[B! javascript] ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ionis id:ionis

javascriptã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (211)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Fridaå…¥é–€ for Windows - æ ªå¼ä¼šç¤¾Ninjastars æŠ€è¡“ç³»ãƒ–ãƒã‚°
ionis 2019/05/22
Frida

è§£èª¬

å…¥é–€

ãƒã‚¤ãƒŠãƒª

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

python
ãƒªãƒ³ã‚¯
å›³ã§ç†è§£ã™ã‚‹JavaScriptã®ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—ãƒã‚§ãƒ¼ãƒ³ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
ionis 2019/05/22
javascript

ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—ãƒã‚§ãƒ¼ãƒ³

é–‹ç™º

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°
ãƒªãƒ³ã‚¯
Node.jsã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
OWASP Night 2019-03-11 / OWASP Japan
ionis 2019/03/12
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

node.js

javascript
ãƒªãƒ³ã‚¯
JavaScriptã‚³ãƒ¼ãƒ‰ã®å®‰å…¨ã‚’ä¿ã¤SAST(é™çš„è§£æž)ãƒ„ãƒ¼ãƒ« ~ npm-audit, NodeJsScan, LGTM~ - å¥½å¥‡å¿ƒã®è¶³è·¡
Pythonç·¨ã‚„ã€SASTãƒ„ãƒ¼ãƒ«ã¨ã¯ï¼Ÿã«ã¤ã„ã¦ã¯ã“ã¡ã‚‰ kusuwada.hatena blog.com ä»Šå›žã¯JavaScriptã§ä½¿ãˆã‚‹SASTãƒ„ãƒ¼ãƒ«ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ npm-audit npm-audit ã¨ã¯ å®Ÿè¡Œ NodeJsScan NodeJsScan ã¨ã¯ installã¨å®Ÿè¡Œ LGTM LGTMã¨ã¯ ç™»éŒ²ã¨å®Ÿè¡Œ å‚è€ƒãƒªãƒ³ã‚¯ npm-audit npm-audit ã¨ã¯ npm@6ã§è¿½åŠ ã•ã‚ŒãŸæ©Ÿèƒ½ã€‚npm install ã‚’å®Ÿè¡Œã™ã‚‹ã¨è‡ªå‹•çš„ã«å®Ÿè¡Œã•ã‚Œã€ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ãŸ node_module ã«å¯¾ã—æ—¢çŸ¥ã®è„†å¼±è£½ã®æœ‰ç„¡ã®ç¢ºèªã‚’å®Ÿæ–½ã—ã€ãƒ¬ãƒãƒ¼ãƒˆã‚’å‡ºåŠ›ã—ã¾ã™ã€‚ãƒ¬ãƒãƒ¼ãƒˆã«ã¯ã€å¯¾å‡¦æ–¹æ³•ã«é–¢ã™ã‚‹æƒ…å ±ã‚‚å«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ ã¾ãŸã€version-upãªã©ã§è‡ªå‹•ä¿®æ£å¯èƒ½ãªå ´åˆã¯ npm audit fix ã‚³ãƒžãƒ³ãƒ‰ã§è‡ªå‹•çš„ã«è„†å¼±æ€§ã‚’ä¿®æ£ã•ã›ã‚‹ã“ã¨ã‚‚å‡ºæ¥ã¾ã™ã€‚ å…¬å¼ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆãƒšãƒ¼ã‚¸ å®Ÿè¡Œ å®Ÿè¡Œã¯ç°¡
ionis 2019/01/10
SAST

ãƒ„ãƒ¼ãƒ«

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
AngularJS
AngularJS support has officially ended as of January 2022. See what ending support means and read the end of life announcement. Visit angular.io for the actively supported Angular.
ionis 2018/03/07
XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

