超絶技巧CSRF / Shibuya.XSS techtalk #7

CSRF, HTML Form Protocol Attack, Cross-protocol scripting attackについて

Transcript

1. $43' NBMB ௒ઈٕ޼
2. ࠓ೔ͷςʔϚ w $43'ʹ͍ͭͯ
   w Έͳ͞Μ͝ଘ஌Ͱ͢ΑͶ
   w ͋·Γ೉͍͜͠ͱ͸࿩͠·ͤΜ
3. $43'
   PS
   943' w DSPTT
   TJUF
   SFRVFTU
   GPSHFSZ
   w ΫϩεαΠτͰϦΫΤετΛڧ੍͢Δ߈ܸख๏
   w 944ͱฒΜͰྑ͘ݟ͔ͭΔ8FCΞϓϦέʔγϣ ϯͷ୅දతͳ੬ऑੑͷҰͭ
4. Կ͕ग़དྷΔ͔ʁ w ةݥ౓௿উखʹॻ͖ࠐΈ ͜Μʹͪ͸͜Μʹͪ͸
   w ةݥ౓ߴ
   ύεϫʔυΛউखʹมߋ
   w $43'ͰՄೳͳΞΫγϣϯʹΑ༷ͬͯʑ
   w ୯ͳΔΠλζϥ͔ΒΞΧ΢ϯτ৐ͬऔΓ·Ͱ
5. ະͩʹଟ͋͘Δ w 944͸ਖ਼͍͠ίʔυΛॻ͍͍ͯΕ͹ݩʑى͖ͳ ͍
   w $43'ରࡦ͸ηΩϡϦςΟͷͨΊͷ௥Ճͷࢪࡦ
   w ϑϨʔϜϫʔΫͳͲͰࣗಈԽ͞Εͯͳ͍ͱ࿙ΕΔ
   w อޢ͢΂͖͔Ͳ͏͔ͷ൑அ͕೉͍͠
6. $43'͸ࣄޙରॲʹͳΓ͕ͪ w ·͋ɺͿͬͪΌ͚ܝࣔ൘ͱ͔౤ථͱ͔ίϝϯτ ػೳͱ͔͸ࣄޙରॲͰྑ͍ͱࢥ͍·͢
   w ॏཁػೳ͕ಉ͡ײ֮ͰࣄޙରॲͩͱϠόΠʂ
   w ˠ
   ϦεΫͷߴ͍$43'ʹ͍ͭͯ঺հ͠·͢
7. ΞΧ΢ϯτ৐ͬऔΓ w ةݥͳ$43'ͷ୅දతͳ΋ͷ
   w ύεϫʔυมߋ͕$43'ͰՄೳ
   w ϝʔϧΞυϨεมߋ͕$43'ͰՄೳ
8. ࿈ܞΞΧ΢ϯτ௥Ճ w 0"VUI
   
