Slide 1
Slide 1 text
4&$$0/#FHJOOFST
5TVCBTB !4[SOZ
#FHJOOFST$5'ͰֶͿ
8FCηΩϡϦςΟ ೖฤ
4&$$0/#FHJOOFST-JWF
Slide 2
Slide 2 text
#ctf4b
കཌྷ 6NFVDIJ5TVCBTB
!4[SOZ
ॴଐ
4&$$0/#FHJOOFSTӡӦνʔϜ
ઌՊֶٕज़େֶӃେֶઌՊֶٕज़ݚڀՊ
'MBUU4FDVSJUZ*OD
ڵຯྖҬ
ΫϥΠΞϯταΠυͷ8FCηΩϡϦςΟ
N#BB4
ԾԽɾίϯςφٕज़
$MPVE/BUJWF
͡Ίʹ
ࣗݾհ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
2
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 3
Slide 3 text
#ctf4b
͡Ίʹ
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
3
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 4
Slide 4 text
#ctf4b
Ұൠʹެ։͞Ε͍ͯΔ8FCΞϓϦέʔγϣϯʹରͯ͠
ຊൃදͰઆ໌͢Δ߈ܸख๏Λ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞
ରͱͳΔαʔό8FCΞϓϦέʔγϣϯʹର͢Δ߈ܸ͕ڐՄ͞Ε͍ͯΔ͔Λ
֬ೝ্ͨ͠Ͱࢼ͢Α͏ʹ͍ͯͩ͘͠͞
ిࢠܭࢉػଛյۀࡑ
ۀʹ༻͢Δిࢠܭࢉػʹڏِͷใए͘͠ෆਖ਼ͳࢦྩΛ༩͑
ਓͷۀΛͨ͠ऀ
ِܭۀࡑ
ِܭΛ༻͍ͯͦͷۀΛͨ͠ऀ
ి࣓తهෆਖ਼࡞ग़ٴͼڙ༻ͷࡑ
ࣄ࣮ূ໌ʹؔ͢Δి࣓తهΛෆਖ਼ʹ࡞ͬͨऀ
͡Ίʹ
๏తɾྙཧతͳҙࣄ߲
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
4
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 5
Slide 5 text
#ctf4b
࣭ɾײDUGCʂ
͡Ίʹ
࣭ɾײ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
5
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 6
Slide 6 text
#ctf4b
"HFOEB
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
6
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 7
Slide 7 text
#ctf4b
8FC 8PSME8JEF8FC
Πϯλʔωοτ্ʹల։͞ΕͨϋΠύʔςΩετࢀরγεςϜ
༷ʑͳϦιʔε͕)551 4
Λ௨ͯ͠ΓऔΓ͞ΕΔ
w )5.-ɺ$44ɺ+BWB4DSJQUɺϚϧνϝσΟΞϑΝΠϧɺ
8FCηΩϡϦςΟ
8FCΞϓϦέʔγϣϯ8FCΫϥΠΞϯτʹର͢Δ߈ܸ͔ΒରΛอޢ͢Δ͜ͱ
8FCΛߏ͢ΔΤίγεςϜʹର͢Δ߈ܸख๏ଟذʹΔ
w ΞϓϦέʔγϣϯ্Ͱൃੜ͢Δ߈ܸ42-J
04$J
%JS5SBW
443'
FUD
w ΫϥΠΞϯτ্Ͱൃੜ͢Δ߈ܸ944
$43'
944FBSDI
94-FBLT
FUD
*OUSPEVDUJPO
8FCͱ8FCηΩϡϦςΟ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
7
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 8
Slide 8 text
#ctf4b
$5'ʹ͓͚Δ8FC
ఏࣔ͞ΕΔ8FCΞϓϦέʔγϣϯʹଘࡏ͢Δ੬ऑੑʹରͯ͠߈ܸΛߦ͍ɺ'MBHΛऔಘ͢Δ
'MBH͕ஔ͞Ε͍ͯΔॴ
