[B! XSS] shiro96ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

shiro96 id:shiro96

XSSã«é–¢ã™ã‚‹shiro96ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

CodeIgniter ã® XSS å¯¾ç–ã¯ã©ã†ã‚ã‚‹ã¹ãã‹ï¼Ÿ - A Day in Serenity @ kenjis
CodeIgniter ã§ã® XSS å¯¾ç–ã«ã¤ã„ã¦ã¯ã€ã„ã‚ã„ã‚è°è«–ãŒã‚ã‚‹ã¯ãšã§ã™ãŒã€ã‚ã¾ã‚Šå…¬é–‹ã•ã‚ŒãŸæ—¥æœ¬èªžã®æƒ…å ±ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ CodeIgniter ã«ã¯ XSS ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°æ©Ÿèƒ½ãŒæ¨™æº–ã§ç”¨æ„ã•ã‚Œã¦ã„ã¾ã™ãŒã€ã“ã‚Œã¯æœ¬è³ªçš„ã«ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆã§ã‚ã‚Šãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°æ¼ã‚ŒãŒç”Ÿã˜ã‚‹å¯èƒ½æ€§ãŒæ®‹ã‚Šã¾ã™ã€‚ã¾ãŸã€å®Ÿéš›ã€éŽåŽ»ã«è„†å¼±æ€§ãŒæŒ‡æ‘˜ã•ã‚Œã¦ãŠã‚Šã€CodeIgniter 2.0.1 ä»¥å‰ã® XSS ãƒ•ã‚£ãƒ«ã‚¿ã«ã‚‚è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ ã¾ãŸã€ãƒ“ãƒ¥ãƒ¼ã§ã®å‡ºåŠ›æ™‚ã«å¤‰æ•°ã®å€¤ã‚’ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã™ã¹ã¦æ–‡å—å‚ç…§ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã¨ã„ã†æ©Ÿèƒ½ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã“ã®æ©Ÿèƒ½ã¯ã‚ã‚‹ã¨ã„ã„ã¨æ€ã„ã¾ã™ãŒã€ã©ã†å®Ÿè£…ã™ã¹ãã‹ãŒãã‚“ãªã«ç°¡å˜ã§ã¯ãªã„ã‚ˆã†ã«æ€ã‚ã‚Œã¾ã™ã€‚ ä»¥ä¸‹ã®è¨˜äº‹ã«ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã®å®Ÿè£…ãŒã¿ã‚‰ã‚Œã¾ã™ãŒã€å°‘ã€…ã€ç‹¬ç‰¹éŽãŽã‚‹æ„Ÿã˜ãŒã—ã¾ã™ã€‚ http://d.hatena.ne.jp/uratch/20100120/126395
shiro96 2011/06/06
CodeIgniter

XSS
ãƒªãƒ³ã‚¯
CodeIgniter XSSå¯¾ç– - æ–°ãƒ»æµ…ãåºƒãã‚’ãƒ¢ãƒƒãƒˆãƒ¼ã« - WEBãƒ—ãƒã‚°ãƒ©ãƒž ãƒ¡ãƒ¢
php, security | 12:40 | CodeIgniter ã«ãŠã‘ã‚‹XSSè‡ªå‹•å¯¾ç–ãƒ‘ãƒƒãƒã‚’é–‹ç™ºã—ã¾ã—ãŸã€‚CodeIgniterã‚’ä½¿ã£ã¦ã„ãªã„æ–¹ã§ã‚‚ã€XSSå¯¾ç–å®Ÿè£…ã®ã‚ã‚‹ã¹ãå§¿ãŒåˆ†ã‹ã‚‹å†…å®¹ã¨ãªã£ã¦ãŠã‚Šã¾ã™ã€‚ã‚ˆã‚ã—ã‘ã‚Œã°å‚è€ƒã«ã—ã¦ãã ã•ã„ã€‚XSSå¯¾ç–ã®å®Ÿè£…æ–¹æ³•ã¯è‰²ã€…ã‚ã‚Šã¾ã™ãŒã€ã‚ãã¾ã§ä»¥ä¸‹ãŒå¿…è¦è¦ä»¶ã¨ãªã‚Šã¾ã™ã€‚ãƒ¦ãƒ¼ã‚¶ãŒå…¥åŠ›ã—ãŸãƒ‡ãƒ¼ã‚¿ãã®ã‚‚ã®ãŒä¿å˜ã•ã‚Œã‚‹ã“ã¨ãƒ¦ãƒ¼ã‚¶ãŒå…¥åŠ›ã—ãŸãƒ‡ãƒ¼ã‚¿ãã®ã‚‚ã®ãŒHTMLå‡ºåŠ›ã•ã‚Œã‚‹ã“ã¨ã“ã‚Œã‚‰ãŒæº€ãŸã•ã‚ŒãŸä¸Šã§åˆã‚ã¦çœŸã®XSSå¯¾ç–ã¨è¨€ãˆã¾ã™ã€‚ãã‚Œãžã‚Œã‚’ã‚‚ã†å°‘ã—è©³ã—ãèª¬æ˜Žã—ã¾ã™ã€‚ãƒ¦ãƒ¼ã‚¶ãŒãƒ•ã‚©ãƒ¼ãƒ ã«ã€Œ&ã€ã¨å…¥åŠ›ã—ãŸã®ã§ã‚ã‚Œã°ã€å½“ç„¶ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã«ã‚‚ã€Œ&ã€ã¨å…¥ã£ã¦ã„ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ã€Œ&ã€ãªã©ã¨åˆ¥ç‰©ã«ãªã‚‹ã“ã¨ãŒã‚ã£ã¦ã¯ãªã‚Šã¾ã›ã‚“ã€‚ãƒ¦ãƒ¼ã‚¶ãŒãƒ•ã‚©ãƒ¼ãƒ ã«ã€Œ&ã€ã¨å…¥åŠ›ã—ãŸã®ã§ã‚ã‚Œã°ã€HTMLå‡ºåŠ›æ™‚ã«ã¯å¿…ãšã€Œ&ã€ã¨è¡¨ç¤ºã•ã‚Œãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ã€Œ&ã€ã¨è¡¨ç¤ºã•ã‚ŒãŸã‚Šã€å…¨è§’ã€Œï¼†ã€ã§
shiro96 2011/04/26
XSS

