超絶技巧CSRF / Shibuya.XSS techtalk #7

CSRF, HTML Form Protocol Attack, Cross-protocol scripting attackについて

Transcript

1. $43'
   NBMB
   ௒ઈٕ޼
   

   View Slide

2. ࠓ೔ͷςʔϚ
   w $43'ʹ͍ͭͯ
   w Έͳ͞Μ͝ଘ஌Ͱ͢ΑͶ
   w ͋·Γ೉͍͜͠ͱ͸࿩͠·ͤΜ
   

   View Slide

3. $43'PS943'
   w DSPTTTJUFSFRVFTUGPSHFSZ
   w ΫϩεαΠτͰϦΫΤετΛڧ੍͢Δ߈ܸख๏
   w 944ͱฒΜͰྑ͘ݟ͔ͭΔ8FCΞϓϦέʔγϣ
   ϯͷ୅දతͳ੬ऑੑͷҰͭ
   

   View Slide

4. Կ͕ग़དྷΔ͔ʁ
   w ةݥ౓௿উखʹॻ͖ࠐΈ ͜Μʹͪ͸͜Μʹͪ͸
   
   w ةݥ౓ߴύεϫʔυΛউखʹมߋ
   w $43'ͰՄೳͳΞΫγϣϯʹΑ༷ͬͯʑ
   w ୯ͳΔΠλζϥ͔ΒΞΧ΢ϯτ৐ͬऔΓ·Ͱ
   

   View Slide

5. ະͩʹଟ͋͘Δ
   w 944͸ਖ਼͍͠ίʔυΛॻ͍͍ͯΕ͹ݩʑى͖ͳ
   ͍
   w $43'ରࡦ͸ηΩϡϦςΟͷͨΊͷ௥Ճͷࢪࡦ
   w ϑϨʔϜϫʔΫͳͲͰࣗಈԽ͞Εͯͳ͍ͱ࿙ΕΔ
   w อޢ͢΂͖͔Ͳ͏͔ͷ൑அ͕೉͍͠
   

   View Slide

6. $43'͸ࣄޙରॲʹͳΓ͕ͪ
   w ·͋ɺͿͬͪΌ͚ܝࣔ൘ͱ͔౤ථͱ͔ίϝϯτ
   ػೳͱ͔͸ࣄޙରॲͰྑ͍ͱࢥ͍·͢
   w ॏཁػೳ͕ಉ͡ײ֮ͰࣄޙରॲͩͱϠόΠʂ
   w ˠϦεΫͷߴ͍$43'ʹ͍ͭͯ঺հ͠·͢
   

   View Slide

7. ΞΧ΢ϯτ৐ͬऔΓ
   w ةݥͳ$43'ͷ୅දతͳ΋ͷ
   w ύεϫʔυมߋ͕$43'ͰՄೳ
   w ϝʔϧΞυϨεมߋ͕$43'ͰՄೳ
   

   View Slide

8. ࿈ܞΞΧ΢ϯτ௥Ճ
   w 0"VUITUBUFύϥϝʔλ࢖ͬͯͳ͍
   w ෳ਺ϓϩόΠμͷJEͰϩάΠϯ͕Մೳ
   w ׂͱ͋Γ͕ͪ
   

   View Slide

9. ωοτϫʔΫػث΁ͷ߈ܸ
   w +7/ϧʔλʔ$43'ͳͲͰάάοͯΈͯͶ
   

   View Slide

10. ͍ΖΜͳ΋ͷʹ$43'͢Δ
    w $43'Ͱ+40/΍9.-ΛૹΔ
    w GPSNFODUZQFUFYUQMBJOΛ࢖͏
    w IUUQJUTFDVSJUZDPODFQUTDPN
    DTSGPOKTPOSFRVFTUT
    w IUUQQFOUFTUNPOLFZOFUCMPHDTSGYNM
    QPTUSFRVFTU
    

    View Slide

11. Ԡ༻
    action="http://127.0.0.1:11211">
    
    set hoge 0 1000000 8
    hogehoge
    
    
    
