[B! hasegawayosuke] mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mi1kman id:mi1kman

hasegawayosukeã«é–¢ã™ã‚‹mi1kmanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è„†å¼±æ€§é–¢é€£æƒ…å ±ã®éžé–‹ç¤ºä¾é ¼ã®å–ä¸‹ã’ç”³è«‹ã®çµæžœãŒè¿”ã£ã¦ããŸ - è‘‰ã£ã±æ—¥è¨˜
2008å¹´8æœˆ5æ—¥ã«å±Šã‘å‡ºãŸè„†å¼±æ€§ã¨ã„ã†ã‹ä»•æ§˜ã¨ã„ã†ã‹å•é¡Œã‚ã‚‹æŒ™å‹•ã«ã¤ã„ã¦ã€ã„ã¤ã¾ã§çµŒã£ã¦ã‚‚ä¿®æ£ã•ã‚Œãšã€ã‚€ã—ã‚å•é¡Œã‚’å…¬ã«ã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè‡ªè¡›ã™ã‚‹ã»ã†ãŒç¤¾ä¼šçš„å…¬ç›Šæ€§ãŒé«˜ã„ã¨æ€ã„ã€2012å¹´10æœˆ21æ—¥ã«è„†å¼±æ€§é–¢é€£æƒ…å ±ã®éžé–‹ç¤ºä¾é ¼ã®å–ä¸‹ã’ç”³è«‹ã‚’IPAã«é€ã£ã¦ã¿ãŸã‚‰ä»¥ä¸‹ã®ã‚ˆã†ãªè¿”äº‹ãŒè¿”ã£ã¦ããŸã€‚ ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆæ¤œæŸ»ã ã‘ã§ã¯ä¸ååˆ†ãªã®ã§ã€ã¨ã‚Šã‚ãˆãšã€è‡ªåˆ†ã®åå‰ã‚„æ‰€å±žã€ä½¿ç”¨ã—ã¦ã„ã‚‹ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿åç‰ãŒå…¬ã«çŸ¥ã‚‰ã‚ŒãŸããªã„ã¨ã„ã†äººã¯ã€Microsoft Officeã§ä½œæˆã•ã‚ŒãŸãƒ•ã‚¡ã‚¤ãƒ«(PDFã«å¤‰æ›ã—ãŸã®ã‚’å«ã‚€)ã‚’ä»–äººã«é…å¸ƒã™ã‚‹ã®ã‚’é¿ã‘ã‚‹ã¨ã‚ˆã„ã¨æ€ã„ã¾ã™ã€‚ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------- ã“ã®ãƒ¡ãƒ¼ãƒ«ã¯ã€å–æ‰±ã„ç•ªå· I
mi1kman 2012/11/07
MSã¯è„†å¼±æ€§ã˜ã‚ƒãªã„ã¨åˆ¤æ–ã—ã¦ãªãŠKBã¨ã—ã¦ã‚‚å…¬è¡¨ã—ãªã„ãã›ã«ã€ã©ã†ã—ã¦ã€Žå½“å•é¡Œã®æƒ…å ±å…¬é–‹ã§ã™ãŒã€ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®æ··ä¹±ã‚’æ‹›ãæã‚Œã‚‚ã‚ã‚Šã¾ã™ã®ã§ã€æŽ§ãˆã¦ã„ãŸã ã‘ã°åŠ©ã‹ã‚Šã¾ã™ã€ãªã‚“ã¦è¨€ã£ã¡ã‚ƒã†ã®ã€‚è»Ÿå¼±ã ãªãã€‚