8FCαʔό্ʹଘࡏ͢ΔຊདྷΞΫηεͰ͖ͳ͍ͣͷϑΝΠϧ
ཧऀݖݶΛ࣋ͭΑ͏ͳϢʔβ͔͠ΞΫηεͰ͖ͳ͍ͣͷϖʔδ
σʔλϕʔεͷϨίʔυ
αΠτཧऀͷΫϥΠΞϯτΛͨ͠Ϋϩʔϥͷ$PPLJF
*OUSPEVDUJPO
$5'ʹ͓͚Δ8FC
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
8
߈ܸ ᠘ϖʔδʹ༠ಋ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 9
Slide 9 text
#ctf4b
8FCʹର͢ΔΞϓϩʔν
ιʔείʔυ͕͞Ε͍ͯΔ͔൱͔ʹΑͬͯେ͖͘ҟͳΔ
ιʔείʔυ͕͞Ε͍ͯΔ߹
ιʔείʔυΛಡΜͰ੬ऑͳ࣮͕ߦΘΕ͍ͯΔՕॴΛ୳͢
ൃݟͨ͠੬ऑੑΛΤΫεϓϩΠτͰ͖ΔΑ͏ͳ߈ܸख๏Λߟ͑ͯ ௐͯ
࣮ߦ͢Δ
ιʔείʔυ͕͞Ε͍ͯͳ͍߹
༷ʑͳϦΫΤετΛૹ৴͢Δ͜ͱͰใऩूΛߦ͏
w ͲͷΑ͏ͳαʔόͰΞϓϦέʔγϣϯ͕ಈ࡞͍ͯ͠Δͷ͔
w ϑΥʔϜͷσʔλͲ͜ʹૹ৴͞ΕɺͲͷΑ͏ʹॲཧ͞ΕΔͷ͔
w ߈ܸ༻ͷσʔλ͕ૹ৴Ͱ͖ͦ͏ͳॴͲ͔͜
੬ऑͳ࣮͕ߦΘΕ͍ͯΔ ͱߟ͑ΒΕΔ
ػೳΛΤΫεϓϩΠτͰ͖ΔΑ͏ͳ
߈ܸख๏Λߟ͑ͯ ௐͯʣ࣮ߦ͢Δ
*OUSPEVDUJPO
8FCʹର͢ΔΞϓϩʔν
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
9
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 10
Slide 10 text
#ctf4b
)551 4
)ZQFS5FYU5SBOTGFS1SPUPDPM
w ओʹόʔδϣϯ )551
w DG3'$3'$
8FCʹ͓͚ΔίϯςϯπͷΓऔΓ ΄ͱΜͲ
)551্ͰߦΘΕΔ
ϦΫΤετϨεϙϯεͷߏɺϔομʔͷछྨͱҙຯʹ͍ͭͯͷ͕ࣝॏཁ
ίϯςϯπ
)5.-
$44
+BWB4DSJQU
FUD
ఏڙ͞ΕΔίϯςϯπ͕ಡղͰ͖Ε0,
w ಛʹ+BWB4DSJQUʹؔͯ͠ɺ࣮·ͰͰ͖Δͱͳ͓ྑ͍Ͱ͢
αʔόɾΞϓϦέʔγϣϯɾΠϯϑϥ
༷ʑͳݴޠ FH1ZUIPO
1)1
(P
/PEFKT
Ͱ࣮͞ΕͨΞϓϦέʔγϣϯίʔυͷಡղ ո͍࣮͠ʹؾͮ͘ᄿ֮
42-ʹΑΔΫΤϦͷߏங
8FCαʔό FHOHJOY
Πϯϑϥ FH%PDLFS
ͷίϯϑΟάϨʔγϣϯͷಡղ
πʔϧ
ϩʔΧϧϓϩΩγ FH#VSQ4VJUF
3&45ΫϥΠΞϯτɺ%FW5PPMTΛ͍͜ͳͤΔͱศརͰ͢
*OUSPEVDUJPO
8FCΛղͨ͘Ίʹඞཁͳࣝɾٕज़
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
10
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 11
Slide 11 text
#ctf4b
*OUSPEVDUJPO
#FHJOOFST$5'ͷ݁Ռ 8FC
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
11
໊ ఆқ ಘ ղ ςʔϚ
Spy Beginner 55pts 441solves
ೝূ
λΠϛϯά߈ܸ
Tweetstore Easy 150pts 150solves SQL Injeciton
unzip Easy 188pts 118solves
Zip Slip
DirTrav
profiler Medium 301pts 59solves GraphQL
Somen Hard 421pts 20solves CSP Bypassing
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 12
Slide 12 text
#ctf4b
*OUSPEVDUJPO
#FHJOOFST$5'ͷ݁Ռ 8FC