    

    View Slide

12. $43'ͰNFNDBDIFEʹॻ͖ࠐΉ
    action="http://127.0.0.1:11211">
    
    set hoge 0 1000000 8
    hogehoge
    
    
    
    

    View Slide

13. ͑ͬʁ
    w ͍͖ͳΓIUUQͷนΛӽ͑ͯߦ͖·ͨ͠Ͷ
    w ରԠ͍ͯ͠ͳ͍ίϚϯυ͸ແࢹ͞ΕΔ
    POST / HTTP/1.1
    ERROR
    w NFNDBDIFEQSPUPDPMͱͯ͠ղऍՄೳͳ෦෼ͩ
    ͚ධՁ͞ΕΔɻ
    

    View Slide

14. ͍ΖΜͳ΋ͷʹ$43'͢Δ
    w $SPTTQSPUPDPMͳSFRVFTUGPSHFSZ
    w ରԠ͍ͯ͠ͳ͍ίϚϯυΛదٓແࢹͯ͘͠Εͯί
    ωΫγϣϯΛ੾அ͠ͳ͍5$1αʔόʔ
    w ˢ͜͏͍͏ੑ࣭ͷαʔόʔʹ͸$43'ͰίϚϯυ
    ൃߦՄೳ
    

    View Slide

15. ࣮͸ݹ͔͘Β͋Δ߈ܸख๏
    w )5.-'PSN1SPUPDPM"UUBDL ೥
    
    w IUUQTXXXKPDIFOUPQGDPNIGQB
    w 5IJTDBOCFVTFEUPTFOEDPNNBOETUP
    TFSWFSTVTJOH"4$**CBTFEQSPUPDPMTMJLF
    4.51 //51 101 *."1 *3$ BOEPUIFSTz
    w )5.-ϑΥʔϜ͔Β4.51ʹίϚϯυૹ৴
    

    View Slide

16. ৄ͘͠͸
    ͜ͷຊͷষʹॻ͍ͯ͋Δ
    

    View Slide

17. ϒϥ΢βଆͰͷରࡦ
    w $SPTT1SPUPDPMTDSJQUJOHBUUBDL
    w IUUQXXXBSDIJWFNP[JMMBPSHQSPKFDUTOFUMJC
    1PSU#BOOJOHIUNM
    w Α͘஌ΒΕ͍ͯΔαʔϏε͕ϒϩοΫ͞Εͨ
    w XFMMLOPXOͰ͸ͳ͍QPSU͸ೖͬͯͳ͍
    w ϙʔτมߋͯ͠ͷӡ༻΍࠷ۙͷ/P42-αʔόʔͳΜ͔
    ͸อޢ͞Ε͍ͯͳ͍
    

    View Slide

18. αʔόʔଆͰͷରࡦ
    w ରԠ͍ͯ͠ͳ͍ίϚϯυ͕ૹΒΕͨΒ੾அ
    w )551͕ૹΒΕ͖ͯͨΒ੾அ͢Δ
    w ͱ͍͏࣮૷ͷαʔόʔ΋͋ΔΒ͍͠
    
    

    View Slide

19. 8IBU`TOFX
    w ೥ͱݱ୅Ͱ΍΍ঢ়گ͕ҟͳ͍ͬͯΔ
    w ϒϥ΢β͔ΒϢʔβʔΞΫγϣϯແ͠ͰͷόΠφ
    Ϧσʔλૹ৴͕Մೳʹͳ͍ͬͯΔ
    w ੲϑΝΠϧΞοϓϩʔυ΍ϓϥάΠϯܦ༝͠ͳ
    ͚Ε͹ແཧͩͬͨ
    w ࠓYISTFOE CMPC
    ͰՄೳ
    