Microsoft

hasegawayosuke

Office
ãƒªãƒ³ã‚¯
é€€è·ã®ãŠçŸ¥ã‚‰ã› - è‘‰ã£ã±æ—¥è¨˜
æ˜¨æ—¥2012å¹´3æœˆ31æ—¥ã‚’ã‚‚ã£ã¦ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ ªå¼ä¼šç¤¾ã‚’é€€è·ã—ã¾ã—ãŸã€‚ 2008å¹´1æœˆã‹ã‚‰ã§ã—ãŸã®ã§4å¹´ã¨å°‘ã—ã¨ã„ã†é•·ãã¯ãªã„æœŸé–“ã§ã—ãŸãŒã€ã¨ã¦ã‚‚å¯†åº¦ã®é«˜ã„æ™‚é–“ã‚’éŽã”ã›ãŸã¨æ„Ÿã˜ã¦ã„ã¾ã™ã€‚å‘¨ã‚Šã«ã¯ã€æ–°å’ã§å…¥ã£ã¦1å¹´ã‚‚çµŒã£ã¦ã„ãªã„ã®ã«ãƒã‚¤ãƒŠãƒªã®å›ºã¾ã‚Šã‚’è¦‹ã‚‹ã ã‘ã§ãã®ãªã‹ã«åŸ‹ã‚è¾¼ã¾ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ã‚’çš„ç¢ºã«ç›®è¦–ã§æŠ½å‡ºã™ã‚‹ã‚ˆã†ãªäººã‚„ã€å†ç¾æ€§ãŒæã‚ã—ãä½Žããªã‹ãªã‹åŽŸå› ãŒã‚ã‹ã‚‰ãªã‹ã£ãŸãƒã‚°ã‚’é€€æ²»ã™ã‚‹æ‰‹ä¼ã„ã‚’ãŠé¡˜ã„ã—ãŸã‚‰ã€1æ™‚é–“ã‚‚ã—ãªã„ã†ã¡ã«ã€Œã ã„ãŸã„åŽŸå› ã¯ã‚ã‹ã‚Šã¾ã—ãŸã€‚xxxã¨ã„ã†é–¢æ•°ã®ãƒãƒƒãƒ•ã‚¡ãŒ1ãƒã‚¤ãƒˆè¶³ã‚Šã¦ã„ãªã„ã‚“ã ã¨æ€ã„ã¾ã™ãŒã€ã¡ã‚ƒã‚“ã¨ç¢ºèªã—ãŸã„ã®ã§ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰è¦‹ã›ã¦ä¸‹ã•ã„ã€ã¨ã„ã†è¿”äº‹ã‚’è¿”ã—ã¦ãã‚‹ã‚ˆã†ãªæ°—é•ã„ã¿ãŸã„ãªãƒã‚¤ãƒŠãƒªã‚¢ãƒ³ãŒå¤šãã€ã©ã‚Œã ã‘å¦ã‚“ã§ã‚‚è‡ªåˆ†ãªã‚“ã¦è¿½ã„ã¤ã‘ãªã„åœ§å€’çš„ãªåŠ£ç‰æ„Ÿã‚’æ„Ÿã˜ã•ã›ã¦ãã‚Œã‚‹ä¼šç¤¾ã§ã—ãŸã€‚ ã¾ãŸã€èª²é•·ã‚„éƒ¨é•·ã¨ã„ã£ãŸç®¡ç†è·ã¸ã®æ˜‡é€²ã ã‘ãŒæ˜‡çµ¦ã®é“ã§ã¯ãªãã€æŠ€è¡“é¢ã§å„ªã‚ŒãŸäººæã‚’
mi1kman 2012/04/01
ã•ã™ãŒã§ã™

é€€è·

hasegawayosuke
ãƒªãƒ³ã‚¯
[ãƒ‡ãƒ–ã‚µãƒŸ2012]è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹
1. Finding Vulnerabilities For Fun And Profit è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹ Feb 16 2012 Yosuke HASEGAWA 2. è‡ªå·±ç´¹ä»‹ ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ ï¶ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ ªå¼ä¼šç¤¾ ç ”ç©¶é–‹ç™ºéƒ¨ ï¶æ ªå¼ä¼šç¤¾ã‚»ã‚ãƒ¥ã‚¢ã‚¹ã‚«ã‚¤ãƒ»ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ æŠ€è¡“é¡§å• ï¶Microsoft MVP for Consumer Security Oct 2005 - ï¶http://utf-8.jp/ ï¶é›£èªåŒ–JavaScriptæ›¸ã„ã¦ã¾ã™ Developers Summit 2012 NetAgent http://www.netagent.co.jp/ 4. è¨˜å·JavaScript JS without alnum $=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:+ +$,$_$$:
mi1kman 2012/02/17
ç†è€…ã®æƒ³ã„ãŒæ›¸ã‹ã‚Œã¦ã„ã¦å‚è€ƒã«ãªã‚‹ã€‚

é•·è°·å·é™½ä»‹

hasegawayosuke

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
MFSA 2011-47: Shift-JIS ã‚’ç”¨ã„ãŸæ½œåœ¨çš„ãª XSS æ”»æ’ƒ
ç¾åœ¨åœ°: ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ > Mozilla Foundation ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒª > MFSA 2011-47 Mozilla Foundation ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒª 2011-47 ã‚¿ã‚¤ãƒˆãƒ«: Shift-JIS ã‚’ç”¨ã„ãŸæ½œåœ¨çš„ãª XSS æ”»æ’ƒ é‡è¦åº¦: é«˜ å…¬é–‹æ—¥: 2011/11/08 å ±å‘Šè€…: Yosuke Hasegawa å½±éŸ¿ã‚’å—ã‘ã‚‹è£½å“: Firefoxã€Thunderbird ä¿®æ£æ¸ˆã¿ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³: Firefox 8.0 Firefox 3.6.24 Thunderbird 8.0 Thunderbird 3.1.16 æ¦‚è¦ Mozilla ã®ãƒ–ãƒ©ã‚¦ã‚¶ã‚¨ãƒ³ã‚¸ãƒ³ãŒ Shift-JIS æ–‡å—ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã«ãŠã‘ã‚‹ä¸æ£ãªã‚·ãƒ¼ã‚±ãƒ³ã‚¹ã‚’é©åˆ‡ã«å‡¦ç†ã—ã¦ã„ãªã„ã“ã¨ãŒã€Yosuke Hasegawa æ°ã«ã‚ˆã£ã¦å ±å‘Šã•ã‚Œã¾ã—ãŸã€‚ä¸æ£ãªãƒšã‚¢ã«éé‡
mi1kman 2011/11/11
hasegawayosuke