escape

AngularJS

javascript
ãƒªãƒ³ã‚¯
Service Worker ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã¨æ›´æ–°å‡¦ç†
Service Worker ã®å®Ÿè£…ãŒä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã§æƒã„å§‹ã‚ã¦ç››ã‚Šä¸ŠãŒã£ã¦ãã¾ã—ãŸãã€‚ãã®æµã‚Œã«ä¾¿ä¹—ã—ã¦ä¹…ã—ã¶ã‚Šã« Service Worker ã®ä»•æ§˜ã‚„å®Ÿè£…ã«é–¢ã™ã‚‹è¨˜äº‹ã‚’æ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ä»Šå›žã¯ Service Worker ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã¨æ›´æ–°å‡¦ç†ã«ã¤ã„ã¦ã§ã™ã€‚ ã“ã®è¨˜äº‹ã¯ Service Worker ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å°‘ã—ã§ã‚‚æ‰‹æ›¸ãã—ã¦å‹•ã‹ã—ãŸã“ã¨ãŒã‚ã‚‹äººã‚’æƒ³å®šèªè€…ã«ã—ã¦ã„ã¾ã™ã€‚Service Worker ã«ã¤ã„ã¦å…¨ãçŸ¥ã‚‰ãªã„äººã¯ã¾ãšåˆ¥ã®å…¥é–€è¨˜äº‹ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚ã¾ãŸã€ç´°ã‹ã„ã“ã¨ã‚’æ°—ã«ã›ãšã« Service Worker ã‚’ä½¿ã„ãŸã„äººã¯ Workbox ã¨ã„ã£ãŸãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚„ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®åˆ©ç”¨ã‚’ãŠã™ã™ã‚ã—ã¾ã™ã€‚ æ›´æ–°å±¥æ´ 2019/09/24: Chrome 78 ã‹ã‚‰ importScripts() ã‚‚æ›´æ–°å¯¾è±¡ã«ãªã‚Šã¾ã—ãŸã€‚ãã‚Œã«ã¤ã„ã¦åŠ ç†ã—ã¾ã—ãŸã€‚ 2018/06/07:
ionis 2018/02/28
javascript

ServiceWorker
ãƒªãƒ³ã‚¯
5æ–‡å—ã§æ›¸ãJavaScript/ Shibuya.XSS techtalk #10
Shibuya.XSS techtalk #10 ã®ç™ºè¡¨è³‡æ–™ã§ã™ã€‚
ionis 2017/12/14
javascript

ãƒã‚¿
ãƒªãƒ³ã‚¯
JavaScriptä¸ç´šè€…ã¸ã®é“ã€5. ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€‘ - Qiita
JavaScriptä¸ç´šè€…ã¸ã®é“ã€5. ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€‘ JavaScriptã®ã¤ã¾ã¥ãã‚„ã™ãã†ãªã¨ã“ã‚ é–¢æ•°ã¯ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®ä¸€ç¨® 4ç¨®é¡žã®this é–¢æ•°ã‚¹ã‚³ãƒ¼ãƒ— éžåŒæœŸé–¢æ•° ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•° â† ã„ã¾ã“ã“ ã‚¯ãƒãƒ¼ã‚¸ãƒ£ ãƒ—ãƒãƒˆã‚¿ã‚¤ãƒ—ç¶™æ‰¿ ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã¨ã¯ æ—¢ã«ã€Œé–¢æ•°ã®å¼•æ•°ã«é–¢æ•°ãŒæ¸¡ã›ã‚‹ã€ã¨ã„ã†ã“ã¨ã‚’å¦ã³ã¾ã—ãŸã€‚ ã“ã‚Œã‚’åˆ©ç”¨ã—ã¦ã€ã€Œã‚ã‚‹ç‰¹å®šã®å‡¦ç†ãŒçµ‚ã‚ã£ãŸã‚‰ã€å¼•æ•°ã«æ¸¡ã—ãŸé–¢æ•°ã®å‡¦ç†ã‚’å®Ÿè¡Œã™ã‚‹ã€ã¨ã„ã£ãŸã‚ˆã†ã« å‡¦ç†ã®ãƒ•ãƒãƒ¼ã‚’åˆ¶å¾¡ã™ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚(ã¨ã„ã†ã‚ˆã‚Šã€éžåŒæœŸã®å ´åˆã¯åˆ¶å¾¡ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™) ãã®éš›ã€å¼•æ•°ã«æ¸¡ã•ã‚Œã‚‹é–¢æ•°ã®ã“ã¨ã‚’ã€Œã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€ã¨ã„ã„ã¾ã™ã€‚ Wikipediaã®ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯ (æƒ…å ±å·¥å¦)ã‚’è¦‹ã‚‹é™ã‚Šã€åŒæœŸ/éžåŒæœŸé–¢ä¿‚ç„¡ãã€å¼•æ•°ã«é–¢æ•°ã‚’å–ã‚‹å®Ÿè£…ã‚’æŒ‡ã—ã¦ã„ã‚‹ã‚ˆã†ã§ã™ã€‚ ã§ã™ãŒã€JavaScriptç•Œéšˆã§ã€Œã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€ã¨ã„ãˆã°ã€éžåŒæœŸå‡¦ç†ã«é–¢ã™ã‚‹è¨˜äº‹ãŒå¤šãè¦‹å—ã‘ã‚‰
ionis 2017/11/17
javascript

