[B! XSS] tomiyanxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tomiyanx id:tomiyanx

XSSã«é–¢ã™ã‚‹tomiyanxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

X-XSS-Nightmare: 1; mode=attack ï½žXSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼ã‚’åˆ©ç”¨ã—ãŸXSSæ”»æ’ƒï½ž
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã€CODE BLUE 2015ã§ç™ºè¡¨ã™ã‚‹"äºˆå®šã ã£ãŸ"è³‡æ–™ã§ã™ã€‚ 2015/12: ä¸€éƒ¨ã®å•é¡ŒãŒã¾ã ä¿®æ£ã•ã‚Œã¦ã„ãªã„ã®ã§ã€éžå…¬é–‹ã®éƒ¨åˆ†ãŒã‚ã‚Šã¾ã™ã€‚ 2016/12: å®Œå…¨ç‰ˆã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚Nightmare 2 ã¨4ãŒæ–°ãŸã«å…¬é–‹ã—ãŸéƒ¨åˆ†ã§ã™ã€‚Read less
tomiyanx 2017/02/08
XSS

JavaScript

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
å®Ÿä¾‹ã«å¦ã¶XSSè„†å¼±æ€§ã®ç™ºè¦‹ã¨ä¿®æ£æ–¹æ³•/line_dm 16 20160916 how to find and fix xss
LINE Developer Meetup in Fukuoka #16 http://connpass.com/event/38413/
tomiyanx 2017/02/08
è„†å¼±æ€§

XSS

JavaScript
ãƒªãƒ³ã‚¯
ã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸ PHP5.5å¯¾å¿œç‰ˆã®ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°
ãŸã«ãã¡ã¾ã“ã¨ã•ã‚“ã® ã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸ãŒã“ã®ãŸã³æ”¹ç‰ˆã•ã‚Œã¦ã€ã‚ˆãã‚ã‹ã‚‹PHPã®æ•™ç§‘æ›¸ ã€PHP5.5å¯¾å¿œç‰ˆã€‘ã¨ã—ã¦å‡ºç‰ˆã•ã‚Œã¾ã—ãŸã€‚æ—§ç‰ˆã¯mysqlé–¢æ•°ã‚’ä½¿ã£ã¦SQLå‘¼ã³å‡ºã—ã—ã¦ã„ã¾ã—ãŸãŒã€mysqlé–¢æ•°ãŒPHP5.5ã«ã¦éžæŽ¨å¥¨ã¨ãªã£ãŸãŸã‚ã®ç·Šæ€¥å¯¾å‡¦çš„ãªå†…å®¹ã¨ãªã£ã¦ã„ã‚‹ã‚ˆã†ã§ã™ã€‚ã¤ã¾ã‚Šã€å¾“æ¥mysqlé–¢æ•°ã‚’å‘¼ã³å‡ºã—ã¦ã„ãŸç®‡æ‰€ã‚’mysqliã®å‘¼ã³å‡ºã—ã«å¤‰æ›´ã—ãŸã¨ã„ã†ã®ãŒã€ä¸»ãªå¤‰æ›´ç‚¹ã®ã‚ˆã†ã§ã€ã“ã‚Œä»¥å¤–ã¯ã‚ã¾ã‚Šå¤‰æ›´ç‚¹ã¯è¦‹ã‚ãŸã‚Šã¾ã›ã‚“ã€‚ æ—¢ã«ã€Amazonã§ã¯ã€ç†±çƒˆãªèªè€…ã®æ–¹ã‹ã‚‰ã®è©³ç´°ã®ãƒ¬ãƒ“ãƒ¥ãƒ¼ãŒå±Šã„ã¦ã„ã¾ã™ã€‚ ç¥žæœ¬å¾¡é™è‡¨ï¼ è¨€ã‚ãšã¨çŸ¥ã‚ŒãŸPHPãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°æ›¸ç±ã®ãƒãƒ³ã‚°ã‚»ãƒ©ãƒ¼ã€‚ 2010å¹´9æœˆã«ç™ºå£²ã•ã‚ŒãŸå‰ä½œã®æ”¹è¨‚ç‰ˆã€‚ PHPã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚‚æœ€æ–°ã®5.5ã«å¯¾å¿œã€å†…å®¹ã¯å‰ä½œã¨æ®†ã©åŒã˜ã€‚ å°‘ã—å‰ã«å‰ä½œã‚’è³¼å…¥ã—ãŸæ–¹ã‚‚æœ¬æ›¸ã‚’è³¼å…¥ã—ãŸæ–¹ãŒã„ã„ã§ã—ã‚‡ã†ã€‚ ã€ä¸ç•¥ã€‘ ãã‚Œã«ã—ã¦ã‚‚ã€å¸¯ã®ã€Œï¼“ä¸‡äººã«èªã¾ã‚ŒãŸå®š
tomiyanx 2014/03/11
PHP