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
12
໊ ఆқ ಘ
ղ
શνʔϜ
ςʔϚ
Spy Beginner 55pts 441solves
ೝূ
λΠϛϯά߈ܸ
Tweetstore Easy 150pts 150solves SQL Injeciton
unzip Easy 188pts 118solves
Zip Slip
DirTrav
profiler Medium 301pts 59solves GraphQL
Somen Hard 421pts 20solves CSP Bypassing
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 13
Slide 13 text
#ctf4b
͡Ίʹ
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
13
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 14
Slide 14 text
#ctf4b
4QZ
қ#FHJOOFS
QUTTPMWFT
w 8FMDPNF
FNPFNPFODPEFͷ࣍ʹਖ਼ͷଟ͔ͬͨͰͨ͠
ͷ֓ཁ
ΞϓϦέʔγϣϯͷιʔείʔυͱैۀһͷ໊લ͕ॻ͔ΕͨςΩετϑΝΠϧ͕͞ΕΔ
ΞϓϦέʔγϣϯϩάΠϯϖʔδͱճϖʔδ͔Βߏ͞ΕΔ
ճϖʔδ͔ΒΞϓϦέʔγϣϯʹొ͞Ε͍ͯΔैۀһΛྻڍͰ͖ΕΫϦΞ
࡞ͷഎܠ
8FCΞϓϦέʔγϣϯʹ͓͚Δ҆શͳೝূใͷอͷͨΊͷख๏Λཧղ͍ͯ͠Δ͔
ॲཧͷ࣌ؒࠩʹىҼ͢Δ੬ऑੑΛൃݟ͢Δ͜ͱ͕Ͱ͖Δ͔
ϩάΠϯܥͷͨ͘͞Μ͋ΔͷͰɺ͋͑ͯϩάΠϯͰ͖ͳͯ͘ղ͚ΔΛ
4QZ
ͷ֓ཁ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
14
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 15
Slide 15 text
#ctf4b
4QZ
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
15
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 16
Slide 16 text
#ctf4b
4QZ
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
16
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 17
Slide 17 text
#ctf4b
4QZ
ͷιʔείʔυ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
17
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 18
Slide 18 text
#ctf4b
ೝূใ
8FCΞϓϦέʔγϣϯԟʑʹͯ͠ೝূ ͢ͳΘͪϩάΠϯ
Λඞཁͱ͢Δ
*%ٴͼύεϫʔυʹΑΔೝূ͕ओྲྀ
͠ύεϫʔυΛฏจͰσʔλϕʔεʹอଘ͍ͯ͠Δͱ
ύεϫʔυ࿙Ӯͷࡍʹෆਖ਼ͳϩάΠϯ͕ߦΘΕΔةݥੑ
ଞαʔϏεʹύεϫʔυΛ͍·Θ͍ͯ͠Δ߹ɺ
ύεϫʔυϦετ߈ܸ͕ޭͯ͠͠·͏
ରࡦ
ύεϫʔυอଘ࣌ʹϋογϡؔʹΑΔϋογϡԽΛߦ͏
ϋογϡԽͷࡍʹɺύεϫʔυʹϥϯμϜͳ 4BMU
ΛՃ͑Δ
w ಉ͡ύεϫʔυͰϋογϡ͕ҟͳΔΑ͏ʹ͢ΔͨΊ
ϋογϡԽΛෳճߦ͏ 4USFUDIJOH
w ϒϧʔτϑΥʔε߈ܸͷੑΛ࣋ͨͤΔͨΊ
4QZ
8FCΞϓϦέʔγϣϯʹ͓͚Δೝূใͷཧ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
18
ID Password
Alice p455w0rd
Bob qwerty
...
