[B! bugbounty] hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hasegawayosuke id:hasegawayosuke

bugbountyã«é–¢ã™ã‚‹hasegawayosukeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è„†å¼±æ€§ç™ºè¦‹å ±å¥¨é‡‘åˆ¶åº¦ã®ã€Œæœ¬éŸ³ã€å¯¾è«‡ã€å¤–éƒ¨ã®ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã¨ã©ã†ä»˜ãåˆã†ã‹ï¼Ÿ
è„†å¼±æ€§ç™ºè¦‹å ±å¥¨é‡‘åˆ¶åº¦ã®é‹å–¶ãƒŽã‚¦ãƒã‚¦ã‚„è‹¦åŠ´è©±ã‚’æœ¬éŸ³ã§èªžã‚‹LINEã¨ã‚µã‚¤ãƒœã‚¦ã‚ºã®å¯¾è«‡ã€‚ç¬¬1å›žã¯ãƒ—ãƒã‚°ãƒ©ãƒ ã®æº–å‚™ã€ç¬¬2å›žã¯å¯©æŸ»ã‚„å ±å¥¨é‡‘ã®æ±ºå®šéŽç¨‹ã‚’ç´¹ä»‹ã—ãŸãŒã€ç¬¬3å›žã¯å¤–éƒ¨ã®ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã¨ã®ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹è‹¦åŠ´è©±ã‚’ç´¹ä»‹ã™ã‚‹ã€‚ å†™çœŸâ—å·¦ã‹ã‚‰ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚°ãƒãƒ¼ãƒãƒ«é–‹ç™ºæœ¬éƒ¨ å“è³ªä¿è¨¼éƒ¨ã®ä¼Šè—¤å½°å—£æ°ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚°ãƒãƒ¼ãƒãƒ«é–‹ç™ºæœ¬éƒ¨ å‰¯æœ¬éƒ¨é•·ã®ä½è—¤é‰„å¹³æ°ã€LINE ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®¤ã®æŽæ˜Žå®°æ°ã€LINE ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®¤ã®ä¸æ‘æ™ºå²æ° è¨˜è€…ã€€å ±å¥¨é‡‘ãƒ—ãƒã‚°ãƒ©ãƒ ã§ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã¨ã‚„ã‚Šå–ã‚Šã™ã‚‹éŽç¨‹ã§ã€ã©ã®ã‚ˆã†ãªç‚¹ã«è‹¦åŠ´ã—ã¾ã—ãŸã‹ã€‚ ã‚µã‚¤ãƒœã‚¦ã‚ºä¼Šè—¤æ°ã€€ã¾ãšã€ãƒžãƒ³ãƒ‘ãƒ¯ãƒ¼ã¨ã„ã†ç‚¹ã§ä¸€ç•ªå¤§å¤‰ã ã£ãŸã®ã¯ã€å ±å¥¨é‡‘ãƒ—ãƒã‚°ãƒ©ãƒ æœ¬ä½“ã§ã¯ãªãã€2014å¹´8æœˆä¸Šæ—¬ã«å®Ÿæ–½ã—ãŸã€Œãƒã‚°ãƒãƒ³ã‚¿ãƒ¼åˆå®¿ã€ï¼ˆé–¢é€£è¨˜äº‹ï¼šã‚µã‚¤ãƒœã‚¦ã‚ºãŒå®Ÿæ–½ã—ãŸã€Œãƒã‚°ãƒãƒ³ã‚¿ãƒ¼åˆå®¿ã€ï¼‰ã§ã—ãŸã€‚2æ—¥ã§50ä»¶ä»¥ä¸Šã®è„†å¼±æ€§å ±å‘Šã‚’è©•ä¾¡ã—ã¾ã—ãŸã€‚ é€šå¸¸ã®è„†å¼±æ€§ãƒ—ãƒã‚°ãƒ©ãƒ ã§ã¯ã€è©•ä¾¡çµ
hasegawayosuke 2016/04/15
bugbounty

