Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
0.0.0.0 day
Search
circled9
August 23, 2024
Programming
0
82
0.0.0.0 day
Niigata 5min Tech #11で発表したスライドです。
circled9
August 23, 2024
Tweet
Share
More Decks by circled9
See All by circled9
キースイッチ入門
circled9
0
57
CloudflareのAI関連の機能さわってみた
circled9
0
470
小数の丸め誤差の話
circled9
0
120
数値の文字列をパースしよう
circled9
0
180
🔥 Hono v4 やってみた
circled9
1
170
JetBrains AI Assistant を試してみた
circled9
1
460
Fresh
circled9
0
230
React Hooks 勉強会 vol.3
circled9
2
420
JSON.stringify()
circled9
2
480
Other Decks in Programming
See All in Programming
Generating OpenAPI schema from serializers throughout the Rails stack - Kyobashi.rb #5
envek
1
430
LINE messaging APIを使ってGoogleカレンダーと連携した予約ツールを作ってみた
takumakoike
0
130
楽しく向き合う例外対応
okutsu
0
740
Honoとフロントエンドの 型安全性について
yodaka
7
1.5k
Google Cloudとo11yで実現するアプリケーション開発者主体のDB改善
nnaka2992
1
130
Webフレームワークとともに利用するWeb components / JSConf.jp おかわり
spring_raining
1
140
Boos Performance and Developer Productivity with Jakarta EE 11
ivargrimstad
0
650
Boost Performance and Developer Productivity with Jakarta EE 11
ivargrimstad
0
1.1k
クリーンアーキテクチャから見る依存の向きの大切さ
shimabox
5
1.2k
Drawing Heighway’s Dragon- Recursive Function Rewrite- From Imperative Style in Pascal 64 To Functional Style in Scala 3
philipschwarz
PRO
0
160
Your Architecture as a Crime Scene:Forensic Analysis @bastacon 2025 in Frankfurt
manfredsteyer
PRO
0
100
[JAWS DAYS 2025] 最近の DB の競合解決の仕組みが分かった気になってみた
maroon1st
0
170
Featured
See All Featured
YesSQL, Process and Tooling at Scale
rocio
172
14k
Code Review Best Practice
trishagee
67
18k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
366
25k
GraphQLとの向き合い方2022年版
quramy
44
14k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
30
2.3k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.7k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
46
2.4k
Become a Pro
speakerdeck
PRO
26
5.2k
KATA
mclloyd
29
14k
Rebuilding a faster, lazier Slack
samanthasiow
80
8.9k
What's in a price? How to price your products and services
michaelherold
244
12k
Transcript
0.0.0.0 day Niigata 5min Tech #11 @circled9
ࣗݾհ @circled9 দҪ ਖ਼ࢤ (Matsui Masashi) גࣜձࣾϞχΫϧ IPΞυϨε127.0.0.1Ͱ͢
ࠓ͢͜ͱ • 0.0.0.0 dayͱ͍͏੬ऑੑͷհΛ͠·͢ • ৄ͘͜͠ͷهࣄΛࢀর͍ͯͩ͘͠͞ • https://www.oligo.security/blog/0-0-0-0-day- exploiting-localhost-apis-from-the-browser 3
֓ཁ • ֎෦ϖʔδ͔ΒϩʔΧϧʹ͚ͯϦΫΤετΛඈͤΔͱ͍͏ • ϩʔΧϧͰಈ͍͍ͯΔαʔϏε͕ૂΘΕΔ͜ͱ͕͋Δ • ֤ϒϥβͷରԠ͜Ε͔Βʢ8݄த०࣌ʣ 4
ͪΐͬͱੲͷ • ֎෦ϖʔδ͔ΒϩʔΧϧͷΞυϨεʹରͯ͠ϦΫΤετΛඈͤͨ • ͦΕΛར༻ͯ͠Ϛγϯ্Ͱಈ͍͍ͯΔαʔόʔͷϙʔτΛεΩϟϯ͠ ͯݸਓΛࣝผ͠Α͏ͱ͢Δ͍ํ͞Ε͍ͯͨ • ͍ΘΏΔϑΟϯΨʔϓϦϯςΟϯά • ͦΕҎ֎ʹϩʔΧϧωοτϫʔΫͷϧʔλʔʹରͯ͠߈ܸΛࢼΈΔ
έʔε͋ͬͨΓͨ͠ 5
CORS (Cross-Origin Resource Sharing) • CORSҟͳΔυϝΠϯʹର͢ΔϦιʔεͷΞΫηεͷ੍ޚΛ͢Δ • CORSʹΑΓ֎෦ϖʔδ͔ΒϩʔΧϧʹରͯ͠উखʹΞΫηε͠Α͏ ͱ͢Δͱ͔ΕΔΑ͏ʹͳͬͨ •
ϩʔΧϧΞΫηεʹΑΔϑΟϯΨʔϓϦϯςΟϯά͕͛ΔΑ͏ʹ ͳͬͨʂ 6
ϦΫΤετ͕࣮ߦ͞ΕΔ • CORSϨεϙϯεΛ੍ޚ͢Δ࡞Γʹͳ͍ͬͯΔ • ͦͷͨΊϦΫΤετͦͷͷ࣮ߦ͞ΕΔ • ϦΫΤετ͕࣮ߦ͞ΕΔ͚ͩͰཱ͢Δ߈ܸʹରͯ͠ແඋ 7
PNA (Private Network Access) • Chromeʹ࣮͞Ε͍ͯΔ༷ • ҆શੑͷ͍ίϯςΩετ͔Β҆શੑͷߴ͍ίϯςΩετʹ௨৴Ͱ ͖ͳ͍ͱ͍͏Έ •
CORSͱҧ͍ϦΫΤετͷ࣮ߦΛ੍ޚ͢Δ 8
https://developer.chrome.com/blog/private-network-access-update?hl=ja 9
͜ΕͰ҆৺ʂ
None
0.0.0.0͕ͳ͍
ࠓޙͷ༧ఆ • Chrome0.0.0.0ΛϒϩοΫ͢Δ༧ఆ • 128͔ΒϩʔϧΞτͯ͠133·Ͱʹྃ༧ఆ • Safari0.0.0.0ΛϒϩοΫ͢Δ༧ఆ • Webkitʹ0.0.0.0ΛϒϩοΫ͢Δมߋ͕ೖͬͨ •
FirefoxͷରԠະఆ • MDNͷ༷ͷํΛߋ৽ͨͬ͠Ά͍ͷͰϒϩοΫ͢Δͣ 13
Α͘Θ͔ͬͯͳ͍͜ͱ • 0.0.0.0ΛϒϩοΫ͢ΔΛ͍ͯ͠Δ͕ɺͦΕҎલʹSafariͱ FirefoxPNAΛ࣮ͯ͠ͳ͍ • 0.0.0.0ΛϒϩοΫ͢Δ͚ͩͰޮՌ͕ബ͍ͷͰʁ • ͋ͱɺखݩͰPNAͷϔομʔ͚ͭͯ௨৴ڐՄ͢Δ࣮Ͱ͖ͳ͔ͬͨɺ Θ͔ΒΜ 14
͓͠·͍