    View Slide

20. ࡉ͔͍࿩
    w ϑΝΠϧΞοϓϩʔυ͢Δ$43'
    w 'MBTIͰېࢭ͞Ε͕ͨ9)3MFWFMͰΉ͠Ζॊೈʹͳ͍ͬͯΔ
    w 'MBTI͔Β'JMF6QMPBE૬౰ͷ1045ϦΫΤετ͸
    DSPTTEPNBJOYNM͕ඞཁ IUUQXXXBEPCFDPNKQEFWOFU
    qBTIQMBZFSBSUJDMFTGQMBZFS@TFDVSJUZ@DIBOHFTIUNM
    
    w ϩʔΧϧϑΝΠϧΛউखʹΞοϓϩʔυˠ౰વແཧ
    w NVMUJQBSUGPSNEBUBΛ$43'ˠՄೳ
    w $034ͷϓϦϑϥΠτର৅֎
    

    View Slide

21. όΠφϦ΋ૹΕΔΑ͏ʹ͢Δ
    w UFYUQMBJOͩͱόΠφϦૹΕͳ͔ͬͨΓ͢Δ

    ˞ૹ৴͢ΔจࣈίʔυͷൣғͰ͔͠ૹΕͳ͍ɺؒҧͬͯͨΒڭ͑ͯ
    
    w NVMUJQBSUGPSNEBUBͰϑΝΠϧૹΕ͹ॊೈʹόΠφ
    Ϧૹ৴Մೳˠͨͩ͠Ϣʔβʔૢ࡞͕ඞཁͩͬͨ
    w /&8YISTFOE CMPC
    ͰόΠφϦ΋ૹΕΔΑ͏ʹɻ
    w ΤϥʔΛద౓ʹແࢹͯ͘͠ΕΕ͹
    όΠφϦϓϩτί
    ϧͰ΋$43'Ͱ஻ΕΔ
    

    View Slide

22. ΋ͬͱѱ༻͢Δ
    w NFNDBDIFEʹόΠφϦσʔλΛॻ͖ࠐΉ
    w SFNPUFDPEFFYFDVUJPOͷFYQMPJU
    w ΦϒδΣΫτσγϦΞϥΠβΛ௨ͨ͡ίʔυ࣮
    ߦ
    w EFNP
    

    View Slide

23. View Slide

24. Կ͕ग़དྷΔ͔
    w σγϦΞϥΠβΛ௨ͨ͠೚ҙίʔυ࣮ߦ

    ˠେ൒ͷݴޠͰಉ༷ͷ߈ܸख๏͕͋Δ
    w NFNDBDIFEͷΞυϨε͕ط஌ͩͬͨΒ೚ҙͷ
    Ωʔʹ೚ҙͷσʔλΛॻ͖ࠐΜͩΓ
    w ߈ܸ༻ͷσʔλΛૹΓࠐΊ͹"QQαʔόʔ্Ͱ
    ೚ҙίʔυ࣮ߦΛҾ͖ى͜͢͜ͱ͕ग़དྷΔ
    

    View Slide

25. ύεϫʔυೝূʹΑΔରࡦ
    w NFNDBDIFE͸ೝূػߏ͕ແ͍
    w *1ΞυϨε΍ΠϯλϑΣʔε੍ݶͰೝূػߏΛඋ
    ͍͑ͯͳ͍ϛυϧ΢ΣΞ΋ଟ͍
    w ೝূ͔͚͓͚ͯ͹0, ˠ൒෼ਖ਼ղ൒෼ؒҧ͍
    

    View Slide

26. ೝূΛಥഁ͢Δ$43'
    w 3FEJTͩͱύεϫʔυΛ͔͚ΒΕΔ
    w 3FEJTͷύεϫʔυೝূ
    BVUINZTFDSFUQBTTXPSE