teppeis

cybozu
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒœã‚¦ã‚ºã¨LINEãŒèªžã‚‹å ±å¥¨é‡‘åˆ¶åº¦ã€è„†å¼±æ€§å ±å‘Šã¸ã®å ±é…¬é‡‘é¡ã¯ã©ã†ã‚„ã£ã¦æ±ºã‚ã‚‹ï¼Ÿã€€
è„†å¼±æ€§ç™ºè¦‹å ±å¥¨é‡‘åˆ¶åº¦ï¼ˆãƒã‚°ãƒã‚¦ãƒ³ãƒ†ã‚£ï¼‰ã®é‹å–¶ã§é›£ã—ã„äº‹ã®ä¸€ã¤ã«ã€å ±å‘Šã•ã‚ŒãŸè„†å¼±æ€§ã‚’ã€Œå¯©åˆ¤ã€ã¨ã—ã¦ã©ã®ã‚ˆã†ã«è©•ä¾¡ã—ã€å ±å¥¨é¡ã‚’æ±ºã‚ã‚‹ã‹ã€ãŒã‚ã‚‹ã€‚å ±å¥¨é‡‘åˆ¶åº¦ã«ãŠã„ã¦ã€å¯©æŸ»ã®å®Ÿå‹™ã¨ã¯ã©ã®ã‚ˆã†ãªã‚‚ã®ãªã®ã‹ã€‚ç¬¬1å›žã«ç¶šãã€ã‚µã‚¤ãƒœã‚¦ã‚ºã¨LINEã®æ‹…å½“è€…ãŒèªžã‚‹ã€‚ å†™çœŸâ—å·¦ã‹ã‚‰ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚°ãƒãƒ¼ãƒãƒ«é–‹ç™ºæœ¬éƒ¨ å“è³ªä¿è¨¼éƒ¨ã®ä¼Šè—¤å½°å—£æ°ã€ã‚µã‚¤ãƒœã‚¦ã‚º ã‚°ãƒãƒ¼ãƒãƒ«é–‹ç™ºæœ¬éƒ¨ å‰¯æœ¬éƒ¨é•·ã®ä½è—¤é‰„å¹³æ°ã€LINE ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®¤ã®ä¸æ‘æ™ºå²æ°ã€LINE ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®¤ã®æŽæ˜Žå®°æ° è¨˜è€…ã€€å ±å‘Šã•ã‚ŒãŸè„†å¼±æ€§ã®å¯©æŸ»ã§ã¯ã€ã©ã®ã‚ˆã†ãªç‚¹ã«è‹¦åŠ´ã—ã¾ã—ãŸã‹ï¼Ÿã€€æ˜Žã‚‰ã‹ãªè„†å¼±æ€§ã§ã‚ã‚‹ã‚‚ã®ã‚’ã€Œè„†å¼±æ€§ã§ã¯ãªã„ã€ã¨è©•ä¾¡ã™ã‚Œã°ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã¯æ€’ã‚Šã¾ã™ã—ã€è©•ä¾¡ã¯å ±é…¬é¡ã«ç›´çµã™ã‚‹ã®ã§ã€é€æ˜Žæ€§ãŒãªã„ã¨ãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ã«ä¸æº€ãŒãŸã¾ã£ã¦ã—ã¾ã„ã¾ã™ã€‚ ã‚µã‚¤ãƒœã‚¦ã‚ºä¼Šè—¤æ°ã€€ã‚µã‚¤ãƒœã‚¦ã‚ºã§ã¯åŸºæœ¬çš„ã«ã€å ±å‘Šã‚’å—ã‘ãŸè„†å¼±æ€§ã®å®¢è¦³çš„ãªè©•ä¾¡åŸºæº–ã¨ã—ã¦ã€å…±é€šè„†å¼±æ€§è©•ä¾¡ã‚·ã‚¹ãƒ†ãƒ ã€ŒCVSSï¼ˆC
hasegawayosuke 2016/04/14
bugbounty

