超絶技巧CSRF / Shibuya.XSS techtalk #7

Transcript

1. $43' NBMB ௒ઈٕ޼

2. ࠓ೔ͷςʔϚ w $43'ʹ͍ͭͯ w Έͳ͞Μ͝ଘ஌Ͱ͢ΑͶ w ͋·Γ೉͍͜͠ͱ͸࿩͠·ͤΜ

3. $43'PS943' w DSPTTTJUFSFRVFTUGPSHFSZ w ΫϩεαΠτͰϦΫΤετΛڧ੍͢Δ߈ܸख๏ w 944ͱฒΜͰྑ͘ݟ͔ͭΔ8FCΞϓϦέʔγϣ ϯͷ୅දతͳ੬ऑੑͷҰͭ

4. Կ͕ग़དྷΔ͔ʁ w ةݥ౓௿উखʹॻ͖ࠐΈ ͜Μʹͪ͸͜Μʹͪ͸ w ةݥ౓ߴύεϫʔυΛউखʹมߋ w $43'ͰՄೳͳΞΫγϣϯʹΑ༷ͬͯʑ w

   ୯ͳΔΠλζϥ͔ΒΞΧ΢ϯτ৐ͬऔΓ·Ͱ

5. ະͩʹଟ͋͘Δ w 944͸ਖ਼͍͠ίʔυΛॻ͍͍ͯΕ͹ݩʑى͖ͳ ͍ w $43'ରࡦ͸ηΩϡϦςΟͷͨΊͷ௥Ճͷࢪࡦ w ϑϨʔϜϫʔΫͳͲͰࣗಈԽ͞Εͯͳ͍ͱ࿙ΕΔ w อޢ͢΂͖͔Ͳ͏͔ͷ൑அ͕೉͍͠

6. $43'͸ࣄޙରॲʹͳΓ͕ͪ w ·͋ɺͿͬͪΌ͚ܝࣔ൘ͱ͔౤ථͱ͔ίϝϯτ ػೳͱ͔͸ࣄޙରॲͰྑ͍ͱࢥ͍·͢ w ॏཁػೳ͕ಉ͡ײ֮ͰࣄޙରॲͩͱϠόΠʂ w ˠϦεΫͷߴ͍$43'ʹ͍ͭͯ঺հ͠·͢

7. ΞΧ΢ϯτ৐ͬऔΓ w ةݥͳ$43'ͷ୅දతͳ΋ͷ w ύεϫʔυมߋ͕$43'ͰՄೳ w ϝʔϧΞυϨεมߋ͕$43'ͰՄೳ

8. ࿈ܞΞΧ΢ϯτ௥Ճ w 0"VUI TUBUFύϥϝʔλ࢖ͬͯͳ͍ w ෳ਺ϓϩόΠμͷJEͰϩάΠϯ͕Մೳ w ׂͱ͋Γ͕ͪ

9. ωοτϫʔΫػث΁ͷ߈ܸ w +7/ϧʔλʔ$43'ͳͲͰάάοͯΈͯͶ

10. ͍ΖΜͳ΋ͷʹ$43'͢Δ w $43'Ͱ+40/΍9.-ΛૹΔ w GPSNFODUZQFUFYUQMBJOΛ࢖͏ w IUUQJUTFDVSJUZDPODFQUTDPN DTSGPOKTPOSFRVFTUT w IUUQQFOUFTUNPOLFZOFUCMPHDTSGYNM

    QPTUSFRVFTU

11. Ԡ༻ <form method="POST" enctype="text/plain" action="http://127.0.0.1:11211"> <textarea name="val"> set hoge 0

    1000000 8 hogehoge </textarea> <input type="submit"> </form>

12. $43'ͰNFNDBDIFEʹॻ͖ࠐΉ <form method="POST" enctype="text/plain" action="http://127.0.0.1:11211"> <textarea name="val"> set hoge 0

    1000000 8 hogehoge </textarea> <input type="submit"> </form>

13. ͑ͬʁ w ͍͖ͳΓIUUQͷนΛӽ͑ͯߦ͖·ͨ͠Ͷ w ରԠ͍ͯ͠ͳ͍ίϚϯυ͸ແࢹ͞ΕΔ POST / HTTP/1.1 ERROR w

    NFNDBDIFEQSPUPDPMͱͯ͠ղऍՄೳͳ෦෼ͩ ͚ධՁ͞ΕΔɻ

14. ͍ΖΜͳ΋ͷʹ$43'͢Δ w $SPTTQSPUPDPMͳSFRVFTUGPSHFSZ w ରԠ͍ͯ͠ͳ͍ίϚϯυΛదٓແࢹͯ͘͠Εͯί ωΫγϣϯΛ੾அ͠ͳ͍5$1αʔόʔ w ˢ͜͏͍͏ੑ࣭ͷαʔόʔʹ͸$43'ͰίϚϯυ ൃߦՄೳ

