徳丸最終回

Transcript

1. ϑΝΠϧμ΢ϯϩʔυʹΑΔXSS ಙؙձ
2. AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ
3. ֓ཁ μ΢ϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μ΢ϯϩʔυ
4. ֓ཁ ը૾σʔλʹ࢓ࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾͸ɺpng΍jpgͱͯ͠ೝࣝ͢Δ͸͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ৚݅ʹΑͬͯ͸HTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δ΋ͷ͕ը૾σʔλʹHTML΍JavaScriptΛ࢓ࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏
5. ֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத਎͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μ΢ϯϩʔυΛ૝ఆͨ͠ϑΝΠϧʹ͸ɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ
6. ߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Β͸ରࡦ͞Ε͍ͯΔ͕IE7Ҏલ͸ରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8͸ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ͸࣮ߦ͞Ε ͯ͠·͏
7. ߈ܸख๏ͱӨڹ PDFμ΢ϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹ͸PATHINFOͱݺ͹ΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.html͸ଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ౉͞ΕΔ
8. ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨ΋ͷ͔νΣοΫ͢Δ ▸ ը૾ͷ৔߹͸ϚδοΫόΠτ΋֬ೝ͢Δ ▸ ϚδοΫόΠτͱ͸ɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ
9. ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ஋ 1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
10. ରࡦ ϑΝΠϧμ΢ϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ৔߹͸ϚδοΫόΠτ΋֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ
11. ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑ͸Content-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑ͸ͳ͘ͳΔ
12. ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μ΢ϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μ΢ϯϩʔυͰ͖͑͢͞Ε͹ྑ͍৔߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸ ͜ͷ৔߹͸Content-Type΋ʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্΋ʮμ΢ϯϩʔυ͢΂͖ϑΝΠϧʯ ʹͳΔ
13. ·ͱΊ ໰୊ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ
14. Ҏ্