XSSã¨ã»ãã¥ãªãã£ãªã¹ã¯ã¨æ£ããèå¼±æ§å ±åã®ããæ¹
é©å½
XSSããã=ãªãã§ãããæ¾é¡ã§ã¯ãªã
ããã°ãµã¼ãã¹ãªã©èªç±ã«HTMLãããããããªãµã¼ãã¹ã§ã¯ã害ãåã°ãªãããã«è¡¨ç¤ºã丸ãã¨å¥ã®ãã¡ã¤ã³ã«åãã¦ãããããããã¯å¥ãã¡ã¤ã³ã®IFRAMEå ã§å®è¡ããããã¦ããã®ãæ®éã§ããå人æ å ±ãé ãã£ã¦ããµã¤ãã¯ãéè¦å人æ å ±ã«ã¤ãã¦ã¯HTTPSãããªãã¨åç §ã§ããªãã£ããããããã表示ããªãã£ãã(ãã¹ã¯ã¼ããã«ã¼ãçªå·ç)ã決æ¸ç¨ã®ãã¹ã¯ã¼ããæ証çªå·ãå ¥ããªãã¨æä½ã§ããªãã£ããããã
åèã¾ã§ã«
- http://blog.bulknews.net/mt/archives/001274.html (2004å¹´ã®ã¢ã¡ããèå¼±æ§ã®è©±)
- http://d.hatena.ne.jp/yamaz/20090114 (ä¿¡é ¼ã§ããªããã¼ã¿ãåãæ±ããã¡ã¤ã³ãåãã話)
管çç¨ã¨å¥ãã¡ã¤ã³ã«åããã«ãé¢ããããscriptå®è¡ã§ãããã¨ã«å¯¾ãã¦DISããã¦ããä¾ããã¡ãã
- http://d.hatena.ne.jp/rosylilly/20091216/1260961264
- http://d.hatena.ne.jp/rosylilly/20091219/1261254527
scriptãæ¸ããã°ãã©ã¯ã©ãç½®ãã¦é²è¦§è ã«å¯¾ãã¦å«ããããããã¨ã¯åºæ¥ããããã©ã¦ã¶ãpluginã«èå¼±æ§ãããå ´åãscriptãæ¸ãããã¨èªä½ããæ·±å»ãªè å¨ã«ãªãããã®ã§ãscriptãä¸åæ¸ããªãããã«ããã¨ããããªã·ã¼ãå¿è«ãããåãä¼ç¤¾ãéå¶ãã¦ãããµã¼ãã¹ã§ããã¡ã¤ã³ãã¨ã«ã»ãã¥ãªãã£ããªã·ã¼ãããããã¨ãã°ã¯ã¦ãªãã¤ã¢ãªã ã£ãããã¦ã¼ã¶ã¼ã®å ¥åããscriptã¯å®è¡ä¸å¯ãGoogle AdSenseãä¸é¨ã®ããã°ãã¼ãã®ã¹ã¯ãªããã¯å®è¡ããã¦è¯ããã¨ãã£ãå ·åã«æ±ºã¾ã£ã¦ããåã«scriptãå®è¡ã§ããã¨ããã ãã§ããã®ãµã¼ãã¹ã¯XSSèå¼±æ§ããããå±éºã ãã¨é¨ãç«ã¦ãã®ã¯è¯ããªããã¨ã ã¨æãã
èå¼±æ§ããã£ãå ´åã®å½±é¿ç¯å²ãæãã
- ããåå¿è ãã¦ã§ãã¢ããªã±ã¼ã·ã§ã³ãä½ãã®ã§ããã°ãã¾ãæåã«ãèå¼±æ§ããã£ã¦ã大ä¸å¤«ã«ããããã¨ãè¦ããã®ãè¯ãã¨æãã
- ãã¾ãã¾ãªæ»ææ段ããããã«å¯¾ãã対çæ¹æ³ãç¶²ç¾ çã«å¦ç¿ããã®ã¯æéããããããé·å¹´éå¶ãã¦ãããµã¤ãã«ãæ¾ç½®ããã¦ããèå¼±æ§ããã£ããããã
- å人æ å ±ãé ãããªãããã«ããã¨ãã決æ¸æ©è½ã¯å¤é¨ãµã¤ãã«é ¼ãã¨ãã
åç´ãªä¾ãè¨ãã¨ãéè¦ãªæ©è½ã«ã¯ãã¹ã¯ã¼ãã®å確èªãå ¥ããããã¨ã ãéè¦ãªæ©è½ã¯ä¾ãã°ããã¹ã¯ã¼ãã®å¤æ´ãã¡ã¼ã«ã¢ãã¬ã¹ã®å¤æ´ããµã¼ãã¹ã®éä¼ãªã©ã ããããã®æ©è½ã«ãã¹ã¯ã¼ãã®å確èªãç¡ãå ´åãXSSãä¸ã¤ããã ãã§ãã¢ã«ã¦ã³ããä¹ã£åã£ããããµã¼ãã¹ãéä¼ãããåºæ¥ã¦ãã¾ãã(ãã¹ã¯ã¼ãå確èªã¯CSRF対çã«ããªã)
æ£ããèå¼±æ§å ±åã®ããæ¹
IPAãéãããããã¨ã対å¿ãé ããªãã®ãæ®éã§ããIPAãéãã¦èå¼±æ§ã®å ±åãæ¥ãã¨ãããã¨ã¯ãèå¼±æ§ã®çºè¦è ãã»ãã¥ãªãã£å°é家ã ã£ããããããã対çãåãããã¾ã§å ¬éãããªããã¨ãäºæ¸¬ã§ãããã¤ã¾ãIPAããèå¼±æ§ã®å ±åãæ¥ã=ç·æ¥ã§ã¯ãªãã¨ããå³å¼ãæãç«ã£ã¦ãã¾ãï¼ï¼
æ©æ¥ã«èå¼±æ§ãä¿®æ£ããããã¨ãæãã§ããã®ã§ããã°ã俺ã¯ã¼ããã¤XSSã®URLãtwitterã«æãããã¦ã¦ãºã¦ãºãã¦ããã ãã©ã©ã©ï¼ï¼ï¼ï¼ãã¨ãã姿å¢ãè¦ããªããä¸ã®äººã«é£çµ¡ããã®ãè¯ãã§ãããã大ä½ãã®æ¥ã®ãã¡ã«ä½ã¨ããã¦ãããã¯ãã§ãã
èå¼±æ§ã®å ±åã¯IPAéãã¨è«¸ã ã®æç¶ããé¢åããããªããã¨ãç¥ã£ã¦ããããããµã¼ãã¹éçºè å士ã®ãããã¯ã¼ã¯ã§ã¯ãIRCãå種IMãSkypeãªã©ã§ä¸ã®äººã«ç´æ¥ç¥ãããã®ãæ®éã§ããããã¦èå¼±æ§ã®å ±åãåããããã礼ã¨ãã¦ç¼èã寿å¸ã奢ãã¨ããæ £ç¿ãããã
ã¨ããã京é½ã«æ¬ç¤¾ãç½®ãHã¨ããä¼ç¤¾ã¯ãèå¼±æ§å ±åã®è¬ç¤¼ããã¯ã¦ãªãã¤ã³ããããã«ã©ã¼ã¹ã¿ã¼ãã§ä»£ç¨ããã¨ãã風ç¿ããããããå¿ ç¶çã«èå¼±æ§ãå ±åããã¡ãªãããå°ãªããªããããã¯é常ã«å±éºãªç¶æ ã§ãããããççãä¿ãããã