[B! xss] takeodonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

takeodon id:takeodon

xssã«é–¢ã™ã‚‹takeodonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XHR XSS ã®è©±ï¼Ž - ã»ã‚€ã‚‰ã¡ã‚ƒã»ã‚€ã»ã‚€
æ¦‚è¦ CORS ãŒã€Œå¹¾ã¤ã‹ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®å…ˆè¡Œå®Ÿè£…ã€ã®çŠ¶æ³ã‹ã‚‰ã€Œå¤ã„ãƒ–ãƒ©ã‚¦ã‚¶ã§ã¯ã‚µãƒãƒ¼ãƒˆã•ã‚Œãªã„æ©Ÿèƒ½ã€ã«å¤‰ã‚ã‚Šã¤ã¤ã‚ã‚‹é ƒåˆã„ãªã®ã§ï¼ŒXHR2 ãŒ XSS ã®èµ·ç‚¹ã«ãªã‚Šã¾ã™ã‚ˆã£ã¦ãŠè©±ï¼Ž ãã‚‚ãã‚‚ XHR XSS ã£ã¦ä½•ã‚ˆ ç°¡å˜ã«è¨€ã†ã¨XHR2 ã«ã‚ˆã‚‹ XSS ã®ã“ã¨ã®ã¤ã‚‚ã‚Šï¼Žèº«è¿‘ãªã¨ã“ã‚ã ã¨ï¼ŒjQuery Mobile ãŒã‚„ã‚‰ã‹ã—ãŸã‚Šï¼Œå¤§é˜ªåºœè¦ãŒã‚„ã‚‰ã‹ã—ãŸã‚Šã—ãŸï¼Ž å…·ä½“ä¾‹1 jQuery Mobile jQuery Mobile ã«ã¤ã„ã¦ã¯ï¼ŒjQuery Mobileã®XSSã«ã¤ã„ã¦ã®è§£èª¬ ã§è§£èª¬ã•ã‚Œã‚‹ã¨ãŠã‚Šï¼Ž ã‹ã„ã¤ã¾ã‚“ã§è¨€ã†ã¨ï¼ŒjQuery Mobile ã« location.hash ã®å¤‰æ›´( hashchange ã‚¤ãƒ™ãƒ³ãƒˆç™ºç«ï¼‰æ™‚ã«ï¼Œlocation.hash ã‚’ URL ã¨ã¿ãªã—ã¦èªè¾¼ã‚“ã§ï¼Œãƒšãƒ¼ã‚¸å†…å®¹ã‚’å¤‰æ›´ã¨ã„ã†æ©Ÿèƒ½ãŒã‚ã£ã¦ï¼Œãã®èªè¾¼å…ˆ URL ã«ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®åˆ¶ç´„ãŒãªã‹ã£ãŸã®ã§ X
takeodon 2012/03/16
xss

security
ãƒªãƒ³ã‚¯
http://blog.monoweb.info/article/2012021823.html
takeodon 2012/02/20
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Ruby

xss
ãƒªãƒ³ã‚¯
Evernote XSSäº‹ä»¶ã®ã‚¨ã‚¯ã‚¹ãƒ—ãƒã‚¤ãƒˆã¨ãã®å¯¾ç–éŽç¨‹ã¨é¡›æœ« | uuu
Evernoteã«ä»»æ„ã®HTMLã‚’æ³¨å…¥ã§ãã‚‹è„†å¼±æ€§ãŒã‚ã‚Šã¾ã—ãŸã€‚ http://togetter.com/li/125281 Evernoteã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ã¨ã‹ã«ã¯è§¦ã‚Œãšã€ã¨ã‚Šã‚ãˆãšä½•ãŒå¯èƒ½ã ã£ãŸã®ã‹ã€ã©ã†ã„ã†çŠ¶æ³ã ã£ãŸã®ã‹ã‚’æ›¸ãã¾ã™ã€‚ 4/18 16æ™‚ã”ã‚ Evernoteã®ç™»éŒ²ãƒšãƒ¼ã‚¸ã®HTMLã«ä»¥ä¸‹ã®ã‚ˆã†ãªè¨˜è¿°ãŒã‚ã‚Šã¾ã™ã€‚ <script type="text/javascript"> $(document).ready(function() { suggestedTags = []; suggestedNotebook = ""; sourceUrl = ""; providerName = ""; payload = { "user" : { ... }, ..å¾Œç•¥.. </script> ã“ã®sourceUrl = ""ã®éƒ¨åˆ†ã€https://www.evernote.c
takeodon 2011/04/20
evernote

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Evernote ã® XSS è„†å¼±æ€§ã«é–¢ã—ã¦ mala æ°ã®ã¤ã¶ã‚„ã
è¦ã™ã‚‹ã«ã€è§£æ±ºã•ã‚Œã‚‹ã¾ã§ã¯ãƒã‚°ã‚¢ã‚¦ãƒˆã—ã¨ã‘ã¨ã„ã†ã“ã¨ã ãã†ãƒ‡ã‚¹ã€‚ ã€2011/04/20 12:20 è¿½è¨˜ã€‘ã²ã‚ƒã£ã¯ãƒ¼çš„ãªãŠã¾ã‘ã‚’è¿½åŠ ã—ã¾ã—ãŸã€‚ ã€2011/04/20 00:30 è¿½è¨˜ã€‘å¤šåˆ†ã“ã‚Œã§æœ€å¾Œã€‚ä»¥é™ã¯ Evernote ã®æ£å¼ç™ºè¡¨ã‚’å¾…ã£ãŸä¸Šã§ã€ãã‚Œã‚’ä¿¡ç”¨ã—ã¦åˆ©ç”¨ã™ã‚‹ã‹ã©ã†ã‹ã¯å„å€‹äººã®åˆ¤æ–ã«ãŠä»»ã›ã—ã¾ã™ã€‚ ã€2011/04/19 17:05 è¿½è¨˜ã€‘åˆå¾Œã®éƒ¨è¿½è¨˜ã€‚ãªãŠã€ã‚¨ãƒ³ãƒˆãƒªã‚’èµ·ã“ã•ã‚Œã¦ã„ã‚‹æ–¹ãŒãŠã‚Šã¾ã—ãŸã®ã§ã”ç´¹ä»‹ã€‚ï¼žã€Žbulkneetsæ°ã«ã‚ˆã£ã¦å ±å‘Šã•ã‚ŒãŸEvernoteã®XSSè„†å¼±æ€§ã¨ã¯ å±é™ºã¨å¯¾ç–ã€( http://d.hatena.ne.jp/pichikupachiku/20110419/1303158373 ) ç¶šãã‚’èªã‚€
takeodon 2011/04/19
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

evernote

xss
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
takeodon 2011/04/14
xss
ãƒªãƒ³ã‚¯
1