CodeIgniter

PHP

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Loading...
shiro96 2010/08/17
XSS

firefox

ã‚¢ãƒ‰ã‚ªãƒ³

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã«ãŠã‘ã‚‹11ã®è„†å¼±æ€§ã®å¸¸è˜ã¨å¯¾ç–
Webã‚¢ãƒ—ãƒªã«ãŠã‘ã‚‹11ã®è„†å¼±æ€§ã®å¸¸è˜ã¨å¯¾ç–ï¼šWebã‚¢ãƒ—ãƒªã®å¸¸è˜ã‚’JSPã¨Strutsã§èº«ã«ã¤ã‘ã‚‹ï¼ˆ11ï¼‰ï¼ˆ1/4 ãƒšãƒ¼ã‚¸ï¼‰ æœ¬é€£è¼‰ã¯ã€JSPï¼ã‚µãƒ¼ãƒ–ãƒ¬ãƒƒãƒˆï¼‹Strutsã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã‚’é€šã˜ã¦ã€Javaè¨€èªžä»¥å¤–ï¼ˆPHPã‚„ASP.NETã€Ruby on Railsãªã©ï¼‰ã®é–‹ç™ºã«ã‚‚é€šç”¨ã™ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å…¨èˆ¬ã®åºƒã„çŸ¥è˜ãƒ»å¸¸è˜ã‚’èº«ã«ä»˜ã‘ã‚‹ãŸã‚ã®é€£è¼‰ã§ã™ ã€2013å¹´2æœˆ25æ—¥ã€‘ç·¨é›†éƒ¨ã‚ˆã‚Šã€ãŠã‚ã³ã¨è¨‚æ£ã®ãŠçŸ¥ã‚‰ã› æœ¬ç¨¿ã«ãŠã„ã¦èªè€…ã®çš†ã•ã¾ã‚ˆã‚Šå¤šæ•°ã®ã”æŒ‡æ‘˜ã‚’ã„ãŸã ãã¾ã—ã¦ã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ç·¨é›†éƒ¨ã§ã‚ã‚‰ãŸã‚ã¦èª¿ã¹ãŸçµæžœã€é–“é•ã„ã‚’æŠŠæ¡ã—ã€ã‚ã‚‰ãŸã‚ã¦ä¿®æ£ç‰ˆã‚’æŽ²è¼‰ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ã“ã®åº¦ã¯ã€é•·æœŸã«ã‚ãŸã‚Šèª¤ã£ãŸå†…å®¹ã‚’æŽ²è¼‰ã—ãŸã®ã§ã€èªè€…ã®çš†ã•ã¾ã«å¤šå¤§ãªã”è¿·æƒ‘ã‚’ãŠæŽ›ã‘ã—ãŸã—ãŸç‚¹ã‚’ãŠã‚ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ é€šå¸¸ã€è¨˜äº‹ã«é–“é•ã„ãŒã‚ã£ãŸå ´åˆã«ã¯ã€ç†è€…ç¢ºèªå¾Œã«ä¿®æ£ç‰ˆã‚’æŽ²è¼‰ã™ã‚‹ã®ã§ã™ãŒã€ä»Šå›žã®å ´
shiro96 2009/09/02
ã¾ã¨ã‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