teppeis

cybozu

line
ãƒªãƒ³ã‚¯
å…ˆé€²2ç¤¾ãŒèªžã‚‹ãƒã‚°å ±å¥¨é‡‘åˆ¶åº¦ã€ã€Œã‚„ã¯ã‚Šç¤¾å†…ã§ã‚‚åå¯¾æ„è¦‹ã¯ã‚ã‚Šã¾ã—ãŸã€
ãƒã‚°ã‚’ç™ºè¦‹ã—ãŸäººã«ã€æœ€é«˜2ä¸‡ãƒ‰ãƒ«ã®å ±é…¬é‡‘ã‚’å‡ºã—ã¾ã™â€•ã€‚ ãƒ¡ãƒƒã‚»ãƒ³ã‚¸ãƒ£ãƒ¼ã‚¢ãƒ—ãƒªé–‹ç™ºã®LINEã¯ã€2015å¹´8æœˆã‹ã‚‰9æœˆã«ã‹ã‘ã€LINEã‚¢ãƒ—ãƒªã®è„†å¼±æ€§ã‚’å ±å‘Šã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å ±å¥¨é‡‘ã‚’æ”¯æ‰•ã†ã€ŒLINE Bug Bounty Programã€ã‚’å®Ÿæ–½ã—ãŸã€‚è¨ˆ200ä»¶ã®å ±å‘ŠãŒé›†ã¾ã‚Šã€LINEã¯ã“ã®ã†ã¡7äººãŒå ±å‘Šã—ãŸ14ä»¶ã®è„†å¼±æ€§ã‚’èªå®šã€1äººã«ã¤ã„ã¦ã¯æœ€é«˜é¡ã®2ä¸‡ãƒ‰ãƒ«ï¼ˆ240ä¸‡å††ï¼‰ã‚’æ”¯æ‰•ã£ãŸã€‚ è‡ªç¤¾ã®ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã‚„Webã‚µãƒ¼ãƒ“ã‚¹ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸå¤–éƒ¨ã®æŠ€è¡“è€…ï¼ˆãƒã‚°ãƒãƒ³ã‚¿ãƒ¼ï¼‰ã«å ±å¥¨é‡‘ã‚’å‡ºã™ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ã€ä¸€èˆ¬ã«ã€Œè„†å¼±æ€§ç™ºè¦‹å ±å¥¨é‡‘åˆ¶åº¦ï¼ˆãƒã‚°ãƒã‚¦ãƒ³ãƒ†ã‚£ï¼‰ã€ã¨å‘¼ã°ã‚Œã‚‹ã€‚ ç±³å›½ã§ã¯ã€ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆã‚„ã‚°ãƒ¼ã‚°ãƒ«ã®ã‚ˆã†ãªITä¼æ¥ã«åŠ ãˆã€ãƒšã‚¤ãƒ‘ãƒ«ã®ã‚ˆã†ãªITã‚µãƒ¼ãƒ“ã‚¹ä¼æ¥ã€ã•ã‚‰ã«ã¯èˆªç©ºä¼šç¤¾ã®ç±³ãƒ¦ãƒŠã‚¤ãƒ†ãƒƒãƒ‰ãƒ»ã‚¨ã‚¢ãƒ©ã‚¤ãƒ³ã‚ºã®ã‚ˆã†ãªä¸€èˆ¬ä¼æ¥ã‚‚å°Žå…¥ã—ã¦ã„ã‚‹ï¼ˆé–¢é€£è¨˜äº‹:OSãƒ™ãƒ³ãƒ€ãƒ¼ã ã‘ã˜ã‚ƒãªã„ã€ä¸€èˆ¬ä¼æ¥ã‚„æ”¿åºœã‚‚å§‹ã‚ãŸã€Œãƒã‚°ç™ºè¦‹å ±å¥¨é‡‘åˆ¶åº¦ã€
hasegawayosuke 2016/04/13
bugbounty