callback
ãƒªãƒ³ã‚¯
å¼•æ•°ã‚’ã¨ã‚‹ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã®å®Ÿç¾ã®ä»•æ–¹ - ã‚ã‹ã‚‰ã‚“
ä»¥ä¸‹ã§ã¯ã€ã€Œã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã‚’å¼•æ•°ã§å—ã‘å–ã‚‹é–¢æ•°ã€ã¨ã€Œå¼•æ•°ã‚’æŒãŸãªã„ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€ã‚’å®šç¾©ã—ã€å‘¼ã³å‡ºã—ã¦ã„ã¾ã™ã€‚ function f1(callback){ console.log('f1'); callback(); } function f2() { console.log('f2'); } f1(f2); //=> f1 //=> f2 ã§ã¯ã€ã€Œã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã‚’å¼•æ•°ã§å—ã‘å–ã‚‹é–¢æ•°ã€ã«ã€ã€Œå¼•æ•°ã®ã‚ã‚‹ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã€ã‚’æ¸¡ã™ã«ã¯ã©ã†ã™ã‚Œã°ã‚ˆã„ã§ã—ã‚‡ã†ã‹ã€‚ æ–¹æ³•1 ã€Œã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã‚’å—ã‘å–ã‚‹é–¢æ•°ã€ã®å®šç¾©ã‚’ã€ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã®å¼•æ•°ã‚‚è‡ªèº«ã®å¼•æ•°ã¨ã—ã¦å—ã‘å–ã‚‹ã‚ˆã†ã«å¤‰æ›´ã—ã¾ã™ã€‚ function f1(callback, arg1){ console.log('f1'); callback(arg1); } function f2(arg1) { console.log(arg1); }
ionis 2017/11/17
javascript

callback
ãƒªãƒ³ã‚¯
ã©ã®ã‚ˆã†ã«ã—ã¦5,000ãƒ‰ãƒ«ã®Googleãƒžãƒƒãƒ—XSSã‚’ç™ºè¦‹ã—ãŸã‹ | POSTD
æ•°ãƒµæœˆå‰ã€ç§ã¯Googleãƒžãƒƒãƒ—ã‚’ã€ã‚‚ã£ã¨æ£ç¢ºã«è¨€ã†ã¨Googleã‚¹ãƒˆãƒªãƒ¼ãƒˆãƒ“ãƒ¥ãƒ¼ã‚’åˆ©ç”¨ã—ã¾ã—ãŸã€‚Googleã‚¹ãƒˆãƒªãƒ¼ãƒˆãƒ“ãƒ¥ãƒ¼ã¯åä¾›ã®é ƒã«æ€ã„æã„ãŸæœªæ¥çš„ãªãƒ†ãƒ¬ãƒãƒ¼ãƒˆã¿ãŸã„ã§ã€ã¨ã¦ã‚‚æ°—ã«å…¥ã£ã¦ã„ã¾ã™ã€‚ç§ã¯ã€æ™®æ®µãã†ã™ã‚‹ã‚ˆã†ã«ã€ãã®æ™‚ã‚‚ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã‚’è¦‹ã¾ã—ãŸã€‚2014å¹´ã®ã„ã¤é ƒã‹ã‚‰ã‹ã€ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã¯å˜ãªã‚‹ã‚¯ã‚¨ãƒªã®æ–‡å—åˆ—ã§ã¯ãªããªã‚Šã€ãã®ä»£ã‚ã‚Šã«æ„Ÿå˜†ç¬¦ã§åŒºåˆ‡ã‚‰ã‚ŒãŸè‹±æ•°å—ã®å¥‡å¦™ãªå¯„ã›é›†ã‚ã«ãªã£ãŸã‚ˆã†ã§ã™ã€‚ é›£è§£ã§ã€ç¾åœ¨ã®ã¨ã“ã‚å…¬é–‹ã•ã‚ŒãŸãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒ†ãƒ¼ã‚·ãƒ§ãƒ³ã‚‚ãªãã€å¤šãã®äººã€…ã«æ¯Žæ—¥ä½¿ç”¨ã•ã‚Œã€ãƒªãƒãƒ¼ã‚¹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°ãŒå¯èƒ½ãªãƒ—ãƒãƒˆã‚³ãƒ«ã€‚ã“ã†ã„ã†ã‚³ãƒ¼ãƒ‰ã‚’ç›®ã®å‰ã«ã™ã‚‹ã¨ã€ç§ã¯è§£èªã—ãŸãã¦ã‚¦ã‚ºã‚¦ã‚ºã—ã¦ãã¾ã™ã€‚ ç§ã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®Webã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã‚‚è¦‹ã¦ã¿ã¾ã—ãŸã€‚AJAX APIã¸ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒåŒã˜ã‚ˆã†ã«ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã•ã‚Œã¦ã„ãŸã ã‘ã§ã¯ãªãã€ã‚‚ã—ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã®ä¸€éƒ¨ãŒç”»åƒã ã£ãŸå ´åˆã€ãã®ä»–ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã¯æš—å·ã‚’ç”¨ã„ãŸãƒã‚¤ãƒŠãƒª
ionis 2017/04/19
google

