
hasegawayosuke 2007/09/13
xss

apache

utf-7
ãƒªãƒ³ã‚¯
æœªçŸ¥ã®ãœã„å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸã€‚ã©ãƒ¼ã™ã‚“ã®ï¼ï¼Ÿã‚ªãƒ¬ï¼ˆãã®1ï¼‰
ã„ããªã‚Šè³ªå•ã§ã™ã€‚æœªçŸ¥ã®ãœã„å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸã‚‰çš†ã•ã‚“ã¯ã©ã†ã—ã¾ã™ã‹ï¼Ÿ è‡ªåˆ†ãŒæœªçŸ¥ã®ãœã„å¼±æ€§ã‚’ç™ºè¦‹ã™ã‚‹ã“ã¨ã¯ç„¡ã„ã¨æ€ã‚ã‚Œã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒï¼Œã˜ã¤ã¯èº«è¿‘ã«å˜åœ¨ã—ã¦ã„ã‚‹ã®ã«ä»Šã¯æ°—ä»˜ã„ã¦ã„ãªã„ã ã‘ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚çš†ã•ã‚“ãŒãœã„å¼±æ€§ã‚’ç™ºè¦‹ã—ã¦å ±å‘Šã™ã‚‹æ—¥ã¯è¿‘ã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã®ã§ï¼Œä»Šå›žã¯ç§ã®çµŒé¨“ã‚’åŸºã«ãœã„å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸã‚‰ã©ã†ã™ã‚‹ã‹ã«ã¤ã„ã¦æ›¸ããŸã„ã¨æ€ã„ã¾ã™ã€‚ ç§ã¯ä»Šã¾ã§ã«ä½•ä»¶ã‹ãœã„å¼±æ€§ã‚’ç™ºè¦‹ã—ã¦ï¼Œã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã®é–‹ç™ºå…ƒã«å ±å‘Šã—ãŸã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚æœ€è¿‘ã§ã¯ã€ŒMS06-053ã€ï¼ˆhttp://www.microsoft.com/japan/tech net/security/bulletin/ms06-053.mspxï¼‰ã§ä¿®æ£ã•ã‚ŒãŸãœã„å¼±æ€§ã‚’å ±å‘Šã—ã¾ã—ãŸã€‚ã¾ãšã¯ï¼Œã“ã®ãœã„å¼±æ€§ã®ç™ºè¦‹ã‹ã‚‰å ±å‘Šã¾ã§ã®æµã‚Œã‚’èª¬æ˜Žã—ã¾ã—ã‚‡ã†ã€‚ 2005å¹´12æœˆã«ã€Œwww.google.comã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ãœã„å¼±æ€§ï¼Œç±³W
hasegawayosuke 2007/04/20
ãã‚Œã€é–“é•ã„ã§ã™(ãŸã¶ã‚“)ã€‚æ—¥æœ¬èªžç‰ˆã§ã‚‚æˆåŠŸã™ã‚‹ã¨æ€ã†ã€‚ï¼žã€Žæ—¥æœ¬èªžç‰ˆã®IISã§ã¯æ”»æ’ƒãŒæˆåŠŸã—ã¾ã›ã‚“ãŒï¼Œè‹±èªžç‰ˆãªã‚‰æ”»æ’ƒãŒæˆåŠŸã™ã‚‹ã€

XSS

UTF-7

Unicode

Microsoft

security

æ–‡å—ã‚³ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
1