teppeis

cybozu

line
ãƒªãƒ³ã‚¯
M365 Bounty | MSRC
All Microsoft Global Microsoft 365 Teams Copilot Windows Surface Xbox Deals Small Business Support Software Windows Apps AI Outlook OneDrive Microsoft Teams OneNote Microsoft Edge Skype PCs & Devices Computers Shop Xbox Accessories VR & mixed reality Certified Refurbished Trade-in for cash Entertainment Xbox Game Pass Ultimate PC Game Pass Xbox games PC and Windows games Movies & TV Business Micro
hasegawayosuke 2014/09/24
Microsoft

bugbounty
ãƒªãƒ³ã‚¯
ã€Œãƒã‚°ã‚’è¦‹ã¤ã‘ã¦ãŠé‡‘ã‚’ã‚‚ã‚‰ãˆã‚‹ï¼Ÿã€ã€å„ç¤¾ãŒå§‹ã‚ã‚‹å ±å¥¨é‡‘æ–½ç–ã®ç‹™ã„ã¨ã¯
é–¢é€£ã‚ãƒ¼ãƒ¯ãƒ¼ãƒ‰ Facebook | Google | ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãƒ†ã‚¹ãƒˆ | è„†å¼±æ€§ è¿‘å¹´ã€ä¸€éƒ¨ã®å¤§æ‰‹ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ä¼æ¥ãŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è„†å¼±æ€§ã‚’ã§ãã‚‹ã ã‘æ—©ãè¦‹ã¤ã‘ã¦ä¿®æ£ã™ã‚‹ãŸã‚ã«ã€Œãƒã‚°å ±å¥¨é‡‘ãƒ—ãƒã‚°ãƒ©ãƒ ã€ã‚’å°Žå…¥ã—ã¦ã„ã‚‹ã€‚ãƒã‚°å ±å¥¨é‡‘ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’å°Žå…¥ã™ã‚‹ä¼æ¥ã‚’ã‚µãƒãƒ¼ãƒˆã™ã‚‹ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼ãƒ™ãƒ³ãƒ€ãƒ¼ã®å¸‚å ´ã‚‚æ´»ç™ºåŒ–ã—ã¦ã„ã‚‹ã€‚ã ãŒã“ã®ã‚ˆã†ãªãƒ—ãƒã‚°ãƒ©ãƒ ã¯ã€ç¤¾å†…ã§å¯¾å¿œã™ã‚‹ã‚ˆã‚Šã‚‚ã€å¤–éƒ¨ã«å§”è¨—ã™ã‚‹ã®ãŒè³¢ã„é¸æŠžè‚¢ãªã®ã ã‚ã†ã‹ï¼Ÿ ãƒã‚°å ±å¥¨é‡‘ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒã‚°ã‚’è¦‹ã¤ã‘ã¦è„†å¼±ãªã‚·ã‚¹ãƒ†ãƒ ã®æ‰€æœ‰è€…ã«å ±å‘Šã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èª¿æŸ»å“¡ã«ã€ä¼æ¥ã‹ã‚‰å ±é…¬ãŒæ”¯æ‰•ã‚ã‚Œã‚‹ã€‚é€šå¸¸ã€å ±é…¬ã¯ç¾é‡‘ã ã€‚å ±å¥¨é‡‘ã‚’æä¾›ã™ã‚‹ç›®çš„ã¯ã€ã§ãã‚‹é™ã‚Šå¤šãã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èª¿æŸ»å“¡ã®ç›®ã‚’ã‚³ãƒ¼ãƒ‰ã®è„†å¼±æ€§ã«å‘ã‘ã•ã›ã‚‹ã“ã¨ã«ã‚ã‚‹ã€‚æ•°ã‚«æœˆï½žæ•°å¹´é–“æ°—ä»˜ã‹ãªã„ã¾ã¾æ”¾ç½®ã•ã‚Œã€è„†å¼±æ€§ã¨ã—ã¦æ‚ªç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹æ¬ é™¥ã‚’ä¿®æ£ã§ãã‚‹ã“ã¨ã‚’æœŸå¾…ã—ã¦ã„ã‚‹ã€‚ ãƒã‚°ã®å ±å¥¨é‡‘ã®é‡‘é¡ã¯ä¼æ¥ã«
hasegawayosuke 2014/07/09
bugbounty
ãƒªãƒ³ã‚¯
è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã‚’é–‹å§‹ã—ã¾ã—ãŸ - Cybozu Inside Out | ã‚µã‚¤ãƒœã‚¦ã‚ºã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒ–ãƒã‚°
Cy-SIRT ã®ä¼Šè—¤ã§ã™ã€‚ ã‚µã‚¤ãƒœã‚¦ã‚ºã¯ 2014 å¹´ 6 æœˆ 19 æ—¥ã«ã€Œè„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã€ã‚’é–‹å§‹ã„ãŸã—ã¾ã—ãŸã€‚ è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ - ãƒ—ãƒ¬ã‚¹ãƒªãƒªãƒ¼ã‚¹ http://group.cybozu.jp/news/14061901.html ä»Šæ—¥ã¯ã‚µã‚¤ãƒœã‚¦ã‚ºãŒè„†å¼±æ€§æƒ…å ±å ±å¥¨é‡‘åˆ¶åº¦ã‚’é–‹å§‹ã™ã‚‹ã¾ã§ã®çµŒç·¯ã‚’ã”ç´¹ä»‹ã„ãŸã—ã¾ã™ã€‚ è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ è„†å¼±æ€§æƒ…å ±ã‚’ã©ã†å–ã‚Šæ‰±ã†ã‹ å ±å¥¨é‡‘åˆ¶åº¦ã‚’è¨è¨ˆã™ã‚‹ å¤šæ•°ã®è„†å¼±æ€§æƒ…å ±ã‚’å–ã‚Šæ‰±ã†ä½“åˆ¶ã‚’ä½œã‚‹ è‡ªç¤¾ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã®å…¬é–‹å ´æ‰€ã‚’é›†ç´„ã™ã‚‹ è„†å¼±æ€§ã®èªå®šæ–¹æ³•ã‚’å…¬é–‹ã™ã‚‹ è„†å¼±æ€§è˜åˆ¥ç•ªå·ã‚’å…¨ç¤¾ã§æ´»ç”¨ã™ã‚‹ çµ‚ã‚ã‚Šã« è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ ã‚µã‚¤ãƒœã‚¦ã‚ºãŒè„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã‚’å®Ÿæ–½ã™ã‚‹ç›®çš„ã¯ã€æœªçŸ¥ã®è„†å¼±æ€§æƒ…å ±ã‚’ã„ã¡æ—©ãç™ºè¦‹ã—ã€æ”¹ä¿®ã™ã‚‹ã“ã¨ã§ã™ã€‚ è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã¯ã€æµ·å¤–ã®å¤šãã®ä¼æ¥ã§é–‹å‚¬ã•ã‚Œã¦ã„ã¾ã™ã€‚ Vulnerability Reward Program - Google http://
hasegawayosuke 2014/06/26
bugreport

