[B! XSS] hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hiroponz id:hiroponz

XSSã«é–¢ã™ã‚‹hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢
ã“ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã®èª¬æ˜Žãƒ»æ³¨æ„ãªã© PHP ã¯ã€Apache ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚„ã€CGIã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã¨ã—ã¦ä½¿ç”¨ã§ãã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã§ã™ã€‚ã“ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€ä¸»ã« PHP ã«ãŠã‘ã‚‹ã€Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã¨ã—ã¦ã¯ã€ä»¥ä¸‹ã®å•é¡Œã«ã¤ã„ã¦ã‚ˆãå–ã‚ŠæŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã‚Œã‚‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦èª¿ã¹ãŸã“ã¨ã‚„ã€ã“ã‚Œã‚‰ä»¥å¤–ã§ã‚‚ã€PHP ã«é–¢é€£ã—ã¦ã„ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã«ã¤ã„ã¦çŸ¥ã£ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦ãƒ¡ãƒ¢ã—ã¦ãŠãã¾ã™ã€‚ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° SQL ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ãƒ‘ã‚¹ãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«) ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã¾ãŸã€PHP ãƒžãƒ‹ãƒ¥ã‚¢ãƒ« : ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚„ã€PHP Security Guide (PHP Security Consortium) ã«ã¯ã€PH
hiroponz 2008/10/20
*programming

security

php

xss

later
ãƒªãƒ³ã‚¯
è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ6ï¼‰ --- ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå¾Œç·¨ï¼‰
ãƒã‚¤ãƒ³ãƒˆ â—Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒæŒã¤ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒåˆ©ç”¨ã•ã‚Œã‚‹ã¨ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ã®CookieãŒè©å–ã•ã‚ŒãŸã‚Šã™ã‚‹æ”»æ’ƒãŒæˆã‚Šç«‹ã¤ã€‚ â—Cookieæƒ…å ±ã®è©å–ã¨ï¼Œã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒ»ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°ã‚„ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ï¼ˆè©æ¬ºã®æ‰‹å£ï¼‰ãŒçµ„ã¿åˆã‚ã•ã£ã¦ï¼Œè¢«å®³ã«åŠã¶ã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹ â—ã“ã®ã‚ˆã†ãªè¢«å®³ã‚’å‡ºã•ãªã„ã‚ˆã†ã«ã™ã‚‹ã«ã¯ï¼Œé–‹ç™ºè€…ã¯è„†å¼±æ€§ã®ç„¡ã„Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹å¿…è¦ãŒã‚ã‚‹ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ï¼Œãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºãªã©ã¸ã®å¯¾ç–ã¨åŒæ§˜ã«ï¼Œã€Œä¿¡é ¼ã®ãŠã‘ãªã„ãƒªãƒ³ã‚¯ã¯ã‚€ã‚„ã¿ã«ã‚¯ãƒªãƒƒã‚¯ã—ãªã„ã€ã€Œä¸å¯©ãªURLã«ã¯ã‚¢ã‚¯ã‚»ã‚¹ã—ãªã„ã€ãªã©ã®ç¿’æ…£ã‚’èº«ã«ã¤ã‘ã¦ãŠãå¿…è¦ãŒã‚ã‚‹ â—†Cookieã¯ï¼ŒWebã‚µã‚¤ãƒˆãŒç™ºè¡Œã—ãŸãƒ†ã‚ã‚¹ãƒˆãƒ»ãƒ‡ãƒ¼ã‚¿ã§ã™ã€‚ã‚»ãƒƒã‚·ãƒ§ãƒ³æƒ…å ±ã‚„èªè¨¼æƒ…å ±ãªã©ãŒè¨˜è¿°ã•ã‚Œã¦ãŠã‚Šï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼PCã®ãƒ–ãƒ©ã‚¦ã‚¶ã«ä¿å˜ã•ã‚Œã¾ã™ã€‚åŸºæœ¬çš„ã«ï¼Œã“ã®æƒ…å ±ã‚’åˆ©ç”¨ã§ãã‚‹ã®ã¯ç™ºè¡Œã—ãŸWebã‚µã‚¤ãƒˆã ã‘ã§ã™ã€‚ â—†å®Ÿé¨“ç”¨ã«ä½œã£ãŸè²·ã„ç‰©ã‚µã‚¤ãƒˆï¼ˆ19
hiroponz 2007/02/28
XSS