xss

google maps

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

writeup
ãƒªãƒ³ã‚¯
JavaScript,jQueryã®çˆ†é€Ÿã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã€ãƒ‡ãƒãƒƒã‚°æ–¹æ³•è«–ã®å‹§ã‚ï½žå®Ÿè·µå‘ã‘é€†å¼•ã(windows,chromeå‘ã‘)ï½ž - Qiita
â€»2017/4/21ã«ã‚ªãƒ³ãƒãƒ¼ãƒ‰æ™‚ã®ãƒ‡ãƒãƒƒã‚°æ–¹æ³•8ã‚’è¿½è¨˜ã—ã¾ã—ãŸï¼ ã“ã‚“ã«ã¡ã¯ï¼ã‚¨ã‚¤ãƒãƒ¼ãƒ å¼•è¶Šã—ä¾ã®åŠ è—¤ã§ã™ï¼ ã¿ãªã•ã‚“JavaScriptæ›¸ã„ã¦ã¾ã™ã‹ï¼Ÿ console.logã‚ã£ã¡ã‚ƒä½¿ã†ã‚ˆããƒ¼ã£ã¦äººã¯ç›®ã‹ã‚‰ã†ã‚ã“ã®ãƒ‡ãƒãƒƒã‚°æ–¹æ³•ã‚’ã€ ã‚±ãƒ¼ã‚¹æ¯Žã«ç´¹ä»‹ã—ã¦ã„ã“ã†ã¨æ€ã„ã¾ã™ã€‚(åƒ•ã¯console.logä½¿ã„ã¾ã›ã‚“) ã‚µãƒ¼ãƒãƒ¼ã«ãƒ‡ãƒãƒƒã‚°ç”¨ã®ã‚³ãƒ¼ãƒ‰ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã™ã‚‹ã“ã¨ç„¡ã„ã®ã§ã€ æ¶ˆã•ãšã«æ„å›³ã«åã—ã¦ãƒªãƒªãƒ¼ã‚¹ã—ã¦ã—ã¾ã†å±é™ºæ€§ãŒãªã„ã®ã‚‚ãŠå‹§ã‚ã§ã™ã€‚ å‰æçŸ¥è˜ F12ã§å‡ºã¦ãã‚‹ãƒ‡ãƒ™ãƒãƒƒãƒ‘ãƒ¼ãƒ„ãƒ¼ãƒ«(Elements, Console, Source, Network)ã®çŸ¥è˜ Ctrl+Shift+Fã§å¤–éƒ¨ã‚½ãƒ¼ã‚¹(js,css)ã«å¯¾ã—ã¦ä¸€æ‹¬æ¤œç´¢ãŒã§ãã‚‹ HTMLã€CSSã¯Elementsã‹ã‚‰ç›´æŽ¥ä¿®æ£â‡’ç¢ºèªãŒã§ãã‚‹ jsã¯Sourceã‹ã‚‰ç›´æŽ¥ä¿®æ£ã§ãã‚‹(Ctrl+Sã§ä¿å˜ã—ãŸã‚‰ãã®çŠ¶æ…‹ã§å®Ÿè¡Œã§ãã‚‹) jsã¯
ionis 2017/03/30
javascript