bugbounty
ãƒªãƒ³ã‚¯
mixiã®è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã«ã¤ã„ã¦ã€€çµæœ« - Shira's blog
2014-06-08 mixiã®è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã«ã¤ã„ã¦ã€€çµæœ« å‰å›žè¨˜äº‹ã‚’æ›¸ã„ãŸã“ã¨ã«ã‚ˆã‚Šmixiã‹ã‚‰ãƒ¡ãƒ¼ãƒ«ãŒæ¥ãŸã®ã§ã€çµæœ«ã‚’æ›¸ã“ã†æ€ã†ã€‚ 1. ä¸€éƒ¨è¿½åŠ ã§å ±é…¬ã‚’é ‚ã‘ãŸã€‚ SQLã®è„†å¼±æ€§ã«ã¤ã„ã¦ã¯å ±é…¬ã‚’é ‚ãã“ã¨ã¯ã§ããªã‹ã£ãŸãŒã€ä»–äººã®ãƒ‡ãƒ¼ã‚¿ã‚’é–²è¦§ãƒ»æ”¹ã–ã‚“ã§ãã‚‹è„†å¼±æ€§ã«ã¤ã„ã¦ã¯æœ€çµ‚çš„ã«ã¯mixiå´ã®åˆ¤æ–ãƒŸã‚¹ã¨ã„ã†ã“ã¨ã¨ãªã‚Šã€å ±é…¬ã‚’é ‚ãã“ã¨ãŒã§ããŸã€‚ ãªã‚“ã¨ã‹è¿½åŠ ã§å ±é…¬ã‚’é ‚ã‘ãŸã‚‚ã®ã®ã€ã“ã¡ã‚‰ã®ãƒ–ãƒã‚°ã®æ–¹ã‚‚æ›¸ã„ã¦ã„ã‚‹ãŒã€å ±é…¬ã®é¡ãŒé«˜é¡ã«ãªã‚‹ã¨ãªã«ã‹ã¨ç†ç”±ã‚’ä»˜ã‘ã¦æ”¯æ‰•ã„ã‚’æ¸‹ã£ã¦ã„ã‚‹ã‚ˆã†ã«æ„Ÿã˜ãŸã€‚ 2. mixiæœ¬ä½“ã®å•ã„åˆã‚ã›ã¯CGIã®ä¸å…·åˆã§mixiã«å±Šã„ã¦ã„ãªã‹ã£ãŸã€‚ å‰å›žã®è¨˜äº‹ã§ã€ŒãƒŸã‚¯ã‚·ã‚£ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒ¼ãƒ ã«ãƒ¡ãƒ¼ãƒ«ã‚’ã ã—ã¦ã‚‚è¿”ä¿¡ãŒãªã„ã“ã¨ã‹ã‚‰ã€ç¾åœ¨ã¯mixiæœ¬ä½“ã®ã‚µã‚¤ãƒˆã®å•ã„åˆã‚ã›ãƒšãƒ¼ã‚¸ï¼ˆhttps://developer.mixi.co.jp/inquiry/security/ï¼‰ã‹ã‚‰å•ã„åˆã‚
hasegawayosuke 2014/06/10
bugbounty