QXSE :JS)%
ύεϫʔυ 4BMU
ϋογϡؔ FH4)"
CFGDCGCDC
࣮ࡍʹ֨ೲ͢Δ
˞ෳճ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 19
Slide 19 text
#ctf4b
4QZ
4USFUDIJOHͱλΠϛϯά߈ܸ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
19
4USFUDIJOHͱॲཧ࣌ؒ
ϋογϡؔΛෳճ࣮ߦ͢ΔͷͰ͋Δఔ͕͔͔࣌ؒΔ
FH4)"ͷ߹
w ճTFD
w ճTFD
w ճTFD
w ճTFD
λΠϛϯά߈ܸ
αΠυνϟωϧ߈ܸͷҰछ
͋Δॲཧͷಈ࡞͔࣌ؒΒຊདྷղੳͰ͖ͳ͍ͣͷใΛղੳ͢Δ
w ༨ஊ944FBSDI94-FBLT͜ΕͷҰछ DGIUUQTHJUIVCDPNYTMFBLTYTMFBLT
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 20
Slide 20 text
#ctf4b
4QZ
ͷιʔείʔυ ࠶ܝ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
20
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 21
Slide 21 text
#ctf4b
4QZ
ͷιʔείʔυͱ͖͢ϙΠϯτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
21
ΞΧϯτ͕
ଘࡏ͢Δʁ
4BMU
4USFUIJOH
݁Ռ͕Ұக
͍ͯ͠Ε
ϩάΠϯޭ
ଘࡏ͠ͳ͚Ε
ऴྃ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 22
Slide 22 text
#ctf4b
4QZ
ͷιʔείʔυ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
22
auth.calc_password_hash ͕ؔॏΊͷॲཧΛߦ͍ͬͯΔ
ͨͩ͠ɺ͜ͷ͕࣮ؔߦ͞ΕΔͷif exists ͷ࣌ͷΈ
w ͢ͳΘͪɺ8FCΞϓϦέʔγϣϯʹΞΧϯτ͕ଘࡏ͢Δ࣌ͷΈ
͜ͷ࣌ͷॲཧͷ࣌ؒࠩΛར༻ͯ͠ଘࡏ͢ΔΞΧϯτΛྻڍՄೳ
w શһͷ໊લͱదͳύεϫʔυͰϩάΠϯΛࢼߦͯ͠ɺ૬ରతʹ͕͔͔࣌ؒΔ͔Ͳ͏͔ΛௐΕྑ͍
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 23
Slide 23 text
#ctf4b
4QZ
͓ΘΓʹ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
23
ͷ·ͱΊ
ΞϓϦέʔγϣϯϩάΠϯ࣌ʹ4BMU4USFUDIJOHΛߦ͍ͬͯͨ
ΞΧϯτ͕ଘࡏ͢Δͱ͖ʹͷΈ֘ॲཧΛ࣮ߦ͍ͯͨͨ͠Ί
ΞΧϯτ͕ଘࡏ͢Δ͔൱͔Ͱॲཧ࣌ؒʹࠩҟ͕ൃੜ͍ͯͨ͠
ॲཧ࣌ؒͷࠩҟΛ؍ଌ͢Δ͜ͱͰɺଘࡏ͢ΔΞΧϯτΛྻڍͰ͖ͨ
ڭ܇
ηΩϡΞʹ͢ΔͭΓͰߦ͍࣮͕ͬͯͨͱ͖ʹ੬ऑੑΛੜΉ͜ͱ͕͋Δ
߈ܸऀʹରͯ͠ɺؒతʹώϯτΛ༩͑ΔΑ͏ͳ࣮ΛߦΘͳ͍
ࢀߟࢿྉ
0ODFVQPOBUJNFBOBDDPVOUFOVNFSBUJPO
w IUUQTTJEFDIBOOFMUFNQFTUTJDPNPODFVQPOBUJNFUIFSFXBTBOBDDPVOUFOVNFSBUJPODGDBDED
94-FBLT
w IUUQTHJUIVCDPNYTMFBLTYTMFBLT
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 24
Slide 24 text
#ctf4b
"HFOEB
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
24
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 25
Slide 25 text
#ctf4b
QSPpMFS
қNFEJVN
QUTTPMWFT
ͷ֓ཁ
ΞϓϦέʔγϣϯͷ63-͕ఏࣔ͞ΕΔ ιʔείʔυͳ͠
ΞϓϦέʔγϣϯҎԼͷϖʔδ͔Βߏ͞ΕΔ
w ΞΧϯτొɾϩάΠϯϖʔδ
w ϓϩϑΝΠϧߋ৽ϖʔδ
ϢʔβΞΧϯτొ࣌ʹ͞ΕΔϢʔβݻ༗ͷτʔΫϯΛ༻͍ͯϓϩϑΝΠϧΛߋ৽Ͱ͖Δ
