サーãƒã‹ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«é€ä¿¡ã™ã‚‹æŠ€è¡“ - WebSocketã‚’ä¸å¿ƒã« - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article? Webã§ã®ãƒ—ッシュ技術 HTTPã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ–ラウザ）ã‹ã‚‰ãƒªã‚¯ã‚¨ã‚¹ãƒˆã—ã¦ã‚µãƒ¼ãƒã‹ã‚‰ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãŒè¿”る一å•ä¸€ç”åž‹ã®ãƒ—ãƒãƒˆã‚³ãƒ«ãªã®ã§ã€åŸºæœ¬çš„ã«ã¯ã‚µãƒ¼ãƒå´ã‹ã‚‰ãƒ–ラウザã«æ–°ç€æƒ…å ±ã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§é€šçŸ¥ï¼ˆãƒ—ッシュ）ã§ãるよã†ã«ã¯ã§ãã¦ã„ã¾ã›ã‚“。 ã—ã‹ã—ãã‚Œã§ã‚‚プッシュをã—ãŸã„ã¨ã„ã†å ´åˆã«ã©ã†ã™ã‚‹ã‹ã¨ã„ã†è©±ãŒå‡ºã¦ãã¾ã™ã€‚ã‚„ã‚Šæ–¹ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªã‚‚ã®ãŒã‚ã‚Šã¾ã™ã€‚ ãƒãƒ¼ãƒªãƒ³ã‚° クライアントã‹ã‚‰ã‚µãƒ¼ãƒã«å®šæœŸçš„ã«æ–°ç€ã‚’å•ã„åˆã‚ã›ã‚‹ã‚ˆã†ã«ã—ã¾ã™ã€‚ 最も原始的ã‹ã¤ç¢ºå®Ÿãªã‚„ã‚Šæ–¹ã€‚æ¬ ç‚¹ã¯ã€æœ€å¤§ã§ãƒãƒ¼ãƒªãƒ³ã‚°é–“éš”ã®åˆ†ã ã‘通知ãŒé…延ã—ã†ã‚‹ã“ã¨ã§ã™ã€‚ ãƒãƒ³ã‚°ãƒãƒ¼ãƒªãƒ³ã‚°ï¼ˆâ€œC
Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token - Detectify Labs
Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token TLDR; I was able to create a malicious page that would reconnect your Slack WebSocket to my own WebSocket to steal your private Slack token. Slack fixed the bug in 5 hours (on a Friday) and paid me $3,000 for it. Recently a bug I found in Slack was published on HackerOne and I wanted to explain it, and the method
WebSocket Echo Server
WebSocket Echo Server We run a free very simple endpoint server with support for websockets and server-sent events (SSE) so that you can test your websocket and SSE clients easily. The server is designed for testing HTTP proxies and clients. It echoes information about HTTP request headers and bodies back to the client. The endpoint is https://echo.websocket.org/ Behavior Any messages sent from a
WebSocketã‚’ç ”ç©¶ã—ã¦ã¿ãŸ | ワークフãƒãƒ¼ã‚·ã‚§ã‚¢No.1ã€€æ ªå¼ä¼šç¤¾ã‚¨ã‚¤ãƒˆãƒ¬ãƒƒãƒ‰
ã“ã‚“ã«ã¡ã¯ï¼ã€€ã‚¨ã‚¤ãƒˆãƒ¬ãƒƒãƒ‰æŠ€è¡“部和田ã§ã™ï¼ エイトレッドã§ã¯æ¯Žæœˆãƒ†ãƒ¼ãƒžã‚’決ã‚ã¦ã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒæŒã¡å›žã‚Šã§å‹‰å¼·ä¼šã‚’実施ã—ã¦ã„ã¾ã™ã€‚ 世間ã‹ã‚‰ã¯ï¼“週ãらã„é…ã‚Œã¦ã‚‹æ°—ã‚‚ã—ã¾ã™ãŒã€å…ˆæ—¥ã¯WebSocketをテーマã«å‹‰å¼·ä¼šã‚’ è¡Œã„ã¾ã—ãŸã®ã§ã€ä»Šå›žãã®å†…容をダイジェスト版ã§ãŠé€ã‚Šã—ã¾ã™ã€‚ 1．