ãƒ‡ãƒãƒƒã‚°

ä¾¿åˆ©

tips
ãƒªãƒ³ã‚¯
Yahooåºƒå‘Šé…ä¿¡ç”¨ s.yimg.jp ãƒ‰ãƒ¡ã‚¤ãƒ³ã§ã®XSSã®è§£èª¬
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ionis 2017/03/03
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

XSS

æ£è¦è¡¨ç¾
ãƒªãƒ³ã‚¯
æ—¢å˜ã®x86/ARM CPUã»ã¼å…¨ã¦ã«é€šç”¨ã™ã‚‹JavaScriptæ”»æ’ƒãŒç™ºè¦‹ã•ã‚Œã‚‹ ï½žã‚¢ãƒ‰ãƒ¬ã‚¹ç©ºé–“é…ç½®ã®ãƒ©ãƒ³ãƒ€ãƒ åŒ–ã‚’çªç ´
ionis 2017/02/17
ASLR

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

JavaScript
ãƒªãƒ³ã‚¯
AnC - vusec
Address Space Layout Randomization Address space layout randomization or ASLR in short is a first line of defense against attackers targeting Internet users. ASLR randomizes the location of an applicationâ€™s code and data in the virtual address space in order to make it difficult for attackers to leak or manipulate the data or reuse the code in order to compromise the application. Combined with the
ionis 2017/02/17
æ™‚é–“ãƒ™ãƒ¼ã‚¹ã®ã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«ã€‚MMUã®ã‚ãƒ£ãƒƒã‚·ãƒ¥åˆ¶å¾¡ã‚’çœºã‚ã¦ã„ã‚‹ã‹ã‚‰ã€javascriptã‚’ã‚ªãƒ•ã«ã™ã‚‹ãã‚‰ã„ã—ã‹å¯¾ç–ãŒãªã„ã€‚

ASLR

ãƒ¡ãƒ¢ãƒª

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript
ãƒªãƒ³ã‚¯
ç¬¬7å›žã€€DOM-based XSS ãã®2 | gihyo.jp
å‰å›žã¯ã€DOM-based XSSã®åŽŸå› ã¨å¯¾ç–ã«ã¤ã„ã¦ã®æ¦‚ç•¥ã‚’è§£èª¬ã—ã€DOM-based XSSã‚’å¼•ãèµ·ã“ã™ã‚·ãƒ³ã‚¯ã®äº‹ä¾‹ã¨ã—ã¦innerHTMLã¸ã®HTMLã®ä»£å…¥ã‚„locationã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã¸ã®URLã®ä»£å…¥ã‚’ã¨ã‚Šã‚ã’ã¾ã—ãŸã€‚ä»Šå›žã¯ã€innerHTMLã‚„locationã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã»ã©é »ç¹ã§ã¯ãªã„ã‚‚ã®ã®ã€å®Ÿéš›ã«DOM-based XSSã®åŽŸå› ã¨ã—ã¦è¦‹ã‹ã‘ã‚‹ã‚·ãƒ³ã‚¯ã®ä»£è¡¨çš„ãªã‚‚ã®ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ document.writeï¼document.writelnï½žã§ãã‚‹ã ã‘ä½¿ã‚ãšã€ä»£æ›¿æ‰‹æ®µã‚’åˆ©ç”¨ã™ã‚‹ DOMã®ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã‚’é…å»¶ã•ã›ã‚‹ãªã©ã®ç†ç”±ã‹ã‚‰ã€ä»¥å‰ã«æ¯”ã¹ã‚‹ã¨document.writeã®ä½¿ç”¨ã•ã‚Œã‚‹é »åº¦ã¯æ¸›ã£ã¦ã„ã¾ã™ãŒã€ãã‚Œã§ã‚‚ãªãŠåºƒå‘Šç”¨ã®JavaScriptãªã©ä¸€éƒ¨ã§ã¯æ ¹å¼·ãdocument.writeãŒä½¿ã‚ã‚Œã¦ã„ã¾ã™ã€‚document.writeã‚„document.writelnã§ã¯ã€å¼•
ionis 2016/11/16
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

javascript
ãƒªãƒ³ã‚¯
æ£è¦è¡¨ç¾ã‚’è¤‡æ•°å›žå®Ÿè¡Œã™ã‚‹éš›ã®æ³¨æ„ç‚¹ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
ionis 2016/10/12
javascript

