Upgrade to Pro — share decks privately, control downloads, hide ads and more …

徳丸最終回

mcz9mm
August 30, 2017
56

 徳丸最終回

mcz9mm

August 30, 2017
Tweet

Transcript

  1. ϑΝΠϧμ΢ϯϩʔυʹΑΔXSS ಙؙձ

  2. AJENDA ▸ ֓ཁ ▸ ख๏ͱӨڹ ▸ ݪҼ ▸ ରࡦ

  3. ֓ཁ μ΢ϯϩʔυʹΑΔJSͷ࣮ߦ Ξοϓϩʔυ ը૾ μ΢ϯϩʔυ

  4. ֓ཁ ը૾σʔλʹ࢓ࠐΉ ▸ ΞοϓϩʔυΛ͢Δࡍͷը૾͸ɺpng΍jpgͱͯ͠ೝࣝ͢Δ͸͕ͣͩɺը૾σʔλͷ தʹHTMLλάؚ͕·Ε͍ͯΔͱ৚݅ʹΑͬͯ͸HTMLϑΝΠϧͱͯ͠ೝࣝ͞Εͯ͠· ͏ ▸ ͜ͷ੬ऑੑΛར༻ͯ͠ɺѱҙͷ͋Δ΋ͷ͕ը૾σʔλʹHTML΍JavaScriptΛ࢓ࠐΜ ͰΞοϓϩʔυͯ͠߈ܸΛߦ͏

  5. ֓ཁ ରࡦ ▸ ϑΝΠϧͷContent-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ֦ுࢠͱը૾ͷத਎͕ରԠ͍ͯ͠Δ͜ͱΛ֬ೝ ▸ μ΢ϯϩʔυΛ૝ఆͨ͠ϑΝΠϧʹ͸ɺϨεϙϯεϔομͱ ͯ͠ʮContent-Disposition:attachmentʯΛࢦఆ͢Δ

  6. ߈ܸख๏ͱӨڹ ը૾ϑΝΠϧʹΑΔXSS ▸ IE8͔Β͸ରࡦ͞Ε͍ͯΔ͕IE7Ҏલ͸ରࡦ͕ඞཁ Hoge.png <script>alert(‘XSS’);</script> ▸ IE8͸ςΩετͱͯ͠දࣔ͞Ε͍ͯΔ͕IE7ҎલͰ͸࣮ߦ͞Ε ͯ͠·͏

  7. ߈ܸख๏ͱӨڹ PDFμ΢ϯϩʔυը໘ʹΑΔXSS http://hoge.jp/fuga/nuge.php?file=614614891.pdf ▸ PDFʹ͸PATHINFOͱݺ͹ΕΔݟ্͔͚ϑΝΠϧ໊ͷΑ͏ͳ ܗͰURLʹύϥϝʔλΛຒΊࠐΉ͜ͱ͕Ͱ͖Δ http://hoge.jp/fuga/nuge.php/a.html?file=614614891.pdf ▸ a.html͸ଘࡏ͠ͳ͍ϑΝΠϧͳͷͰύϥϝʔλͱͯ͠εΫϦ ϓϓτʹ౉͞ΕΔ

  8. ରࡦ ϑΝΠϧΞοϓϩʔυ࣌ͷରࡦ ▸ ֦ுࢠ͕ڐՄ͞Εͨ΋ͷ͔νΣοΫ͢Δ ▸ ը૾ͷ৔߹͸ϚδοΫόΠτ΋֬ೝ͢Δ ▸ ϚδοΫόΠτͱ͸ɺϑΝΠϧࣝผͷͨΊʹϑΝΠϧͷઌ಄ ʹஔ͔Εͨݻఆͷจࣈྻͷ͜ͱ

  9. ରࡦ ϚδοΫόΠτͷ֬ೝ array getimagesize(string $filename [, array &$imageinfo]) ▸ ฦΓ஋

    1. 1: IMAGETYPE_GIF 2. 2: IMAGETYPE_JPEG 3. 3: IMAGETYPE_PNG
  10. ରࡦ ϑΝΠϧμ΢ϯϩʔυ࣌ͷରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ ը૾ͷ৔߹͸ϚδοΫόΠτ΋֬ೝ͢Δ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ

  11. ରࡦ ▸ Content-TypeΛਖ਼͘͠ઃఆ͢Δ ▸ XSSͷ੬ऑੑ͸Content-Typeͷؒҧ͍͕ݪҼ ▸ PDFܗࣜͷContent-TypeΛ[application/pdf]ͱઃఆ͢Δ͚ͩ Ͱ੬ऑੑ͸ͳ͘ͳΔ

  12. ରࡦ ▸ ඞཁʹԠͯ͡Content-DispositionϔομΛઃఆ͢Δ ▸ μ΢ϯϩʔυͨ͠ϑΝΠϧΛΞϓϦέʔγϣϯͰར༻ͤͣɺ μ΢ϯϩʔυͰ͖͑͢͞Ε͹ྑ͍৔߹ɺʮContent- Disposition: attachmentʯͱ͍͏ϨεϙϯεϔομΛࢦఆ͢ Δ ▸

    ͜ͷ৔߹͸Content-Type΋ʮapplication/octet-streamʯʹ ͢ΔͱϑΝΠϧϔομ্΋ʮμ΢ϯϩʔυ͢΂͖ϑΝΠϧʯ ʹͳΔ
  13. ·ͱΊ ໰୊ͷجຊ ▸ Content-Typeͱ֦ுࢠΛਖ਼͘͠ઃఆ͢Δ͜ͱ

  14. Ҏ্