bugreport
ãƒªãƒ³ã‚¯
mixiã€ã‚°ãƒ¼ã‚°ãƒ«ã‚‚å°Žå…¥ã€€è„†å¼±æ€§å ±å‘Šã«å¯¾ã™ã‚‹å ±å¥¨é‡‘åˆ¶åº¦ã¯æµ¸é€ã™ã‚‹ã‹
ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ã‚„ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã‚’å¼•ãèµ·ã“ã™ãƒã‚°ç‰ã®ã€Œè„†å¼±æ€§æƒ…å ±ã€ã¯ã€ä¸€å®šã®æ¤œè¨¼ã‚’è¡Œã£ãŸä¸Šã§å…¬è¡¨ã—ãªã„ã¨ã€èª¤å ±ã‚„å½ã®æƒ…å ±ã‚’åºƒã‚ã‚‹ã“ã¨ã«ãªã‚Šç¤¾ä¼šã‚’æ··ä¹±ã•ã›ã¦ã—ã¾ã†ã€‚ ã‚ˆã£ã¦ã€ã“ã‚Œã‚‰ã®æƒ…å ±ã¯ã‚€ã‚„ã¿ã«å…¬è¡¨ã™ã‚‹ã®ã§ã¯ãªãã€ã¾ãšé–‹ç™ºè€…ã‚„ãƒ™ãƒ³ãƒ€ãƒ¼ã«çŸ¥ã‚‰ã›ã€å¯¾å¿œç–ã‚„ãƒ‘ãƒƒãƒãƒ—ãƒã‚°ãƒ©ãƒ ã‚’å®Œæˆã•ã›ã¦ã‹ã‚‰ä¸€æ–‰ã«å…¬é–‹ã™ã‚‹ã“ã¨ãŒæœ›ã¾ã—ã„ã¨ã•ã‚Œã¦ã„ã‚‹ã€‚ ç¾åœ¨ã€è„†å¼±æ€§æƒ…å ±ã®ãƒãƒ³ãƒ‰ãƒªãƒ³ã‚°ã«ã¤ã„ã¦ã¯ã€ä¸–ç•Œçš„ã«å…±é€šã®æž çµ„ã¿ãŒã‚ã‚Šå…±é€šã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã«ã‚ˆã£ã¦ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã”ã¨ã®å€‹ã€…ã®è„†å¼±æ€§ã¯ã™ã¹ã¦ä¸€å…ƒç®¡ç†ã•ã‚Œã¦ã„ã‚‹ã€‚ ãã®ä¸€æ–¹ã€ã“ã®ãƒãƒªã‚·ãƒ¼ã«å¯¾ã—ã¦ã€Œãƒ•ãƒ«ãƒ‡ã‚£ã‚¹ã‚¯ãƒãƒ¼ã‚¸ãƒ£ã€ã¨ã„ã†è€ƒãˆæ–¹ã‚‚ã‚ã‚‹ã€‚ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®åˆ†é‡Žã§ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚„ã‚·ã‚¹ãƒ†ãƒ ã«ç™ºè¦‹ã•ã‚ŒãŸç‰¹å®šã®è„†å¼±æ€§ã«ã¤ã„ã¦ã®æƒ…å ±ã‚’é–‹ç¤ºã™ã‚‹ã¨ã„ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å“²å¦ã ã€‚ ã™ã¹ã¦ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ã€å¤§è¡†ã®ç›£è¦–ã®ã‚‚ã¨ã‚ªãƒ¼ãƒ—ãƒ³ãªçŠ¶æ…‹ã§æ©Ÿèƒ½ã‚„å®‰å…¨æ€§ãŒç¢ºä¿ã•ã‚Œã‚‹ã¹ãã¨ã„
hasegawayosuke 2014/06/10
security

