[B! xss] libkazzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

libkazz id:libkazz

xssã«é–¢ã™ã‚‹libkazzã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œã‚‹å‰ã«çŸ¥ã‚‹ã¹ã10ã®è„†å¼±æ€§ â€• ï¼ IT
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒæ”»æ’ƒè€…ã«ä»˜ã‘è¾¼ã¾ã‚Œã‚‹è„†å¼±æ€§ã®å¤šãã¯ã€è¨è¨ˆè€…ã‚„é–‹ç™ºè€…ã®ãƒ¬ãƒ™ãƒ«ã§æŽ’é™¤ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚å®Ÿè£…ã«å¿™ã—ã„æ–¹ã‚‚ã€æœ€è¿‘ã‚ˆãç‹™ã‚ã‚Œã‚‹è„†å¼±æ€§ã®ãƒˆãƒƒãƒ—10ã‚’çŸ¥ã‚‹ã“ã¨ã§æ‰‹ã£å–ã‚Šæ—©ãæ¦‚è¦ã‚’çŸ¥ã‚Šã€é–‹ç™ºã®éš›ã«ãã®å˜åœ¨ã‚’æ„è˜ã—ã¦ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã—ã¦ã„ãŸã ã‘ã‚Œã°å¹¸ã„ã§ã™ã€‚ Webã®ä¸–ç•Œã‚’è„…ã‹ã™è„†å¼±æ€§ã‚’é †ä½ä»˜ã‘ OWASPï¼ˆOpen Web Application Security Projectï¼‰ã¯ã€ä¸»ã«Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‘ä¸Šã‚’ç›®çš„ã¨ã—ãŸã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã§ã€ãã“ã§ã®èª¿æŸ»ã‚„é–‹ç™ºã®æˆæžœç‰©ã‚’èª°ã§ã‚‚åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ ãã®ä¸ã®ã€ŒOWASP Top Ten Projectã€ã¨ã„ã†ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã¯ã€å¹´ã«1å›žWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ãƒˆãƒƒãƒ—10ã‚’æŽ²è¼‰ã—ã¦ã„ã¾ã™ã€‚2004å¹´ç‰ˆã¯æ—¥æœ¬èªžã‚’å«ã‚€å„å›½èªžç‰ˆãŒæä¾›ã•ã‚Œã¦ã„ã¾ã™ãŒã€2007å¹´ç‰ˆã¯ç¾åœ¨ã®ã¨ã“ã‚è‹±èªžç‰ˆã®ã¿ãŒæä¾›ã•
libkazz 2007/06/14
security

xss

web
ãƒªãƒ³ã‚¯
è¢«ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ç”»åƒè¡¨ç¤ºãƒšãƒ¼ã‚¸ã«XSSæ”»æ’ƒã—ã¦ã¿ã‚‹ã€‚ - ãŽã˜ã‚…ã£ã‚„ã•ã‚“
libkazz 2007/05/08
å…¨éƒ¨ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã—ã¨ã‘ã°ã‚ˆã„ã®ã‹

xss

ã‚ã¨ã§
ãƒªãƒ³ã‚¯
ã¾ã ã¾ã ã‚ã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒæ³•
å‰å›žã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®ãœã„å¼±æ€§ã‚’çªãæ”»æ’ƒã®å¯¾ç–ã¨ã—ã¦ã®HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã®æœ‰åŠ¹æ€§ã‚’è¿°ã¹ãŸã€‚ãŸã ï¼ŒHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã ã‘ã§ã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒã‚’å®Œå…¨ã«é˜²å¾¡ã™ã‚‹ã“ã¨ã¯ã§ããªã„ã€‚ãã“ã§ä»Šå›žã¯ï¼ŒHTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã§å¯¾å‡¦ã§ããªã„ã‚¿ã‚¤ãƒ—ã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°æ”»æ’ƒã®æ‰‹å£ã¨ï¼Œãã®å¯¾ç–ã«ã¤ã„ã¦è§£èª¬ã™ã‚‹ã€‚ HTMLã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã§å¯¾å‡¦ã§ããªã„æ”»æ’ƒã«ã¯ï¼Œæ¬¡ã®ã‚ˆã†ãªã‚‚ã®ãŒã‚ã‚‹ã€‚ ã‚¿ã‚°æ–‡å—ã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆï¼ˆWebãƒ¡ãƒ¼ãƒ«ï¼Œãƒ–ãƒã‚°ãªã©ï¼‰ CSSï¼ˆã‚«ã‚¹ã‚±ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãƒ»ã‚¹ã‚¿ã‚¤ãƒ«ã‚·ãƒ¼ãƒˆï¼‰ã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆï¼ˆãƒ–ãƒã‚°ãªã©ï¼‰ æ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’æ˜Žç¤ºã—ã¦ã„ãªã„ã‚±ãƒ¼ã‚¹ã§UTF-7æ–‡å—ã‚³ãƒ¼ãƒ‰ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° <SCRIPT>ã®å†…å®¹ã‚’å‹•çš„ã«ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆ Aã‚¿ã‚°ãªã©ã®URLã‚’å‹•çš„ã«ç”Ÿæˆã—ã¦ã„ã‚‹å ´åˆæ³¨ï¼‰ ä»¥ä¸‹ã§ã¯ï¼ŒHTMLã‚¿ã‚°ã‚„CSSã®å…¥åŠ›ã‚’è¨±å®¹ã—ã¦ã„ã‚‹å ´åˆã¨ï¼Œæ–‡å—ã‚³ãƒ¼ãƒ‰ã‚’æ˜Ž
libkazz 2007/04/20
ç°¡å˜ãªã®ãã€‚ã€‚

security

xss

css
ãƒªãƒ³ã‚¯
ãã‚Œ Unicode ã§
UTF-7 ã‚’ä½¿ã£ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨˜è¿° +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-+AC8-SCRIPT+AD4- IE ã¯ã€æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ãŒä¸æ˜Žã§ UTF-7 ã£ã½ã„æ–‡å—åˆ—ãŒã‚ã‚Œã°ã€è‡ªå‹•åˆ¤åˆ¥ã§ UTF-7 ã¨ãªã‚‹ã€‚
libkazz 2007/04/20
security

xss

ã“ã‚Œã¯ã™ã”ã„
ãƒªãƒ³ã‚¯
GNUCITIZEN >> Universal PDF XSS After Party
Everybody knows about it. Everybody talks about it. We had a nice party. It is time for estimating the damages. In this article I will try to show the impact of the Universal PDF XSS vulnerability by explaining how it can be used in real life situations. For those who has slept over the last two days, here is a short introduction of what this talk is going to be about: The Universal PDF XSS issue
libkazz 2007/01/17
XSSã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ã®ãƒã‚§ãƒƒã‚¯ãŒã§ãã‚‹

xss
ãƒªãƒ³ã‚¯
1