security

è§£èª¬
ãƒªãƒ³ã‚¯
è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ5ï¼‰ --- ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå‰ç·¨ï¼‰
ãƒã‚¤ãƒ³ãƒˆ â—Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ã«é€ä¿¡ã™ã‚‹ãƒšãƒ¼ã‚¸ï¼ˆã‚³ãƒ³ãƒ†ãƒ³ãƒ„ï¼‰ã‚’å‹•çš„ã«ä½œã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ã“ã®æ™‚ã«ï¼ŒåŠè§’ï¼œï¼žãªã©ã®ç‰¹æ®Šæ–‡å—ã‚’é©åˆ‡ã«å‡¦ç†ã—ã¦ã„ãªã„ã¨ï¼Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã«ã¤ãªãŒã‚‹ â—Cookieã¨ã¯ï¼ŒWebã‚µãƒ¼ãƒãƒ¼ã‚’è¨ªå•ã—ãŸäººã®ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ï¼ˆãƒ–ãƒ©ã‚¦ã‚¶ï¼‰ã«ï¼Œãƒ†ã‚ã‚¹ãƒˆãƒ»ãƒ‡ãƒ¼ã‚¿ã‚’ä¿å˜ã—ã¦ãŠãä»•çµ„ã¿ã®ã“ã¨ã€‚èªè¨¼æƒ…å ±ã‚„å€‹äººçš„ãªæƒ…å ±ãŒå…¥ã£ã¦ã„ã‚‹å ´åˆãŒã‚ã‚‹ãŸã‚ï¼Œæ”»æ’ƒã®çš„ã«ãªã‚Šã‚„ã™ã„ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¯ï¼Œã“ã‚Œã¾ã§ã«ç´¹ä»‹ã—ã¦ããŸä»–ã®æ”»æ’ƒæ‰‹æ³•ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«ï¼ŒOSã‚³ãƒžãƒ³ãƒ‰ãƒ»ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ï¼ŒSQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ï¼‰ã¨åŒæ§˜ã«Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’çªãæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ãŸã ã—ï¼Œåå‰ã®é€šã‚Šï¼Œã‚µã‚¤ãƒˆã‚’ã‚¯ãƒã‚¹ã—ã¦ï¼ˆã¾ãŸãŒã£ã¦ï¼‰å®Ÿè¡Œã•ã‚Œã‚‹ãŸã‚ï¼Œã—ãã¿ãŒè¤‡é›‘ã«ãªã£ã¦ã„ã¾ã™ã€‚ ã“ã®é€£è¼‰ã§ã¯ï¼Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ä¾‹ã¨ã—ã¦ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼PCã®Cookieã®å†…å®¹ã‚’è©å–ã™
hiroponz 2007/02/21
XSSè„†å¼±æ€§ã®ã‚ã‚‹å ´åˆã¨ãªã„å ´åˆã®æ¯”è¼ƒã‚µãƒ³ãƒ—ãƒ«ã‚’ç´¹ä»‹

security

XSS

èªã¿ç‰©

sample

later
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

XSSã«é–¢ã™ã‚‹hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

XSSã«é–¢ã™ã‚‹hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚­ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢

è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ6ï¼‰ --- ã‚¯ãƒ­ã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå¾Œç·¨ï¼‰

è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ5ï¼‰ --- ã‚¯ãƒ­ã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå‰ç·¨ï¼‰

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (8)

XSSã«é–¢ã™ã‚‹hiroponzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

PHP ã¨ Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢

è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ6ï¼‰ --- ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå¾Œç·¨ï¼‰

è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ‰‹æ³•ï¼ˆ5ï¼‰ --- ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆå‰ç·¨ï¼‰

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