   TUBUFύϥϝʔλ࢖ͬͯͳ͍
   w ෳ਺ϓϩόΠμͷJEͰϩάΠϯ͕Մೳ
   w ׂͱ͋Γ͕ͪ
9. ωοτϫʔΫػث΁ͷ߈ܸ w +7/
   ϧʔλʔ
   $43'
   ͳͲͰάάοͯΈͯͶ
10. ͍ΖΜͳ΋ͷʹ$43'͢Δ w $43'Ͱ+40/΍9.-ΛૹΔ
    w GPSN
    FODUZQFUFYUQMBJO
    Λ࢖͏
    w IUUQJUTFDVSJUZDPODFQUTDPN DTSGPOKTPOSFRVFTUT
    w IUUQQFOUFTUNPOLFZOFUCMPHDTSGYNM QPTUSFRVFTU
11. Ԡ༻ <form method="POST" enctype="text/plain" action="http://127.0.0.1:11211"> <textarea name="val"> set hoge 0 1000000 8 hogehoge </textarea> <input type="submit"> </form>
12. $43'ͰNFNDBDIFEʹॻ͖ࠐΉ <form method="POST" enctype="text/plain" action="http://127.0.0.1:11211"> <textarea name="val"> set hoge 0 1000000 8 hogehoge </textarea> <input type="submit"> </form>
13. ͑ͬʁ w ͍͖ͳΓIUUQͷนΛӽ͑ͯߦ͖·ͨ͠Ͷ
    w ରԠ͍ͯ͠ͳ͍ίϚϯυ͸ແࢹ͞ΕΔ
    POST / HTTP/1.1 ERROR w NFNDBDIFE
    QSPUPDPMͱͯ͠ղऍՄೳͳ෦෼ͩ ͚ධՁ͞ΕΔɻ
14. ͍ΖΜͳ΋ͷʹ$43'͢Δ w $SPTT
    QSPUPDPM
    ͳ
    SFRVFTU
    GPSHFSZ
    w ରԠ͍ͯ͠ͳ͍ίϚϯυΛదٓແࢹͯ͘͠Εͯί ωΫγϣϯΛ੾அ͠ͳ͍5$1αʔόʔ
    w ˢ͜͏͍͏ੑ࣭ͷαʔόʔʹ͸$43'ͰίϚϯυ ൃߦՄೳ
15. ࣮͸ݹ͔͘Β͋Δ߈ܸख๏ w )5.-
    'PSN
    1SPUPDPM
    "UUBDL
    ೥
    w IUUQTXXXKPDIFOUPQGDPNIGQB
    w 5IJT
    DBO
    CF
    VTFE
    UP
    TFOE
    DPNNBOET
    UP
    TFSWFST
    VTJOH
    "4$**
    CBTFE
    QSPUPDPMT
    MJLF
    4.51
    //51
    101
    *."1
    *3$
    BOE
    PUIFSTz
    w )5.-ϑΥʔϜ͔Β4.51ʹίϚϯυૹ৴
16. ৄ͘͠͸ ͜ͷຊͷষʹॻ͍ͯ͋Δ
17. ϒϥ΢βଆͰͷରࡦ w $SPTT1SPUPDPM
    TDSJQUJOH
    BUUBDL
    w IUUQXXXBSDIJWFNP[JMMBPSHQSPKFDUTOFUMJC 1PSU#BOOJOHIUNM
    w Α͘஌ΒΕ͍ͯΔαʔϏε͕ϒϩοΫ͞Εͨ
    w XFMM
    LOPXOͰ͸ͳ͍QPSU͸ೖͬͯͳ͍
    w ϙʔτมߋͯ͠ͷӡ༻΍࠷ۙͷ/P42-αʔόʔͳΜ͔ ͸อޢ͞Ε͍ͯͳ͍
18. αʔόʔଆͰͷରࡦ w ରԠ͍ͯ͠ͳ͍ίϚϯυ͕ૹΒΕͨΒ੾அ
    w )551
    
    ͕ૹΒΕ͖ͯͨΒ੾அ͢Δ
    w ͱ͍͏࣮૷ͷαʔόʔ΋͋ΔΒ͍͠
19. 8IBU`T
    OFX w ೥ͱݱ୅Ͱ΍΍ঢ়گ͕ҟͳ͍ͬͯΔ
    w ϒϥ΢β͔ΒϢʔβʔΞΫγϣϯແ͠ͰͷόΠφ Ϧσʔλૹ৴͕Մೳʹͳ͍ͬͯΔ
    w ੲ
    ϑΝΠϧΞοϓϩʔυ΍ϓϥάΠϯܦ༝͠ͳ ͚Ε͹ແཧͩͬͨ
    w ࠓ
    YISTFOE CMPC
    ͰՄೳ
20. ࡉ͔͍࿩ w ϑΝΠϧΞοϓϩʔυ͢Δ$43'
    w 'MBTIͰېࢭ͞Ε͕ͨ9)3
    MFWFMͰΉ͠Ζॊೈʹͳ͍ͬͯΔ
    w 'MBTI
    ͔Β'JMF
    6QMPBE
    ૬౰ͷ1045ϦΫΤετ͸ DSPTTEPNBJOYNM͕ඞཁ
    IUUQXXXBEPCFDPNKQEFWOFU qBTIQMBZFSBSUJDMFTGQMBZFS@TFDVSJUZ@DIBOHFTIUNM
    
