XSS Attack Tips / 今日ã‹ã‚‰å§‹ã‚ã‚‹XSS - http80日々ã®å¥å…¨ãªXSSã«ãŠå½¹ç«‹ã¦ãã ã•ã„。 â—極力çŸã„コードã§XSS 本題ã«å…¥ã‚‹å‰ã«è»½ãæ•´ç†ã—ã¾ã™ã€‚オーソドックスãªXSSã§ã‚ã‚Œã°ã€ãŠãªã˜ã¿ã®æ¬¡ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã«ãªã‚‹ã§ã—ょã†ã€‚ "><script>alert(document.cookie)</script> *1 ã—ã‹ã—ãªãŒã‚‰ã€Reflectedã™ã‚‹ã®ã«ã‚‚ã‹ã‹ã‚らãšã€å ´åˆã«ã‚ˆã£ã¦ã¯æ–‡å—数制é™ã¨ã„ã†å•é¡Œã«ã¶ã¡å½“ãŸã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã‹ã¨æ€ã‚ã‚Œã¾ã™ã€‚ãã®å ´åˆã€ã‚ˆã‚ŠçŸã„コードã§XSSã‚’æˆåŠŸã•ã›ã‚‹å¿…è¦æ€§ãŒã‚ã‚Šã¾ã™ã€‚ã©ã“ã«Reflectedã•ã‚Œã‚‹ã‹ã«ã‚ˆã£ã¦æ›¸ãæ–¹ã¯å¤‰ã‚ã‚Šã¾ã™ãŒã€å¤§ã¾ã‹ã«ã¯ä¸‹è¨˜ã®ã©ã‚Œã‹ã«ãªã‚‹ã§ã—ょã†ã€‚ â—†HTML Body(HTML構文内) BAD: <input type="text" value="<?php echo $GET['name']; ?>"> PoC: "><script>alert(1)</script> (28æ–‡å—) PoC
elasticsearch-ruby ã§å¤–部入力ã‹ã‚‰æ¤œç´¢æ™‚ã® json 用文å—列ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—処ç†
SQL Injection | OWASP Foundation
{{#tags}}- {{label}}
{{/tags}}