æ£è¦è¡¨ç¾
ãƒªãƒ³ã‚¯
JavaScriptã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®åŸºç¤ŽçŸ¥è˜ è¨˜äº‹ä¸€è¦§ | gihyo.jp
ç¬¬3å›žWebã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãŠã•ã‚‰ã„ ãã®3 CSRFãƒ»ã‚ªãƒ¼ãƒ—ãƒ³ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆãƒ»ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚° ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ 2016-07-13
ionis 2016/07/25
javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
å®‰æ˜“ãªã‚³ãƒ”ãƒ¼&ãƒšãƒ¼ã‚¹ãƒˆã«ã‚ˆã‚Šãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã›ã‚‹PoCã€ŒPastejackingã€ã®å±é™ºæ€§ã€‚
å®‰æ˜“ãªã‚³ãƒ”ãƒ¼&ãƒšãƒ¼ã‚¹ãƒˆã«ã‚ˆã‚Šã‚¯ãƒªãƒƒãƒ—ãƒœãƒ¼ãƒ‰ã‚’ä»‹ã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã›ã‚‹PoCã€ŒPastejackingã€ãŒå…¬é–‹ã•ã‚Œè©±é¡Œã«ãªã£ã¦ã„ã¾ã™ã€‚è©³ç´°ã¯ä»¥ä¸‹ã‹ã‚‰ã€‚ ç±³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥MalwarebytesãŒã€Œã‚¿ãƒ¼ãƒŸãƒŠãƒ«ã¸ã®ã‚³ãƒ”ãƒ¼ï¼†ãƒšãƒ¼ã‚¹ãƒˆã‚’å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ã§ã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ã®å‡ºæ¥ã‚‹ã€æ¦‚å¿µå®Ÿè¨¼ã€ŒPastejackingã€ã®å±é™ºæ€§ã‚’ä¼ãˆã¦ã„ã¾ã™ã€‚ Browsers now allow developers to automatically add content to a userâ€™s clipboard, following certain conditions. Namely, this can only be triggered on browser events. This post details how you can exploit this to trick a
ionis 2016/06/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

PoC

PasteJacking
ãƒªãƒ³ã‚¯
target="_blank"ã¯è„†å¼±æ€§ï¼ï¼Ÿã€ãƒ‡ãƒ¢ãƒšãƒ¼ã‚¸ã‚ã‚Šã€‘
ãµã¨Redditã®Webdevæ¿ã‚’è¦‹ã¦ã„ãŸã‚‰ã€ã‚¦ã‚§ãƒ–ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦å°‘ã—èˆˆå‘³æ·±ã„è¨˜äº‹ãŒã‚ã£ãŸã®ã§ã‚·ã‚§ã‚¢ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ è¨˜äº‹ã®ã‚¿ã‚¤ãƒˆãƒ«ã¯ã€ŒTarget=â€_blankâ€â€Šâ€”â€Šthe most underestimated vulnerability everã€ã€‚ æ—¥æœ¬èªžã§ã„ã†ã¨ã€Œtarget="_blank" ã¯æœ€ã‚‚éŽå°è©•ä¾¡ã•ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ã€ã¨ã„ã†ã¨ã“ã‚ã§ã—ã‚‡ã†ã‹ã€‚ ã§ã¯ã€é †ã‚’è¿½ã£ã¦å°‘ã—ãšã¤è¦‹ã¦è¡Œãã¾ã—ã‚‡ã†ã€‚ ã€ã¾ãš target="_blank"Â ã¨ã¯ï¼Ÿã€‘ target="_blank" ã¯ä»–ã®ãƒšãƒ¼ã‚¸ã¸ã®ãƒªãƒ³ã‚¯ã«åˆ©ç”¨ã•ã‚Œã‚‹ã‚‚ã®ã§ã€ç°¡å˜ã«ã„ã†ã¨ã€Œæ–°ã—ã„ã‚¿ãƒ–ã¨ã‹ã§ãƒšãƒ¼ã‚¸ã§é–‹ã„ã¦ãã€ã¨ã„ã†å‘½ä»¤ã§ã™ã€‚ ä¾‹ï¼š Yahoo! HTMLã‚¿ã‚°ã§ã„ã†ã¨ã“ã†ãªã£ã¦ã„ã¾ã™ã€‚ <a href="http://yahoo.co.jp/" target="_blank">Yahoo!</a> ã¤ã¾ã‚Šã€tar
ionis 2016/05/19
å…ƒã®ãƒšãƒ¼ã‚¸ã‚’ç§»å‹•ã•ã›ã‚‹ã€‚SNSã«ãƒªãƒ³ã‚¯æµã—ã¦ã€å…ƒãƒšãƒ¼ã‚¸ã‚’SNSãã£ãã‚Šãƒšãƒ¼ã‚¸ã«ç§»å‹•ã•ã›ã‚‹ã¨ã‹ã ã¨ã€æ°—ä»˜ãã¥ã‚‰ã„ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