࡞ͷഎܠ
(SBQI2-"1*ʹର͢Δ߈ܸख๏Λ͍ͬͯΔ͔ɺ·ͨɺΫΤϦΛ͍͜ͳͤΔ͔
͋·Γ(SBQI2-ͷΛݟ͔͚ͨ͜ͱ͕ͳ͍ͷͰ
QSPpMFS
ͷ֓ཁ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
25
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 26
Slide 26 text
#ctf4b
QSPpMFS
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
26
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 27
Slide 27 text
#ctf4b
QSPpMFS
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
27
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 28
Slide 28 text
#ctf4b
QSPpMFS
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
28
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 29
Slide 29 text
#ctf4b
QSPpMFS
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
29
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 30
Slide 30 text
#ctf4b
QSPpMFS
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
30
ͷղ๏
'MBHΛऔಘ͢ΔͨΊʹBENJOͷUPLFO͕ࣗΞΧϯτʹઃఆ͞Ε͍ͯΔඞཁ͕͋Δ
ͦͷͨΊʹ
w BENJOͷUPLFOΛΔඞཁ͕͋Δ
w औಘͨ͠BENJOͷUPLFOΛࣗΞΧϯτͷUPLFOʹઃఆ͢Δඞཁ͕͋Δ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 31
Slide 31 text
#ctf4b
%FW5PPMTͰΞϓϦέʔγϣϯͷ௨৴Λ؍ଌͯ͠ΈΔͱ
"1*ʹ+40/ܗࣜͷϦΫΤετΛසൟʹૹ৴͍ͯ͠Δ
ಛతͳΩʔϫʔυ͕ϦΫΤετͷϖΠϩʔυʹ༻͍ΒΕ͍ͯΔ
w RVFSZ
NVUBUJPO
ʮRVFSZNVUBUJPOBQJʯͰݕࡧͯ͠ΈΔͱ
(SBQI2-
QSPpMFS
ͷ͖͔͚ͬͷݟ͚ͭํ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
31
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 32
Slide 32 text
#ctf4b
(SBQI2-
'BDFCPPL͕։ൃͨ͠"1*ͷن֨ͷҰछ
ैདྷͷ8FC"1* ͢ͳΘͪ3&45"1*
ͱҟͳΓɺ
୯ҰͷΤϯυϙΠϯτʹରͯ͠ΫΤϦΛૹ৴͢Δ͜ͱͰσʔλΛૢ࡞͢Δ
QSPpMFS
(SBQI2-ͷ֓ཁ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
32
VTFST
OPUFT
(&5
1045
3&45
ૢ࡞ରͷϦιʔε63-Ͱࣝผ͢Δ
ૢ࡞ͷํ๏)551ϝιουͰࣔ͢
(SBQI2-
ΤϯυϙΠϯτҰ͚ͭͩ
ૢ࡞ରͦͷํ๏ΫΤϦͰදݱ͢Δ
query { user { ... } }
mutation { note { ... } }
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 33
Slide 33 text
#ctf4b
(SBQI2-
'BDFCPPL͕։ൃͨ͠"1*ͷاըͷҰछ
ैདྷͷ8FC"1* ͢ͳΘͪ3&45"1*
ͱҟͳΓɺ
୯ҰͷΤϯυϙΠϯτʹରͯ͠ΫΤϦΛૹ৴͢Δ͜ͱͰσʔλΛૢ࡞͢Δ
"1*ͷ࣮
"1*͕ѻ͏σʔλͷܕΫΤϦͷεΩʔϚΛࣄલʹఆ͓ٛͯ͘͠
֤ΫΤϦ͝ͱʹ࣮ࡍͷॲཧΛߦ͏3FTPMWFSΛ࣮͢Δ
(SBQI2-ͷΫΤϦ
RVFSZσʔλΛऔಘ͢ΔͨΊͷΦϖϨʔγϣϯ