    w ϩʔΧϧϑΝΠϧΛউखʹΞοϓϩʔυ
    ˠ
    ౰વແཧ
    w NVMUJQBSUGPSNEBUBΛ$43'
    ˠ
    Մೳ
    w $034ͷϓϦϑϥΠτର৅֎
21. όΠφϦ΋ૹΕΔΑ͏ʹ͢Δ w UFYUQMBJO
    ͩͱόΠφϦૹΕͳ͔ͬͨΓ͢Δ
 ˞ૹ৴͢ΔจࣈίʔυͷൣғͰ͔͠ૹΕͳ͍ɺؒҧͬͯͨΒڭ͑ͯ
    w NVMUJQBSUGPSNEBUBͰϑΝΠϧૹΕ͹ॊೈʹόΠφ Ϧૹ৴Մೳ
    ˠ
    ͨͩ͠Ϣʔβʔૢ࡞͕ඞཁͩͬͨ
    w /&8
    
    YISTFOE CMPC
    ͰόΠφϦ΋ૹΕΔΑ͏ʹɻ
    w ΤϥʔΛద౓ʹແࢹͯ͘͠ΕΕ͹
    όΠφϦϓϩτί ϧͰ΋$43'Ͱ஻ΕΔ
22. ΋ͬͱѱ༻͢Δ w NFNDBDIFEʹόΠφϦσʔλΛॻ͖ࠐΉ
    w SFNPUF
    DPEF
    FYFDVUJPOͷFYQMPJU
    w ΦϒδΣΫτσγϦΞϥΠβΛ௨ͨ͡ίʔυ࣮ ߦ
    w EFNP
24. Կ͕ग़དྷΔ͔ w σγϦΞϥΠβΛ௨ͨ͠೚ҙίʔυ࣮ߦ
 ˠ
    େ൒ͷݴޠͰಉ༷ͷ߈ܸख๏͕͋Δ
    w NFNDBDIFEͷΞυϨε͕ط஌ͩͬͨΒ೚ҙͷ Ωʔʹ೚ҙͷσʔλΛॻ͖ࠐΜͩΓ
    w ߈ܸ༻ͷσʔλΛૹΓࠐΊ͹"QQαʔόʔ্Ͱ ೚ҙίʔυ࣮ߦΛҾ͖ى͜͢͜ͱ͕ग़དྷΔ
25. ύεϫʔυೝূʹΑΔରࡦ w NFNDBDIFE
    ͸ೝূػߏ͕ແ͍
    w *1ΞυϨε΍ΠϯλϑΣʔε੍ݶͰೝূػߏΛඋ ͍͑ͯͳ͍ϛυϧ΢ΣΞ΋ଟ͍
    w ೝূ͔͚͓͚ͯ͹0,
    ˠ
    ൒෼ਖ਼ղ
    ൒෼ؒҧ͍
26. ೝূΛಥഁ͢Δ$43' w 3FEJTͩͱύεϫʔυΛ͔͚ΒΕΔ
    w 3FEJTͷύεϫʔυೝূ
    BVUI
    NZTFDSFUQBTTXPSE
 TFU
    LFZ
    WBMVF
    w ͜ΜͳͷΛૹΕ͹ྑ͍͚ͩͳͷͰಥഁՄೳ
27. ϛυϧ΢ΣΞͷύεϫʔυ w ͔͚͓ͯ͘ʹͨ͜͜͠ͱ͸ͳ͍͕
    w ಺෦ͷωοτϫʔΫߏ੒ͳͲ͕ط஌ʹͳΔέʔε
 ˠιʔείʔυ΍ઃఆ৘ใ΋࿙Ӯ͍ͯ͠Δ͜ͱ΋ ૝ఆ͢΂͖
    w ྫ͑͹ୀ৬ऀ͕಺෦৘ใΛώϯτʹݱ৬ࣾһΛ ᠘ʹ͔͚ͯSFNPUF
    DPEF
    FYFDVUJPOՄೳ
28. $43'ͰಥഁͰ͖Δೝূ w ݁ՌͷಡΈऔΓͷඞཁ͕ͳ͍ೝূํࣜͰ͋Ε͹ɺ ύεϫʔυΛૹΓ͚ͭΔ͚ͩͳͷͰಥഁՄೳ
    w νϟϨϯδϨεϙϯεܗࣜͷೝূͰ͋Ε͹ಥഁ Ͱ͖ͳ͍
    w $43'Ͱ͸ϦΫΤετͷ݁Ռ͕ಡΊͳ͍ͷͰ
29. ϛυϧ΢ΣΞ΁ͷ$43'ରࡦ w "$-͋Δ͔Β҆શͱࢥͬͯ·ͤΜ͔ʁ
    w ωοτϫʔΫࣗମΛִ཭͢Δͷ͕ྑ͍
    w ִ཭͢Δ΋ͷ͸ͪΌΜͱִ཭ɺιʔείʔυ΍ ύεϫʔυ͕ط஌ͳΒ߈ܸͰ͖ΔΑ͏ͳͷ͸
 ʮୀ৬ऀ޲͚όοΫυΞʯ
30. ࠓޙͷ܏޲ͱରࡦ w ϙʔτ੍ݶʹ͍ͭͯ͸࢓༷͕໌֬Խ͞ΕΔΑ͏ ʹͳͬͨ
    