Firefox

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
æ£ã—ã„è„†å¼±æ€§å ±å‘Šã®ã‚ã‚Šæ–¹ - è‘‰ã£ã±æ—¥è¨˜
ã€ŒXSSã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã¨æ£ã—ã„è„†å¼±æ€§å ±å‘Šã®ã‚ã‚Šæ–¹ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼šã€ã‚’èªã‚“ã§ã€‚ IPAã‚’é€šã˜ã¦è„†å¼±æ€§ã®å ±å‘ŠãŒæ¥ã‚‹ã¨ã„ã†ã“ã¨ã¯ã€è„†å¼±æ€§ã®ç™ºè¦‹è€…ãŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ã ã£ãŸã‚Šã™ã‚‹ãŸã‚ã€å¯¾ç–ãŒå–ã‚‰ã‚Œã‚‹ã¾ã§å…¬é–‹ã•ã‚Œãªã„ã“ã¨ãŒäºˆæ¸¬ã§ãã‚‹ã€‚ã¤ã¾ã‚ŠIPAã‹ã‚‰è„†å¼±æ€§ã®å ±å‘ŠãŒæ¥ã‚‹=ç·Šæ€¥ã§ã¯ãªã„ã¨ã„ã†å›³å¼ãŒæˆã‚Šç«‹ã£ã¦ã—ã¾ã†ï¼ï¼XSSã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã¨æ£ã—ã„è„†å¼±æ€§å ±å‘Šã®ã‚ã‚Šæ–¹ - æœ€é€Ÿè»¢è·ç ”ç©¶ä¼šã‚ˆã‚Šã†ã†ã‚€ã€‚å€‹äººçš„ã«ã¯ã€è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸå ´åˆã«ã¯ã‚€ã—ã‚å°‚é–€å®¶ä»¥å¤–ã®ç´ äººã»ã©IPAã‚’é€šã˜ã¦å ±å‘Šã™ã‚‹ã»ã†ãŒã‚ˆã„ã¨æ€ã£ã¦ã„ã‚‹ã€‚ç†ç”±ã¯ä»¥ä¸‹ã®é€šã‚Šã€‚ é€£çµ¡å…ˆã®æŠŠæ¡ãŒå›°é›£ Webã‚µã‚¤ãƒˆã«ã‚‚ã‚ˆã‚Šã¾ã™ãŒã€è„†å¼±æ€§å ±å‘Šã®ãŸã‚ã®çª“å£ã‚’ç”¨æ„ã—ãã‚Œã‚’æ˜Žç¢ºã«ç¤ºã—ã¦ã„ã‚‹Webã‚µã‚¤ãƒˆã¯ã‚ã¾ã‚Šå¤šãã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ãã®ã‚ˆã†ãªé€£çµ¡å…ˆã‚’ã‚µã‚¤ãƒˆã”ã¨ã«é€ä¸€æŽ¢ã™ãã‚‰ã„ã§ã‚ã‚Œã°ã€IPAã«é€£çµ¡ã™ã‚‹ã»ã†ãŒæ‰‹é–“ãŒåœ§å€’çš„ã«å°‘ãªãã¦æ¸ˆã¿ã¾ã™ã€‚ã¾ãŸã€ä¸€èˆ¬çš„ãªå•ã„åˆã‚ã›çª“å£
mi1kman 2010/02/23
æ¨™æº–åŒ–ã•ã‚Œã¦ã‚‹ã£ã¦ã®ã¯ãƒ¡ãƒªãƒƒãƒˆã ã‚ˆãª

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

è‘‰ã£ã±

hasegawayosuke

IPA
ãƒªãƒ³ã‚¯
æ–‡å—ã‚³ãƒ¼ãƒ‰ polyglot - è‘‰ã£ã±æ—¥è¨˜
IEé™å®šã€‚å¤–ã‹ã‚‰æŒ‡å®šã•ã‚Œã‚‹charsetã«å¿œã˜ã¦æŒ™å‹•ã‚’å¤‰ãˆã‚‹JavaScriptã®é–¢æ•°ã®å®Ÿè£…ä¾‹ã€‚ä»¥ä¸‹ã®ã‚³ãƒ¼ãƒ‰ã‚’ Shift_JIS ã¨ã—ã¦ä¾‹ãˆã° charset.js ã®ã‚ˆã†ãªåå‰ã§ä¿å˜ã™ã‚‹ã€‚ function detectCharSet() { try{ var ADE = 'ï½±ï½±'; // 0xB1 x2 if(+ADE-0 == 10 ){ return 'UTF-7'; } if( ADE == 11 ){ return 'US-ASCII'; // 0xB1 means 0x31 } if( ADE.charCodeAt(0) == 0xFF71 ){ return 'Shift_JIS'; // Halfwidth Katakana Letter A x2 } if( ADE.charCodeAt(0) == 0x81FC ){ return 'EUC-JP'; // 0xB1
mi1kman 2009/05/27
JavaScript

æ–‡å—ã‚³ãƒ¼ãƒ‰

hasegawayosuke

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
1