w JOUSPTQFDUJPO"1*ͷεΩʔϚใΛऔಘ͢ΔRVFSZ
NVUBUJPOσʔλΛॻ͖ࠐΉࡍʹ༻͍ΒΕΔΦϖϨʔγϣϯ
TVCTDSJQUJPOσʔλΛϦΞϧλΠϜʹ؍ଌ͢ΔͨΊʹ༻͍ΒΕΔΦϖϨʔγϣϯ
w ෦తʹ8FC4PDLFUʹΑΔ௨৴͕༻͍ΒΕΔ
QSPpMFS
(SBQI2-ͷ֓ཁ ߋʹৄ͘͠
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
33
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 34
Slide 34 text
#ctf4b
QSPpMFS
εΩʔϚఆٛͷྫ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
34
εΩʔϚఆٛ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 35
Slide 35 text
#ctf4b
QSPpMFS
3FTPMWFS࣮ͷྫ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
35
RVFSZͷ࣮ NVUBUJPOͷ࣮
DG"SJBEOFu1ZUIPO(SBQI2-4DIFNBpSTU
IUUQTBSJBEOFHSBQIRMPSH
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 36
Slide 36 text
#ctf4b
*OUSPTQFDUJPO2VFSZʹΑΔεΩʔϚใͷऔಘ
ຊདྷศརͳ༷
w ΫϥΠΞϯταΠυ͔Βݺͼग़ͤΔΫΤϦऔಘՄೳͳσʔλͷܕΛϦΞϧλΠϜʹ֬ೝͰ͖Δ
ҎԼͷΑ͏ͳ߹ʹɺεΩʔϚใΛऔಘ͞ΕΔͱ߈ܸʹ׆༻͞ΕΔڪΕ͕͋Δ
w σʔλܕͷఆٛʹෆཁͳϑΟʔϧυؚ͕·Ε͍ͯΔ FHϢʔβͷύεϫʔυ
w ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦ͕ެ։͞Ε͍ͯΔ
*%03
*OTFDVSF%JSFDU0CKFDU3FGFSFODF
FHΫΤϦͷҾʹෆਖ਼ͳΛࢦఆ͢Δ͜ͱͰɺຊདྷऔಘͰ͖ͳ͍ͣͷσʔλ͕औಘͰ͖Δ
%P4
ॲཧྔ͕ലେʹͳΔΑ͏ͳΫΤϦΛૹ৴͠ɺ"1*ଆͷϦιʔεΛރׇͤ͞Δ
/P
42-*OKFDUJPO
എޙʹσʔλϕʔε͕ଘࡏ͍ͯ͠Δ߹ɺೖྗ͕దʹॲཧ͞Ε͍ͯͳ͍ͱ
ΫΤϦʹಛघจࣈΛૠೖ͢Δ͜ͱͰ /P
42-*OKFDUJPO͕Մೳͳ߹͕͋Δ
QSPpMFS
(SBQI2-ʹର͢Δ߈ܸख๏
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
36
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 37
Slide 37 text
#ctf4b
*OUSPTQFDUJPO2VFSZͷྫ
DG(SBQI2-$PNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFN
w IUUQTNFEJVNDPN!UIFCJMBMSJ[XBOHSBQIRMDPNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJU
UIFNGGEDF
"1*ʹ͓͍ͯ*OUSPTQFDUJPO2VFSZͷ࣮ߦ͕ڋ൱͞Ε͍ͯͳ͍߹ɺ
εΩʔϚใ͕֨ೲ͞Εͨ+40/͕Ϩεϙϯε͞ΕΔ
͜ͷ+40/ɺHSBQIRMWPZBHFSͰՄࢹԽ͢Δ͜ͱ͕Ͱ͖Δ
w DGIUUQTHJUIVCDPN"1*THVSVHSBQIRMWPZBHFS
QSPpMFS
*OUSPTQFDUJPO2VFSZ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
37
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 38
Slide 38 text
#ctf4b
εΩʔϚใͷՄࢹԽ
HSBQIRMWPZBHFSͷ݁Ռ 2VFSZ
εΩʔϚใͷղੳ
ҎԼͷΑ͏ͳRVFSZͱNVUBUJPO͕ఆٛ͞Ε͍ͯΔ͜ͱ͕͔Δ
QSPpMFS
εΩʔϚใͷՄࢹԽͱղੳ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
38