bugreport

bugbounty
ãƒªãƒ³ã‚¯
mixiè„†å¼±æ€§å ±å‘Šåˆ¶åº¦ï¼šå‚åŠ è€…ã¨ã—ã¦æ„Ÿã˜ãŸã“ã¨
WEBç³»ã®æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®å¦ç¿’ãƒ¡ãƒ¢ã§ã™ã€‚ãƒ¡ãƒ¢ãªã®ã§ä»–æƒ…å ±ã®ãƒã‚¤ãƒ³ã‚¿ã ã‘ã€ã¨ã‹ã®å‘æ€¯ãªè¨˜äº‹ã‚‚ã‚ã‚Šã¾ã™ã€‚ â€»2020.9 æ³¨è¨˜:æœ¬ãƒ–ãƒã‚°ã®è§£èª¬è¨˜äº‹ã¯å†…å®¹ãŒå¤ããªã£ã¦ãŠã‚Šã¾ã™ã€‚OWASP ZAPãªã©ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®è§£èª¬ã¯ç¾è¡Œãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®ä»•æ§˜ã‹ã‚‰ä¹–é›¢ã—ã¦ã„ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ mixiã®è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã®ç·æ‹¬è¨˜äº‹ã‚’æ›¸ã“ã†ã¨æ€ã„ã€å ±å‘Šã—ãŸè„†å¼±æ€§ã®è©•ä¾¡ãŒç¢ºå®šã™ã‚‹ã®ã‚’å¾…ã£ã¦ã„ãŸã®ã ãŒã€æœ€å¾Œã®ä¸€ä»¶ã®è©•ä¾¡ãŒãªã‹ãªã‹æˆ»ã£ã¦æ¥ãªã„ãŸã‚å•ã„åˆã‚ã›ãŸã¨ã“ã‚ã€ä¿®æ£æ–¹æ³•ã‚’å«ã‚æ™‚é–“ãŒã‹ã‹ã‚‹ã€ã¨ã®äº‹ã ã£ãŸã€‚ ãã®ãŸã‚ã€ä¸€ä»¶è©•ä¾¡ãŒæœªç¢ºå®šã®ã‚‚ã®ãŒæ®‹ã£ã¦ã¯ã„ã‚‹ãŒã€è©•ä¾¡ãŒå‡ºã‚‹ã®ã‚’å¾…ã£ã¦ã„ãŸã‚‰é…ããªã‚Šãã†ãªã®ã§ã€å…ˆã«ä»Šå›žã®è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã«å‚åŠ ã—ãŸæ„Ÿæƒ³ã‚’æ›¸ã„ã¦ã—ã¾ãŠã†ã¨æ€ã†ã€‚ å ±é…¬ å ±å‘Šã—ãŸè„†å¼±æ€§ï¼š15ä»¶ è©•ä¾¡ã•ã‚ŒãŸè„†å¼±æ€§ï¼š4ä»¶ ï¼ˆè©•ä¾¡ãŒç¢ºå®šã—ã¦ã„ãªã„ã‚‚ã®ãŒ1ä»¶æ®‹ã£ã¦ã„ã‚‹ï¼‰ ã„ãŸã ã„ãŸå ±é…¬ï¼šç¾æ™‚ç‚¹ã¾ã§ã®åˆè¨ˆ ï¿¥475,000ï¼ˆAm
hasegawayosuke 2014/05/16
bugreport