    TFULFZWBMVF
    w ͜ΜͳͷΛૹΕ͹ྑ͍͚ͩͳͷͰಥഁՄೳ
    

    View Slide

27. ϛυϧ΢ΣΞͷύεϫʔυ
    w ͔͚͓ͯ͘ʹͨ͜͜͠ͱ͸ͳ͍͕
    w ಺෦ͷωοτϫʔΫߏ੒ͳͲ͕ط஌ʹͳΔέʔε

    ˠιʔείʔυ΍ઃఆ৘ใ΋࿙Ӯ͍ͯ͠Δ͜ͱ΋
    ૝ఆ͢΂͖
    w ྫ͑͹ୀ৬ऀ͕಺෦৘ใΛώϯτʹݱ৬ࣾһΛ
    ᠘ʹ͔͚ͯSFNPUFDPEFFYFDVUJPOՄೳ
    

    View Slide

28. $43'ͰಥഁͰ͖Δೝূ
    w ݁ՌͷಡΈऔΓͷඞཁ͕ͳ͍ೝূํࣜͰ͋Ε͹ɺ
    ύεϫʔυΛૹΓ͚ͭΔ͚ͩͳͷͰಥഁՄೳ
    w νϟϨϯδϨεϙϯεܗࣜͷೝূͰ͋Ε͹ಥഁ
    Ͱ͖ͳ͍
    w $43'Ͱ͸ϦΫΤετͷ݁Ռ͕ಡΊͳ͍ͷͰ
    

    View Slide

29. ϛυϧ΢ΣΞ΁ͷ$43'ରࡦ
    w "$-͋Δ͔Β҆શͱࢥͬͯ·ͤΜ͔ʁ
    w ωοτϫʔΫࣗମΛִ཭͢Δͷ͕ྑ͍
    w ִ཭͢Δ΋ͷ͸ͪΌΜͱִ཭ɺιʔείʔυ΍
    ύεϫʔυ͕ط஌ͳΒ߈ܸͰ͖ΔΑ͏ͳͷ͸

    ʮୀ৬ऀ޲͚όοΫυΞʯ
    

    View Slide

30. ࠓޙͷ܏޲ͱରࡦ
    w ϙʔτ੍ݶʹ͍ͭͯ͸࢓༷͕໌֬Խ͞ΕΔΑ͏
    ʹͳͬͨ
    w IUUQTGFUDITQFDXIBUXHPSHQPSU
    CMPDLJOH
    w ͔͠͠XFMMLOPXOͰͳ͍QPSU͸Ҿ͖ଓ͖

    DSPTTQSPUPDPMBUUBDL͕ՄೳͰ͠ΐ͏
    

    View Slide

31. ࠓޙͷ܏޲ͱରࡦ
    w ಺෦ωοτϫʔΫ޲͚ͷ$43'ରࡦ
    w $034BOE3'$

    IUUQTNJLFXFTUHJUIVCJPDPSTSGD
    w ϒϥ΢βଆͰͷରࡦ΋ೖΔ͔΋
    

    View Slide

32. ྨࣅͷ໰୊
    w $SPTTTJUF TDSJQUJOHSFRVFTUGPSHFSZ
    
    w TJUFˠQSPUPDPMTJUFˠBQQ
    w *1$ͷͨΊͷϩʔΧϧαʔόʔΛ࡞ΔΞϓϦ
    w ΧελϜεΩʔϜ΁ͷϦΫΤετڧ੍
    w ϦΫΤετ͸ҰํతʹૹΕΔ૬ޓʹೝূ͢Δϓ
    ϩτίϧʹͳ͍ͬͯΔ͔֬ೝ͠·͠ΐ͏
    

    View Slide

33. ·ͱΊ
    w $43'ΛͳΊͯ͸͍͚ͳ͍
    w ʮউखʹॻ͖ࠐΈʯग़དྷΔ͚͕ͩͩ

    ॻ͖ࠐΈର৅ʹΑͬͯ͸ग़དྷΔ͜ͱ͕෯޿͍
    w DSPTTQSPUPDPMͳ$43'

    YISTFOE CMPC
    ͰόΠφϦૹΕΔ
    w )5.-Ͱػೳ͕૿͑Δˠ߈ܸํ๏΍ϦεΫ૿Ճ
    

    View Slide

34. ऴΘΓ
    w "OZRVFTUJPOT
    

    View Slide