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 39
Slide 39 text
#ctf4b
ͷղ๏ ࠶ܝ
'MBHΛऔಘ͢ΔͨΊʹBENJOͷUPLFO͕ࣗΞΧϯτʹઃఆ͞Ε͍ͯΔඞཁ͕͋Δ
ͦͷͨΊʹ
w BENJOͷUPLFOΛΔඞཁ͕͋Δ
w औಘͨ͠BENJOͷUPLFOΛࣗΞΧϯτͷUPLFOʹઃఆ͢Δඞཁ͕͋Δ
ΞϓϦέʔγϣϯ্͔ΒͦͷΑ͏ͳػೳ؍ଌͰ͖ͳ͍
TPNFPOF VJE*%
6TFS
VJEΛҾͱͯ͠6TFSͷσʔλΛऔಘ͢ΔΫΤϦ
6TFSͷεΩʔϚʹUPLFOؚ͕·Ε͍ͯΔ
BENJOͷVJEBENJOͰ͋Δ͜ͱ͕(FU'MBHͷϖʔδʹࣔ͞Ε͍ͯΔ
VQEBUF5PLFO UPLFO4USJOH
#PPMFBO
ࣗΞΧϯτͷUPLFOΛߋ৽͢Δϛϡʔςʔγϣϯ
BENJOͷUPLFO͕͔͍ͬͯΕɺࣗΞΧϯτͷUPLFOΛBENJOͷUPLFOͰ্ॻ͖Ͱ͖Δ
QSPpMFS
ͷΞϓϩʔν
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
39
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 40
Slide 40 text
#ctf4b
someoneΫΤϦͰBENJOͷUPLFOΛऔಘ͢Δ
updateTokenϛϡʔςʔγϣϯͰࣗΞΧϯτͷUPLFOΛ্ॻ͖
qBHΫΤϦͰ'MBHΛऔಘ
QSPpMFS
ղ๏
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
40
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 41
Slide 41 text
#ctf4b
QSPpMFS
͓ΘΓʹ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
41
ͷ·ͱΊ
ΞϓϦέʔγϣϯʹ(SBQI2-"1*͕࣮͞Ε͍ͯͨ
"1**OUSPTQFDUJPO2VFSZΛڋ൱͍ͯ͠ͳ͔ͬͨ
"1*ػඍͳσʔλ͕֨ೲ͞ΕͨϑΟʔϧυ JFUPLFO
ΛσʔλܕʹؚΊ͍ͯͨ
"1*ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦ JFVQEBUF5PLFO
Λެ։͍ͯͨ͠
*OUSPTQFDUJPO2VFSZΛૹ৴͢Δ͜ͱͰ͜ΕΒͷใ͕ಘΒΕɺ߈ܸ͕Մೳͩͬͨ
ڭ܇
ػඍͳσʔλ͕֨ೲ͞ΕͨϑΟʔϧυΛσʔλܕʹؚΊͯެ։͠ͳ͍
ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦΛެ։͠ͳ͍
ΫϥΠΞϯταΠυʹ"1*ͷεΩʔϚΛެද͢Δҙਤ͕ͳ͍ͱ͖*OUSPTQFDUJPO2VFSZΛڋ൱͢Δ
ࢀߟࢿྉ
(SBQI2-c"RVFSZMBOHVBHFGPSZPVS"1*
w IUUQTHSBQIRMPSH
(SBQI2-$PNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFN
w IUUQTNFEJVNDPN!UIFCJMBMSJ[XBOHSBQIRMDPNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFNGGEDF
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 42
Slide 42 text
#ctf4b
"HFOEB
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
42
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 43
Slide 43 text
#ctf4b
4PNFO
қ)BSE
QUTTPMWFT
ͷ֓ཁ
ΞϓϦέʔγϣϯ 1)1
ͱ8PSLFS Ϋϩʔϥ
ͷ࣮͕͞ΕΔ
໊લΛೖྗ͢Δཝͱɺೖྗͨ͠ϖʔδΛ"ENJOͷΫϩʔϥʹ։͔ͤΔػೳ͕ଘࡏ͢Δ
"ENJOͷΫϩʔϥͷ$PPLJFʹ'MBH͕֨ೲ͞Ε͍ͯΔ
w 944ͷ༧ײ
ճʹඞཁͳࣝ
944 3FqFDUFE944%0.CBTFE944
$41ͷجૅ
w TDSJQUTSD TUSJDUEZOBNJD
CBTFVSJ
$41#ZQBTTJOH
4PNFO
