Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
徳丸最終回
Search
mcz9mm
August 30, 2017
0
72
徳丸最終回
mcz9mm
August 30, 2017
Tweet
Share
More Decks by mcz9mm
See All by mcz9mm
SwiftUI-List-Pagination
mcz9mm
2
2.1k
ARKit2.0でAppleが伝えたいアプリ体験を考える
mcz9mm
2
1k
ゆるく学ぶARKit
mcz9mm
3
1.4k
What’s TCP/UDP?
mcz9mm
0
98
NATサーバーの必要性
mcz9mm
0
84
What’s New in ARKit2.0
mcz9mm
0
78
徳丸本 ログインフォーム
mcz9mm
0
97
arkit+animoji
mcz9mm
0
63
徳丸本8
mcz9mm
0
110
Featured
See All Featured
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
27
1.9k
Statistics for Hackers
jakevdp
796
220k
Building Flexible Design Systems
yeseniaperezcruz
327
38k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
25
1.8k
KATA
mclloyd
29
13k
The World Runs on Bad Software
bkeepers
PRO
65
11k
Agile that works and the tools we love
rasmusluckow
327
21k
Typedesign – Prime Four
hannesfritz
39
2.4k
The Art of Programming - Codeland 2020
erikaheidi
51
13k
Scaling GitHub
holman
458
140k
What’s in a name? Adding method to the madness
productmarketing
PRO
22
3.1k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
92
16k
Transcript
ϑΝΠϧμϯϩʔυʹΑΔXSS ಙؙձ
AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
֓ཁ μϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μϯϩʔυ
֓ཁ ը૾σʔλʹࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾ɺpngjpgͱͯ͠ೝࣝ͢Δ͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ݅ʹΑͬͯHTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δͷ͕ը૾σʔλʹHTMLJavaScriptΛࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μϯϩʔυΛఆͨ͠ϑΝΠϧʹɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Βରࡦ͞Ε͍ͯΔ͕IE7Ҏલରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ࣮ߦ͞Ε ͯ͠·͏
߈ܸख๏ͱӨڹ PDFμϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹPATHINFOͱݺΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.htmlଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ͞ΕΔ
ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨͷ͔νΣοΫ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ϚδοΫόΠτͱɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ
1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
ରࡦ ϑΝΠϧμϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ߹ϚδοΫόΠτ֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑContent-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑͳ͘ͳΔ
ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μϯϩʔυͰ͖͑͢͞Εྑ͍߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸
͜ͷ߹Content-Typeʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্ʮμϯϩʔυ͖͢ϑΝΠϧʯ ʹͳΔ
·ͱΊ ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
Ҏ্