Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
ブラウザのUIのバグを探す / Secusoba PopUnder
Search
Masato Kinugawa
November 26, 2017
Technology
2
2k
ブラウザのUIのバグを探す / Secusoba PopUnder
第40回セキュそば勉強会(
http://secusoba.info/?%E7%AC%AC40%E5%9B%9E%2811%E6%9C%8825%E6%97%A5%29
) で発表した資料です。
Masato Kinugawa
November 26, 2017
Tweet
Share
More Decks by Masato Kinugawa
See All by Masato Kinugawa
注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3
masatokinugawa
8
3k
バグハンティングのすゝめ / P3NFEST
masatokinugawa
5
1.9k
Pwn2OwnでMicrosoft Teamsをハッキングして2000万円を獲得した方法/ Shibuya.XSS techtalk #12
masatokinugawa
13
18k
How I Hacked Microsoft Teams and got $150,000 in Pwn2Own
masatokinugawa
0
19k
JSでDoSる/ Shibuya.XSS techtalk #11
masatokinugawa
21
6.7k
Electron: Abusing the lack of context isolation - CureCon(en)
masatokinugawa
5
96k
Electron: Context Isolationの欠如を利用した任意コード実行 / Electron: Abusing the lack of context isolation - CureCon(ja)
masatokinugawa
9
24k
バグハンターが見てきたBug Bountyの7年 / LINE Developer Meetup #34 Security Bug Bounty
masatokinugawa
18
12k
5文字で書くJavaScript/ Shibuya.XSS techtalk #10
masatokinugawa
35
20k
Other Decks in Technology
See All in Technology
電子辞書にステータスバーを実装する
puhitaku
0
110
Develop to Survive - YAPC::Hakodate 2024 Keynote
moznion
8
3k
マーケットプレイス版Oracle WebCenter Content For OCI
oracle4engineer
PRO
2
240
怖くないオフライン機能開発 〜基本的な技術で実現する現場向けオフライン機能 / Developing offline functions without fear ~ Offline functions for the field realized with basic technology
kaminashi
1
110
Microsoft 365 でデータセキュリティを強化しよう
sophiakunii
2
280
エムスリー全チーム紹介資料 / Introduction of M3 All Teams
m3_engineering
1
320
Efficient zero-copy networking using io_uring
ennael
PRO
0
400
Unlearn Modularity
lemiorhan
5
160
普通の Web エンジニアのための様相論理入門 #yapcjapan / YAPC Hakodate 2024
ytaka23
6
1.6k
プロダクト開発の貢献をアピールするための目標設計や認知活動 / Goal design and recognition activities to promote product development contributions.
oomatomo
5
920
Oracle GoldenGate 23ai 導入Tips
oracle4engineer
PRO
1
280
Castor - Le Task Runner PHP qui simplifie votre Workflow
lyrixx
1
310
Featured
See All Featured
How to Think Like a Performance Engineer
csswizardry
16
1k
Build The Right Thing And Hit Your Dates
maggiecrowley
32
2.3k
Happy Clients
brianwarren
97
6.7k
What's new in Ruby 2.0
geeforr
341
31k
Debugging Ruby Performance
tmm1
73
12k
Bash Introduction
62gerente
608
210k
Art, The Web, and Tiny UX
lynnandtonic
296
20k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
41
9.2k
Learning to Love Humans: Emotional Interface Design
aarron
272
40k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.2k
From Idea to $5000 a Month in 5 Months
shpigford
381
46k
Done Done
chrislema
181
16k
Transcript
None
None
None
• • •
•
• •
None
• • newWin = window.open('//example.com/','w','a'); newWin.blur();//新しいウインドウのフォーカスを離す window.focus();//親にフォーカスを移す
• •
• https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
None
None
None
None
None
confirm(1);
prompt(1);
print();
//Basic認証
//外部アプリを開くプロトコルへナビゲーション location = "mms:";
onbeforeunload=function(e){return 1;} //どこかへ移動しようとするとダイアログ出現
new PresentationRequest("").start();
new PaymentRequest([{ supportedMethods: ['basic-card'] }], { total: { label: 1,
amount: { currency: 'USD', value: 0 } } }).show();
navigator.usb.requestDevice({filters:[]});
<form> <input type="email" value="a"> <button id="button"> </form> <script> button.click(); </script>
• • • • • •
<script> function popUnder() { new PresentationRequest("").start(); window.open("https://example.com/", "_blank","a"); setTimeout(function(){ location.reload();//リロードでダイアログを消す
},1000); } </script> <button onclick="popUnder()">Create PopUnder</button>
None
• • • • • • •
• • • • •
• •
• • •
None