サーãƒã‹ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«é€ä¿¡ã™ã‚‹æŠ€è¡“ - WebSocketã‚’ä¸å¿ƒã« - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article? Webã§ã®ãƒ—ッシュ技術 HTTPã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ–ラウザ）ã‹ã‚‰ãƒªã‚¯ã‚¨ã‚¹ãƒˆã—ã¦ã‚µãƒ¼ãƒã‹ã‚‰ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãŒè¿”る一å•ä¸€ç”åž‹ã®ãƒ—ãƒãƒˆã‚³ãƒ«ãªã®ã§ã€åŸºæœ¬çš„ã«ã¯ã‚µãƒ¼ãƒå´ã‹ã‚‰ãƒ–ラウザã«æ–°ç€æƒ…å ±ã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§é€šçŸ¥ï¼ˆãƒ—ッシュ）ã§ãるよã†ã«ã¯ã§ãã¦ã„ã¾ã›ã‚“。 ã—ã‹ã—ãã‚Œã§ã‚‚プッシュをã—ãŸã„ã¨ã„ã†å ´åˆã«ã©ã†ã™ã‚‹ã‹ã¨ã„ã†è©±ãŒå‡ºã¦ãã¾ã™ã€‚ã‚„ã‚Šæ–¹ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªã‚‚ã®ãŒã‚ã‚Šã¾ã™ã€‚ ãƒãƒ¼ãƒªãƒ³ã‚° クライアントã‹ã‚‰ã‚µãƒ¼ãƒã«å®šæœŸçš„ã«æ–°ç€ã‚’å•ã„åˆã‚ã›ã‚‹ã‚ˆã†ã«ã—ã¾ã™ã€‚ 最も原始的ã‹ã¤ç¢ºå®Ÿãªã‚„ã‚Šæ–¹ã€‚æ¬ ç‚¹ã¯ã€æœ€å¤§ã§ãƒãƒ¼ãƒªãƒ³ã‚°é–“éš”ã®åˆ†ã ã‘通知ãŒé…延ã—ã†ã‚‹ã“ã¨ã§ã™ã€‚ ãƒãƒ³ã‚°ãƒãƒ¼ãƒªãƒ³ã‚°ï¼ˆâ€œC
Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token - Detectify Labs
Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token TLDR; I was able to create a malicious page that would reconnect your Slack WebSocket to my own WebSocket to steal your private Slack token. Slack fixed the bug in 5 hours (on a Friday) and paid me $3,000 for it. Recently a bug I found in Slack was published on HackerOne and I wanted to explain it, and the method
WebSocket Echo Server - Free Testing Tool for Real-Time Applications
The WebSocket Echo Server at echo.websocket.org is a free, publicly available testing endpoint that has become an essential tool for developers working with real-time web technologies. This server provides instant echo responses for WebSocket connections, Server-Sent Events (SSE), and standard HTTP requests, making it invaluable for testing, debugging, and validating real-time implementations. Unl
WebSocketã‚’ç ”ç©¶ã—ã¦ã¿ãŸ | ワークフãƒãƒ¼ã‚·ã‚§ã‚¢No.1ã€€æ ªå¼ä¼šç¤¾ã‚¨ã‚¤ãƒˆãƒ¬ãƒƒãƒ‰
ã“ã‚“ã«ã¡ã¯ï¼ã€€ã‚¨ã‚¤ãƒˆãƒ¬ãƒƒãƒ‰æŠ€è¡“部和田ã§ã™ï¼ エイトレッドã§ã¯æ¯Žæœˆãƒ†ãƒ¼ãƒžã‚’決ã‚ã¦ã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒæŒã¡å›žã‚Šã§å‹‰å¼·ä¼šã‚’実施ã—ã¦ã„ã¾ã™ã€‚ 世間ã‹ã‚‰ã¯ï¼“週ãらã„é…ã‚Œã¦ã‚‹æ°—ã‚‚ã—ã¾ã™ãŒã€å…ˆæ—¥ã¯WebSocketをテーマã«å‹‰å¼·ä¼šã‚’ è¡Œã„ã¾ã—ãŸã®ã§ã€ä»Šå›žãã®å†…容をダイジェスト版ã§ãŠé€ã‚Šã—ã¾ã™ã€‚ 1．