webé–‹ç™º
ãƒªãƒ³ã‚¯
XSSã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’ç™ºè¦‹ã™ã‚‹Â·Pixy MOONGIFT
PHPã¯Webã‚·ã‚¹ãƒ†ãƒ ã®ä¸ã§åºƒãä½¿ã‚ã‚Œã¦ã„ã‚‹ãƒãƒ”ãƒ¥ãƒ©ãƒ¼ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªžã ã€‚ã ãŒã€æ‰‹è»½ã«ç¿’å¾—ã—ã€é–‹ç™ºãŒè¡Œãˆã‚‹ã¨ã‚ã£ã¦æˆæžœç‰©ã®ãƒ¬ãƒ™ãƒ«ãŒæ§˜ã€…ã§ã‚ã‚Šã€ä¸ã«ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šå•é¡Œã®ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ãŒå¤šæ•°å˜åœ¨ã™ã‚‹ã“ã¨ãŒã‚ã‚‹ã€‚ãã†ã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å•é¡Œã‚’è§£æ±ºã™ã‚‹æ‰‹æ³•ã‚„ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚‚ã‚ã‚‹ãŒã€ã”ãç°¡å˜ãªã‚·ã‚¹ãƒ†ãƒ ã§ã¯ä½¿ã‚ã‚Œã‚‹ã“ã¨ãŒãªã„ã ã‚ã†ã€‚ SQLã®ã‚³ãƒ¼ãƒ‰ã‚’ç²¾æŸ»ã—ã€å•é¡Œã®ç™ºè¦‹ã«ã¤ãªã’ã‚‹ ãã®ã‚ˆã†ãªã‚‚ã®ã‚’æ”¾ç½®ã—ã¦ãŠãã¨ã€ã„ã¤ä½•æ™‚å•é¡ŒãŒã‚ãä¸ŠãŒã‚‹ã‹åˆ†ã‹ã‚‰ãªã„ã€‚ãã†ã—ãŸä¸å®‰ã‚’å–ã‚Šé™¤ããŸã‚ã«ã‚‚Pixyã‚’ä½¿ã£ã¦ã¿ã‚ˆã†ã€‚ ä»Šå›žç´¹ä»‹ã™ã‚‹ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ»ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯Pixyã€XSSã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚’ç™ºè¦‹ã™ã‚‹ã‚¹ã‚ãƒ£ãƒŠã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã ã€‚ æœ€åˆã«æ–ã£ã¦ãŠãã¨å®Ÿéš›è©¦ã—ã¦ã¿ãŸã¨ã“ã‚ã§ã¯100%ã®è§£æ±ºã«ã¯ã¤ãªãŒã‚‰ãªã•ãã†ãªã®ã§ã”æ³¨æ„ã„ãŸã ããŸã„ã€‚Pixyã¯Javaã§ä½œã‚‰ã‚ŒãŸã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã§ã€PHPãƒ•ã‚¡ã‚¤ãƒ«ã‚’æŒ‡å®šã—ã¦å®Ÿè¡Œã™ã‚‹ã¨ã‚½ãƒ¼ã‚¹ãƒ•
shiro96 2009/08/20
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

PHP

SQL

XSS

é–‹ç™º
ãƒªãƒ³ã‚¯
Movable Typeã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§
ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆIPA/ISECï¼‰ãŠã‚ˆã³æœ‰é™è²¬ä»»ä¸é–“æ³•äºº JPCERT ã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆJPCERT/CCï¼‰ã¯4æœˆ24æ—¥ã€ã‚·ãƒƒã‚¯ã‚¹ãƒ»ã‚¢ãƒ‘ãƒ¼ãƒˆãŒæä¾›ã™ã‚‹ãƒ–ãƒã‚°ã‚·ã‚¹ãƒ†ãƒ ã€ŒMovable Typeã€ã«ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã®è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã¨å…¬è¡¨ã—ãŸã€‚ã“ã®å•é¡Œã¯ã€éŽåŽ»ã«å…¬è¡¨ã•ã‚ŒãŸè„†å¼±æ€§ã¨ã¯ç•°ãªã‚‹ã‚‚ã®ã ã¨ã„ã†ã€‚ ä»Šå›žç¢ºèªã•ã‚ŒãŸè„†å¼±æ€§ã¯ã€ã€ŒMovable Type 4.24ï¼ˆProfessional Packã€Community Packã‚’åŒæ¢±ï¼‰ã€ã€ŒMovable Type Commercial 4.24ï¼ˆProfessional Packã‚’åŒæ¢±ï¼‰ã€ã€ŒMovable Type 4.24 Enterpriseã€ã€ŒMovable Type 4.24ï¼ˆOpen Sourceï¼‰ã€ã«å˜åœ¨ã™ã‚‹ã€‚ã¾ãŸã€ŒMovable Type 4.25ã€ã§ã‚‚ã€ã‚°ãƒãƒ¼ãƒãƒ«ãƒ†ãƒ³ãƒ—
shiro96 2009/04/27
MovableType

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS
ãƒªãƒ³ã‚¯
1