security

bugbounty
ãƒªãƒ³ã‚¯
mixiã®è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã«ã¤ã„ã¦ - Shira's blog
mixiãŒ2013å¹´9æœˆ31æ—¥ã‹ã‚‰ã¯ã˜ã‚ãŸè„†å¼±æ€§å ±å‘Šåˆ¶åº¦ã‚’åˆ©ç”¨ã—ã€ã„ãã¤ã‹ã®è„†å¼±æ€§ã®å ±å‘Šã‚’è¡Œã£ãŸã®ã§ã€ãã®çµæžœã¨ãƒŸã‚¯ã‚·ã‚£ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒ¼ãƒ ã®å¯¾å¿œã«ã¤ã„ã¦è¨˜è¼‰ã—ã‚ˆã†ã¨æ€ã†ã€‚ è„†å¼±æ€§å ±å‘Šåˆ¶åº¦ https://developer.mixi.co.jp/inquiry/security/ 1. å ±å‘Šå†…å®¹ã¨å ±é…¬ã«ã¤ã„ã¦ å¯¾è±¡ãƒ»è„†å¼±æ€§ãƒ»å ±é…¬ã‚’è¡¨ã«ã¾ã¨ã‚ã¦ã¿ãŸã€‚ å¯¾è±¡è„†å¼±æ€§å ±é…¬ Find Job! XSS 12.5ä¸‡å†† Open Redirect ï¼ˆãªã—ï¼‰ mixi Open Redirect / OpenIDæ¼ãˆã„ 6ä¸‡å†† mixi research SQL (ãƒã‚°ã‚¤ãƒ³) 50ä¸‡å†† SQL (ãƒã‚°ã‚¤ãƒ³(Ciao)) SQL (æ¤œç´¢) SQL (æ¤œç´¢(Ciao)) SQL (ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒªãƒžã‚¤ãƒ³ãƒ€) ä»–äººã®ãƒ‡ãƒ¼ã‚¿ã®é–²è¦§ãƒ»æ”¹ã–ã‚“ ï¼ˆãªã—ï¼‰ ä»–äººã®ãƒ‡ãƒ¼ã‚¿ã®é–²è¦§ ï¼ˆãªã—ï¼‰ XSS 12.5ä¸‡å†† XSS XSS
hasegawayosuke 2014/05/13
mixi

bugreport

bugbounty
ãƒªãƒ³ã‚¯
1