ブラウザのUIのバグを探す / Secusoba PopUnder

第40回セキュそば勉強会(http://secusoba.info/?%E7%AC%AC40%E5%9B%9E%2811%E6%9C%8825%E6%97%A5%29) で発表した資料です。

Transcript

1. View Slide

2. View Slide

3. View Slide

4. •
   •
   •
   

   View Slide

5. •
   

   View Slide

6. •
   •
   

   View Slide

7. View Slide

8. •
   •
   newWin = window.open('//example.com/','w','a');
   newWin.blur();//新しいウインドウのフォーカスを離す
   window.focus();//親にフォーカスを移す
   

   View Slide

9. •
   •
   

   View Slide

10. •
    https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
    

    View Slide

11. View Slide

12. View Slide

13. View Slide

14. View Slide

15. View Slide

16. confirm(1);
    

    View Slide

17. prompt(1);
    

    View Slide

18. print();
    

    View Slide

19. //Basic認証
    

    View Slide

20. //外部アプリを開くプロトコルへナビゲーション
    location = "mms:";
    

    View Slide

21. onbeforeunload=function(e){return 1;}
    //どこかへ移動しようとするとダイアログ出現
    

    View Slide

22. new PresentationRequest("").start();
    

    View Slide

23. new PaymentRequest([{
    supportedMethods: ['basic-card']
    }], {
    total: {
    label: 1,
    amount: {
    currency: 'USD',
    value: 0
    }
    }
    }).show();
    

    View Slide

24. navigator.usb.requestDevice({filters:[]});
    

    View Slide

25. 
    
    
    
    <br/>button.click();<br/>
    

    View Slide

26. •
    •
    •
    •
    •
    •
    

    View Slide

27. <br/>function popUnder() {<br/>new PresentationRequest("").start();<br/>window.open("https://example.com/", "_blank","a");<br/>setTimeout(function(){<br/>location.reload();//リロードでダイアログを消す<br/>},1000);<br/>}<br/>
    Create PopUnder
    

    View Slide

28. View Slide

29. •
    •
    •
    •
    •
    •
    •
    

    View Slide

30. •
    •
    •
    •
    •
    

    View Slide

31. •
    •
    

    View Slide

32. •
    •
    •
    

    View Slide

33. View Slide