XSS
ãƒªãƒ³ã‚¯
ä»Šå¤œã¤ã‘ã‚‹ HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ãƒ¼ ï¼ˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç·¨ï¼‰ - ã†ã•ãŽæ–‡å¦æ—¥è¨˜
Webã‚µãƒ¼ãƒãƒ¼ãŒãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’ç™ºè¡Œã™ã‚‹éš›ã«ã€HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ãƒ¼ã«ä»˜ã‘ã‚‹ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¬ãƒ™ãƒ«ã®å‘ä¸Šã«ã¤ãªãŒã‚‹ãƒ˜ãƒƒãƒ€ãƒ¼ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ å›²ã¿å†…ã¯æŽ¨å¥¨ã™ã‚‹è¨å®šã®ä¸€ä¾‹ã§ã™ã€‚ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ã¯å¯¾å¿œã—ã¦ã„ãªã„ãƒ˜ãƒƒãƒ€ãƒ¼ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã‚„ã‚ªãƒ—ã‚·ãƒ§ãƒ³ãªã©ã‚‚ã‚ã‚Šã¾ã™ã®ã§ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ç’°å¢ƒã«ã‚ˆã£ã¦ã¯æ©Ÿèƒ½ã—ãªã„ã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ X-Frame-Options ãƒ–ãƒ©ã‚¦ã‚¶ãŒ frame ã¾ãŸã¯ iframe ã§æŒ‡å®šã—ãŸãƒ•ãƒ¬ãƒ¼ãƒ å†…ã«ãƒšãƒ¼ã‚¸ã‚’è¡¨ç¤ºã™ã‚‹ã“ã¨ã‚’åˆ¶å¾¡ã™ã‚‹ãŸã‚ã®ãƒ˜ãƒƒãƒ€ãƒ¼ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã§ã™ã€‚ä¸»ã«ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã¨ã„ã†æ”»æ’ƒã‚’é˜²ããŸã‚ã«ç”¨ã„ã‚‰ã‚Œã¾ã™ã€‚ X-Frame-Options: SAMEORIGIN DENY ãƒ•ãƒ¬ãƒ¼ãƒ å†…ã«ãƒšãƒ¼ã‚¸ã‚’è¡¨ç¤ºã™ã‚‹ã“ã¨ã‚’ç¦æ¢ï¼ˆåŒã˜ã‚µã‚¤ãƒˆå†…ã§ã‚ã£ã¦ã‚‚ç¦æ¢ã§ã™ï¼‰ SAMEORIGIN è‡ªåˆ†è‡ªèº«ã¨ç”Ÿæˆå…ƒãŒåŒã˜ãƒ•ãƒ¬ãƒ¼ãƒ ã®å ´åˆã«ãƒšãƒ¼ã‚¸ã‚’è¡¨ç¤ºã™ã‚‹ã“ã¨ã‚’è¨±å¯ï¼ˆä»–ã®ã‚µã‚¤ãƒˆã«ç¦æ¢ã—ãŸã„å ´åˆã¯ä¸»ã«ã“
tomiyanx 2013/12/08
http

XSS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1