HTML
ãƒªãƒ³ã‚¯
JavaScriptåˆå¿ƒè€…ã‚’ä¸€æ°—ã«ä¸Šç´šè€…ã¸å°Žãæµ·å¤–ã®ç„¡æ–™å‹•ç”»ãƒ™ã‚¹ãƒˆ6ã‚’ä¸€æŒ™å…¬é–‹ï¼ -
ã©ã†ã‚‚ã€ã¾ã•ã¨ã‚‰ã‚“ï¼ˆ@0310lanï¼‰ã§ã™ã€‚ ã¿ãªã•ã‚“ã¯ã€ã€ŒJavaScriptã€ã‚’ã©ã®ã‚ˆã†ãªæ–¹æ³•ã§å¦ç¿’ã•ã‚Œã¦ã„ã‚‹ã§ã—ã‚‡ã†ã‹ï¼Ÿ ãŠæ‰‹è»½ãªæ–¹æ³•ã¨ã—ã¦ã¯â€¦ã€ ãƒ»æ›¸ç±ã‚„ãƒ–ãƒã‚°è¨˜äº‹ã‚’èªã‚€ ãƒ»å‹‰å¼·ä¼šãƒ»ã‚»ãƒŸãƒŠãƒ¼ã¸å‚åŠ ã™ã‚‹ ãƒ»å‹äººã‚„å…ˆè¼©ã«ç›´æŽ¥èžã ãƒ»å¦ç¿’å‘ã‘ã®Webã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã™ã‚‹ ãƒ»etc... ãªã©ãŒä¸€èˆ¬çš„ã§ã—ã‚‡ã†ã‹ã€‚ ä»Šå›žã¯ã€ä¸Šè¨˜ã®ãƒªã‚¹ãƒˆã«åŠ ãˆã¦ã€ã‚‚ã†ï¼‘ã¤æœ‰åŠ¹ãªæ–¹æ³•ã§ã‚ã‚‹ã€Œæµ·å¤–ã®ç„¡æ–™å‹•ç”»ã€ã«ã¤ã„ã¦ã”ç´¹ä»‹ã—ã‚ˆã†ã¨æ€ã„ã¾ã™ï¼ ã€Œã©ã†ã›ã€è‹±èªžã ã‹ã‚‰â€¦ã€ã¨ã€ã¤ã„æ•¬é ã—ãŒã¡ã§ã™ãŒã€æµ·å¤–ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒä½œã‚‹ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°å¦ç¿’å‹•ç”»ã¯ã€å›½å†…ã«æ¯”ã¹ã¦åœ§å€’çš„ã«ã€Œè³ªã€ãŒé«˜ã„ã®ãŒç‰¹å¾´ã§ã™ã€‚ ãªã‹ã§ã‚‚ã€ç‰¹ã«è§£èª¬ãŒä¸å¯§ã§ç†è§£ã—ã‚„ã™ã„å‹•ç”»ã ã‘ã‚’åŽ³é¸ã—ã¾ã—ãŸã®ã§ã€ãœã²ãƒã‚§ãƒƒã‚¯ã—ã¦ã¿ã¦ãã ã•ã„ï¼ â– ã€ŒJavaScriptã€ã®åŸºæœ¬ã‚’å¾¹åº•çš„ã«å¦ã¶ï¼ ã¾ãšã¯ã€JavaScriptã‚’ã€Œã©ã®ã‚ˆã†ã«æ›¸ã„ãŸã‚‰è‰¯ã„ã®ã‹ï¼Ÿã€ã‚’ä¸å¯§ã«æ•™ãˆã¦ãã‚Œã‚‹å‹•ç”»ã®ã”
ionis 2016/03/31
javascript

å‹‰å¼·

å…¥é–€

å‹•ç”»

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