WebSocketã¨ã¯ï¼Ÿ ãã‚‚ãã‚‚WebSocketã¨ã¯ä½•ãªã®ã§ã—ょã†ã‹ï¼Ÿ WebSocketã¨ã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ–ラウザ）ã¨ã‚µãƒ¼ãƒé–“㧠本当ã®æ„味ã§ã®å…¨äºŒé‡ï¼ˆåŒæ–¹å‘）通信を行ã†ãŸã‚ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã™ã€‚ ã‚‚ã¨ã‚‚ã¨ã¯HTML5ã®ä¸€éƒ¨ã¨ã—ã¦ã€ä»•æ§˜ã®ç–定ãŒé€²ã‚られã¦ã„ã¾ã—ãŸãŒ ãã®å¾Œç‹¬ç«‹ã—ã€å˜ä½“ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã¨ã—ã¦ä»•æ§˜ç–定ãŒé€²ã‚られã¦ã„ã¾ã™ã€‚ WebSocketã®ç‰¹å¾´ã¨ã—ã¦ã¯æ¬¡ã®ç‚¹ãŒã‚ã’られã¾ã™ã€‚ TCP上ã§å‹•ä½œ デフォルトãƒãƒ¼ãƒˆã¯ 80番 ã¾ãŸã¯ 443番 明示的ã«åˆ‡æ–ã—ãªã„é™ã‚ŠæŽ¥ç¶šã•ã‚Œç¶šã‘る⇒効率的ã«åŒæ–¹å‘通信ãŒ
コラム- Ruby ＆ Rails | 第12回　WebSocketã§ã‚µãƒ¼ãƒãƒ—ッシュ｜CTC教育サービス ç ”ä¿®/トレーニング
[ITç ”ä¿®]注目ã‚ーワード Python UiPath(RPA) æœ€æ–°æŠ€è¡“å‹•å‘ Microsoft Azure Docker Kubernetes 第12回　WebSocketã§ã‚µãƒ¼ãƒãƒ—ッシュ (æ¾æ°¸ç´˜) 2014å¹´3月 2/18ã«Rails3.2.17ã€4.0.3ã€åŠã³4.1.0.beta2（*1）ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸï¼ˆ*2）。ã“れらã¯å‰å›žã®ã‚¢ãƒƒãƒ—デートåŒæ§˜ã€DoS攻撃やXSSã®è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç·Šæ€¥åº¦ã®é«˜ã„ã‚»ã‚ュリティフィックスã®ã‚ˆã†ã§ã™ã®ã§ã€ã§ãã‚‹ã ã‘æ—©ãアップデートã™ã‚‹ã“ã¨ã‚’ãŠå‹§ã‚ã„ãŸã—ã¾ã™ã€‚ ã•ã¦è©±ã¯å¤‰ã‚ã‚Šã¾ã™ãŒã€1/25～26ã«ã‹ã‘ã¦é–‹å‚¬ã•ã‚ŒãŸã€ŒSECCON 2013 CTF オンライン予é¸ï¼ˆ*3）ã€ã«å‚åŠ ã—ã¦ã¿ã¾ã—ãŸã€‚ã“ã®äºˆé¸ã¯ã€ŽIT技術やセã‚ュリティã«é–¢ã™ã‚‹5ã¤ã®ã‚¸ãƒ£ãƒ³ãƒ«ã€Œãƒ•ã‚©ãƒ¬ãƒ³ã‚¸ãƒƒã‚¯ã‚¹ã€ã€Œãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æš—å·ã€ã€Œãƒã‚¤ãƒŠãƒªã€ã€Œãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ»Webã€ã€Œãã®ä»–・トリビアã€ã‹ã‚‰è¨ˆ2
ã“ã‚Œã¯é¢ç™½ã„。WebSocketを使ã£ãŸWebベースã®ã‚¿ãƒ¼ãƒŸãƒŠãƒ«Â·ws-io MOONGIFT
ws-ioã¯WebSocketã¨I/Oを組ã¿åˆã‚ã›ã‚‹ã“ã¨ã§Webベースã®ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ã‚’実ç¾ã™ã‚‹ã€‚ ws-ioã¯Ruby製ã®ã‚ªãƒ¼ãƒ—ンソース・ソフトウェア。HTML5ã§æ–°ã—ãç™»å ´ã—ãŸæ©Ÿèƒ½ã¯å¹¾ã¤ã‚‚ã‚ã‚‹ãŒã€ãã®ä¸ã§ã‚‚特殊ãªä½ç½®ã«ã‚ã‚‹ã®ãŒWebSocketã§ã¯ãªã„ã ã‚ã†ã‹ï¼ˆä»•æ§˜ã‹ã‚‰ã¯åˆ‡ã‚Šé›¢ã•ã‚Œã¦ã„ã‚‹ãŒï¼‰ã€‚ã“ã‚Œã¾ã§ã«ãªã‹ã£ãŸã‚½ã‚±ãƒƒãƒˆé€šä¿¡ã‚’ã©ã†æ´»ã‹ã™ã‹ãŒå•é¡Œã 。 Web上ã§irb ãã®ãŸã‚ã€å‡ºã¦ã„ã‚‹ã‚‚ã®ã‚‚ãƒãƒ£ãƒƒãƒˆãらã„ãŒãƒ¡ã‚¤ãƒ³ã§ã€ã¾ã ã¾ã 模索ã—ã¦ã„る段階ã 。ãã®ã‚ˆã†ãªæ™‚期ã«ã¯ã¨ã«ã‹ã色々ãªã‚‚ã®ã‚’作りã€ãã®ä¸ã§æœ€ã‚‚マッãƒã—ã¦ã„ã‚‹ã¨æ€ã‚れるもã®ã‚’見極ã‚ãªã‘ã‚Œã°ãªã‚‰ãªã„。今回ã¯ãã®ä¸€ã¤ã€ws-ioを紹介ã—よã†ã€‚ ws-ioã¯WebSocketã¨ã‚µãƒ¼ãƒã®I/Oã‚’ã¤ãªã’ã¦ã—ã¾ã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã 。例ãˆã°Shellã¨ã¤ãªã’ã¦ã—ã¾ã†ã“ã¨ã§ã€Webブラウザ上ã«ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ãŒç«‹ã¡ä¸ŠãŒã‚‹ã¨è¨€ã£ãŸå…·åˆã 。WebSocketã§ç¹‹ãŒã£ã¦
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
OWASP Top 10 Details About WebSocket Vulnerabilities and Mitigations - SecureLayer7
{{#tags}}- {{label}}
{{/tags}}