    w IUUQTGFUDITQFDXIBUXHPSHQPSU CMPDLJOH
    w ͔͠͠
    XFMM
    LOPXO
    Ͱͳ͍QPSU͸Ҿ͖ଓ͖
 DSPTT
    QSPUPDPM
    BUUBDL͕ՄೳͰ͠ΐ͏
31. ࠓޙͷ܏޲ͱରࡦ w ಺෦ωοτϫʔΫ޲͚ͷ$43'ରࡦ
    w $034
    BOE
    3'$
    
 IUUQTNJLFXFTUHJUIVCJPDPSTSGD
    w ϒϥ΢βଆͰͷରࡦ΋ೖΔ͔΋
32. ྨࣅͷ໰୊ w $SPTTTJUF
    TDSJQUJOH
    
    SFRVFTU
    GPSHFSZ
    w TJUF
    ˠ
    QSPUPDPM
    
    TJUF
    ˠ
    BQQ
    w *1$ͷͨΊͷϩʔΧϧαʔόʔΛ࡞ΔΞϓϦ
    w ΧελϜεΩʔϜ΁ͷϦΫΤετڧ੍
    w ϦΫΤετ͸ҰํతʹૹΕΔ
    ૬ޓʹೝূ͢Δϓ ϩτίϧʹͳ͍ͬͯΔ͔֬ೝ͠·͠ΐ͏
33. ·ͱΊ w $43'ΛͳΊͯ͸͍͚ͳ͍
    w ʮউखʹॻ͖ࠐΈʯग़དྷΔ͚͕ͩͩ
 ॻ͖ࠐΈର৅ʹΑͬͯ͸ग़དྷΔ͜ͱ͕෯޿͍
    w DSPTT
    QSPUPDPM
    ͳ
    $43'
    
    
 YISTFOE CMPC ͰόΠφϦૹΕΔ
    w )5.-Ͱػೳ͕૿͑Δˠ߈ܸํ๏΍ϦεΫ૿Ճ
34. ऴΘΓ w "OZ
    RVFTUJPOT