15. ࣮͸ݹ͔͘Β͋Δ߈ܸख๏ w )5.-'PSN1SPUPDPM"UUBDL ೥ w IUUQTXXXKPDIFOUPQGDPNIGQB w 5IJTDBOCFVTFEUPTFOEDPNNBOETUP TFSWFSTVTJOH"4$**CBTFEQSPUPDPMTMJLF

    4.51 //51 101 *."1 *3$ BOEPUIFSTz w )5.-ϑΥʔϜ͔Β4.51ʹίϚϯυૹ৴

16. ৄ͘͠͸ ͜ͷຊͷষʹॻ͍ͯ͋Δ

17. ϒϥ΢βଆͰͷରࡦ w $SPTT1SPUPDPMTDSJQUJOHBUUBDL w IUUQXXXBSDIJWFNP[JMMBPSHQSPKFDUTOFUMJC 1PSU#BOOJOHIUNM w Α͘஌ΒΕ͍ͯΔαʔϏε͕ϒϩοΫ͞Εͨ w XFMMLOPXOͰ͸ͳ͍QPSU͸ೖͬͯͳ͍

    w ϙʔτมߋͯ͠ͷӡ༻΍࠷ۙͷ/P42-αʔόʔͳΜ͔ ͸อޢ͞Ε͍ͯͳ͍

18. αʔόʔଆͰͷରࡦ w ରԠ͍ͯ͠ͳ͍ίϚϯυ͕ૹΒΕͨΒ੾அ w )551͕ૹΒΕ͖ͯͨΒ੾அ͢Δ w ͱ͍͏࣮૷ͷαʔόʔ΋͋ΔΒ͍͠

19. 8IBU`TOFX w ೥ͱݱ୅Ͱ΍΍ঢ়گ͕ҟͳ͍ͬͯΔ w ϒϥ΢β͔ΒϢʔβʔΞΫγϣϯແ͠ͰͷόΠφ Ϧσʔλૹ৴͕Մೳʹͳ͍ͬͯΔ w ੲϑΝΠϧΞοϓϩʔυ΍ϓϥάΠϯܦ༝͠ͳ ͚Ε͹ແཧͩͬͨ w

    ࠓYISTFOE CMPC ͰՄೳ

20. ࡉ͔͍࿩ w ϑΝΠϧΞοϓϩʔυ͢Δ$43' w 'MBTIͰېࢭ͞Ε͕ͨ9)3MFWFMͰΉ͠Ζॊೈʹͳ͍ͬͯΔ w 'MBTI͔Β'JMF6QMPBE૬౰ͷ1045ϦΫΤετ͸ DSPTTEPNBJOYNM͕ඞཁ IUUQXXXBEPCFDPNKQEFWOFU qBTIQMBZFSBSUJDMFTGQMBZFS@TFDVSJUZ@DIBOHFTIUNM

    w ϩʔΧϧϑΝΠϧΛউखʹΞοϓϩʔυˠ౰વແཧ w NVMUJQBSUGPSNEBUBΛ$43'ˠՄೳ w $034ͷϓϦϑϥΠτର৅֎

21. όΠφϦ΋ૹΕΔΑ͏ʹ͢Δ w UFYUQMBJOͩͱόΠφϦૹΕͳ͔ͬͨΓ͢Δ
 ˞ૹ৴͢ΔจࣈίʔυͷൣғͰ͔͠ૹΕͳ͍ɺؒҧͬͯͨΒڭ͑ͯ w NVMUJQBSUGPSNEBUBͰϑΝΠϧૹΕ͹ॊೈʹόΠφ Ϧૹ৴Մೳˠͨͩ͠Ϣʔβʔૢ࡞͕ඞཁͩͬͨ w /&8YISTFOE

    CMPC ͰόΠφϦ΋ૹΕΔΑ͏ʹɻ w ΤϥʔΛద౓ʹແࢹͯ͘͠ΕΕ͹ όΠφϦϓϩτί ϧͰ΋$43'Ͱ஻ΕΔ

22. ΋ͬͱѱ༻͢Δ w NFNDBDIFEʹόΠφϦσʔλΛॻ͖ࠐΉ w SFNPUFDPEFFYFDVUJPOͷFYQMPJU w ΦϒδΣΫτσγϦΞϥΠβΛ௨ͨ͡ίʔυ࣮ ߦ w EFNP

23. None

24. Կ͕ग़དྷΔ͔ w σγϦΞϥΠβΛ௨ͨ͠೚ҙίʔυ࣮ߦ
 ˠେ൒ͷݴޠͰಉ༷ͷ߈ܸख๏͕͋Δ w NFNDBDIFEͷΞυϨε͕ط஌ͩͬͨΒ೚ҙͷ Ωʔʹ೚ҙͷσʔλΛॻ͖ࠐΜͩΓ w ߈ܸ༻ͷσʔλΛૹΓࠐΊ͹"QQαʔόʔ্Ͱ ೚ҙίʔυ࣮ߦΛҾ͖ى͜͢͜ͱ͕ग़དྷΔ