WebSocketã¨ã¯ï¼Ÿ ãã‚‚ãã‚‚WebSocketã¨ã¯ä½•ãªã®ã§ã—ょã†ã‹ï¼Ÿ WebSocketã¨ã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ–ラウザ）ã¨ã‚µãƒ¼ãƒé–“㧠本当ã®æ„味ã§ã®å…¨äºŒé‡ï¼ˆåŒæ–¹å‘）通信を行ã†ãŸã‚ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã™ã€‚ ã‚‚ã¨ã‚‚ã¨ã¯HTML5ã®ä¸€éƒ¨ã¨ã—ã¦ã€ä»•æ§˜ã®ç–定ãŒé€²ã‚られã¦ã„ã¾ã—ãŸãŒ ãã®å¾Œç‹¬ç«‹ã—ã€å˜ä½“ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã¨ã—ã¦ä»•æ§˜ç–定ãŒé€²ã‚られã¦ã„ã¾ã™ã€‚ WebSocketã®ç‰¹å¾´ã¨ã—ã¦ã¯æ¬¡ã®ç‚¹ãŒã‚ã’られã¾ã™ã€‚ TCP上ã§å‹•ä½œ デフォルトãƒãƒ¼ãƒˆã¯ 80番 ã¾ãŸã¯ 443番 明示的ã«åˆ‡æ–ã—ãªã„é™ã‚ŠæŽ¥ç¶šã•ã‚Œç¶šã‘る⇒効率的ã«åŒæ–¹å‘通信ãŒ
コラム- Ruby ＆ Rails | 第12回　WebSocketã§ã‚µãƒ¼ãƒãƒ—ッシュ｜CTC教育サービス ç ”ä¿®/トレーニング
[ITç ”ä¿®]注目ã‚ーワード Python UiPath(RPA) æœ€æ–°æŠ€è¡“å‹•å‘ Microsoft Azure Docker Kubernetes 第12回　WebSocketã§ã‚µãƒ¼ãƒãƒ—ッシュ (æ¾æ°¸ç´˜) 2014å¹´3月 2/18ã«Rails3.2.17ã€4.0.3ã€åŠã³4.1.0.beta2（*1）ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸï¼ˆ*2）。ã“れらã¯å‰å›žã®ã‚¢ãƒƒãƒ—デートåŒæ§˜ã€DoS攻撃やXSSã®è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç·Šæ€¥åº¦ã®é«˜ã„ã‚»ã‚ュリティフィックスã®ã‚ˆã†ã§ã™ã®ã§ã€ã§ãã‚‹ã ã‘æ—©ãアップデートã™ã‚‹ã“ã¨ã‚’ãŠå‹§ã‚ã„ãŸã—ã¾ã™ã€‚ ã•ã¦è©±ã¯å¤‰ã‚ã‚Šã¾ã™ãŒã€1/25～26ã«ã‹ã‘ã¦é–‹å‚¬ã•ã‚ŒãŸã€ŒSECCON 2013 CTF オンライン予é¸ï¼ˆ*3）ã€ã«å‚åŠ ã—ã¦ã¿ã¾ã—ãŸã€‚ã“ã®äºˆé¸ã¯ã€ŽIT技術やセã‚ュリティã«é–¢ã™ã‚‹5ã¤ã®ã‚¸ãƒ£ãƒ³ãƒ«ã€Œãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯ã‚¹ã€ã€Œãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æš—å·ã€ã€Œãƒã‚¤ãƒŠãƒªã€ã€Œãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ»Webã€ã€Œãã®ä»–・トリビアã€ã‹ã‚‰è¨ˆ2
ã“ã‚Œã¯é¢ç™½ã„。WebSocketを使ã£ãŸWebベースã®ã‚¿ãƒ¼ãƒŸãƒŠãƒ«Â·ws-io MOONGIFT
ws-ioã¯WebSocketã¨I/Oを組ã¿åˆã‚ã›ã‚‹ã“ã¨ã§Webベースã®ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ã‚’実ç¾ã™ã‚‹ã€‚ ws-ioã¯Ruby製ã®ã‚ªãƒ¼ãƒ—ンソース・ソフトウェア。HTML5ã§æ–°ã—ãç™»å ´ã—ãŸæ©Ÿèƒ½ã¯å¹¾ã¤ã‚‚ã‚ã‚‹ãŒã€ãã®ä¸ã§ã‚‚特殊ãªä½ç½®ã«ã‚ã‚‹ã®ãŒWebSocketã§ã¯ãªã„ã ã‚ã†ã‹ï¼ˆä»•æ§˜ã‹ã‚‰ã¯åˆ‡ã‚Šé›¢ã•ã‚Œã¦ã„ã‚‹ãŒï¼‰ã€‚ã“ã‚Œã¾ã§ã«ãªã‹ã£ãŸã‚½ã‚±ãƒƒãƒˆé€šä¿¡ã‚’ã©ã†æ´»ã‹ã™ã‹ãŒå•é¡Œã 。 Web上ã§irb ãã®ãŸã‚ã€å‡ºã¦ã„ã‚‹ã‚‚ã®ã‚‚ãƒãƒ£ãƒƒãƒˆãらã„ãŒãƒ¡ã‚¤ãƒ³ã§ã€ã¾ã ã¾ã 模索ã—ã¦ã„る段階ã 。ãã®ã‚ˆã†ãªæ™‚期ã«ã¯ã¨ã«ã‹ã色々ãªã‚‚ã®ã‚’作りã€ãã®ä¸ã§æœ€ã‚‚マッãƒã—ã¦ã„ã‚‹ã¨æ€ã‚れるもã®ã‚’見極ã‚ãªã‘ã‚Œã°ãªã‚‰ãªã„。今回ã¯ãã®ä¸€ã¤ã€ws-ioを紹介ã—よã†ã€‚ ws-ioã¯WebSocketã¨ã‚µãƒ¼ãƒã®I/Oã‚’ã¤ãªã’ã¦ã—ã¾ã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã 。例ãˆã°Shellã¨ã¤ãªã’ã¦ã—ã¾ã†ã“ã¨ã§ã€Webブラウザ上ã«ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ãŒç«‹ã¡ä¸ŠãŒã‚‹ã¨è¨€ã£ãŸå…·åˆã 。WebSocketã§ç¹‹ãŒã£ã¦
1
ランã‚ング
ãŠçŸ¥ã‚‰ã›
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
OWASP Top 10 Details About WebSocket Vulnerabilities and Mitigations - SecureLayer7
{{#tags}}- {{label}}
{{/tags}}