25. ύεϫʔυೝূʹΑΔରࡦ w NFNDBDIFE͸ೝূػߏ͕ແ͍ w *1ΞυϨε΍ΠϯλϑΣʔε੍ݶͰೝূػߏΛඋ ͍͑ͯͳ͍ϛυϧ΢ΣΞ΋ଟ͍ w ೝূ͔͚͓͚ͯ͹0, ˠ൒෼ਖ਼ղ൒෼ؒҧ͍

26. ೝূΛಥഁ͢Δ$43' w 3FEJTͩͱύεϫʔυΛ͔͚ΒΕΔ w 3FEJTͷύεϫʔυೝূ BVUINZTFDSFUQBTTXPSE
 TFULFZWBMVF w ͜ΜͳͷΛૹΕ͹ྑ͍͚ͩͳͷͰಥഁՄೳ

27. ϛυϧ΢ΣΞͷύεϫʔυ w ͔͚͓ͯ͘ʹͨ͜͜͠ͱ͸ͳ͍͕ w ಺෦ͷωοτϫʔΫߏ੒ͳͲ͕ط஌ʹͳΔέʔε
 ˠιʔείʔυ΍ઃఆ৘ใ΋࿙Ӯ͍ͯ͠Δ͜ͱ΋ ૝ఆ͢΂͖ w ྫ͑͹ୀ৬ऀ͕಺෦৘ใΛώϯτʹݱ৬ࣾһΛ ᠘ʹ͔͚ͯSFNPUFDPEFFYFDVUJPOՄೳ

28. $43'ͰಥഁͰ͖Δೝূ w ݁ՌͷಡΈऔΓͷඞཁ͕ͳ͍ೝূํࣜͰ͋Ε͹ɺ ύεϫʔυΛૹΓ͚ͭΔ͚ͩͳͷͰಥഁՄೳ w νϟϨϯδϨεϙϯεܗࣜͷೝূͰ͋Ε͹ಥഁ Ͱ͖ͳ͍ w $43'Ͱ͸ϦΫΤετͷ݁Ռ͕ಡΊͳ͍ͷͰ

29. ϛυϧ΢ΣΞ΁ͷ$43'ରࡦ w "$-͋Δ͔Β҆શͱࢥͬͯ·ͤΜ͔ʁ w ωοτϫʔΫࣗମΛִ཭͢Δͷ͕ྑ͍ w ִ཭͢Δ΋ͷ͸ͪΌΜͱִ཭ɺιʔείʔυ΍ ύεϫʔυ͕ط஌ͳΒ߈ܸͰ͖ΔΑ͏ͳͷ͸
 ʮୀ৬ऀ޲͚όοΫυΞʯ

30. ࠓޙͷ܏޲ͱରࡦ w ϙʔτ੍ݶʹ͍ͭͯ͸࢓༷͕໌֬Խ͞ΕΔΑ͏ ʹͳͬͨ w IUUQTGFUDITQFDXIBUXHPSHQPSU CMPDLJOH w ͔͠͠XFMMLOPXOͰͳ͍QPSU͸Ҿ͖ଓ͖
 DSPTTQSPUPDPMBUUBDL͕ՄೳͰ͠ΐ͏

31. ࠓޙͷ܏޲ͱରࡦ w ಺෦ωοτϫʔΫ޲͚ͷ$43'ରࡦ w $034BOE3'$
 IUUQTNJLFXFTUHJUIVCJPDPSTSGD w ϒϥ΢βଆͰͷରࡦ΋ೖΔ͔΋

32. ྨࣅͷ໰୊ w $SPTTTJUF TDSJQUJOHSFRVFTUGPSHFSZ w TJUFˠQSPUPDPMTJUFˠBQQ w *1$ͷͨΊͷϩʔΧϧαʔόʔΛ࡞ΔΞϓϦ w

    ΧελϜεΩʔϜ΁ͷϦΫΤετڧ੍ w ϦΫΤετ͸ҰํతʹૹΕΔ૬ޓʹೝূ͢Δϓ ϩτίϧʹͳ͍ͬͯΔ͔֬ೝ͠·͠ΐ͏

33. ·ͱΊ w $43'ΛͳΊͯ͸͍͚ͳ͍ w ʮউखʹॻ͖ࠐΈʯग़དྷΔ͚͕ͩͩ
 ॻ͖ࠐΈର৅ʹΑͬͯ͸ग़དྷΔ͜ͱ͕෯޿͍ w DSPTTQSPUPDPMͳ$43' 
 YISTFOE

    CMPC ͰόΠφϦૹΕΔ w )5.-Ͱػೳ͕૿͑Δˠ߈ܸํ๏΍ϦεΫ૿Ճ

34. ऴΘΓ w "OZRVFTUJPOT