ͷ֓ཁ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
43
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 44
Slide 44 text
#ctf4b
4PNFO
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
44
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 45
Slide 45 text
#ctf4b
4PNFO
εΫϦʔϯγϣοτ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
45
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 46
Slide 46 text
#ctf4b
ΞϓϦέʔγϣϯͷ࣮ ॏཁͳͱ͜Ζ͚ͩநग़
4PNFO
࣮ΛݟͯΈΔ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
46
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 47
Slide 47 text
#ctf4b
ΞϓϦέʔγϣϯͷ࣮ ॏཁͳͱ͜Ζ͚ͩநग़
4PNFO
࣮ΛݟͯΈΔ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
47
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 48
Slide 48 text
#ctf4b
$41 $POUFOU4FDVSJUZ1PMJDZ
944σʔλΠϯδΣΫγϣϯ߈ܸͷϦεΫΛܰݮͤ͞ΔηΩϡϦςΟϨΠϠʔ
ಛఆͷ8FCϖʔδʹ͓͍ͯɺಡΈࠐΈ࣮ߦΛڐՄ͢ΔϦιʔεΛ໌ࣔతʹࢦఆͰ͖Δ
w ద༻͍ͨ͠ϙϦγʔͷछผΛࣔ͢σΟϨΫςΟϒͱͦΕʹଓ͘Ͱࢦఆ͢Δ
Content-Security-PolicyϔομʔͰ৴͢Δ
4PNFO
$41ͷ֓ཁ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
48
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 49
Slide 49 text
#ctf4b
σΟϨΫςΟϒ
ద༻͍ͨ͠ϙϦγʔͷछผΛࣔ͢ ۩ମతͳσΟϨΫςΟϒ໊ʹଓ͍ͯࢦఆ͢Δ
4PNFO
$41ͷσΟϨΫςΟϒ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
49
σΟϨΫςΟϒछผ ֓ཁ ྫ
Fetch Directives ϦιʔεͷಡΈࠐΈʹؔ͢Δ੍ݶ JavaScript (script-src)
Document Directives υΩϡϝϯτͷঢ়ଶʹؔ͢Δ੍ݶ ૬ରURIͷى (base-uri)
Navigation Directives φϏήʔγϣϯίϯςΩετʹؔ͢Δ੍ݶ ຒΊࠐΈϑϨʔϜͷ (frame-ancestors)
Reporting Directives ϨϙʔτػೳΛఏڙ Ϩϙʔτૹ৴ઌ (report-to)
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 50
Slide 50 text
#ctf4b
FHscript-srcσΟϨΫςΟϒʹઃఆՄೳͳ
4PNFO
$41ͷσΟϨΫςΟϒ TDSJQUTSD
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
50
ҙຯ
'none' JavaScript ͷ࣮ߦΛશͯېࢭ
'self' ࢀরதͷWebϖʔδͱಉҰ Origin Ͱ৴͞Ε͍ͯΔ JavaScript ͷ࣮ߦΛڐՄ
'example.com' example.com ͔Β৴͞Ε͍ͯΔ JavaScript ͷ࣮ߦΛڐՄ
'nonce-' Nonce (͍ࣺͯͷ) ͕Ұக͢Δ JavaScript ͷ࣮ߦΛڐՄ
'-' ϋογϡ͕Ұக͢Δ JavaScript ͷ࣮ߦΛڐՄ
'strict-dynamic'
Nonce ϋογϡͰ৴པ͞Εͨ JavaScript ͔Βಈతʹ
non-"parser-insrted" ͳํ๏ͰಡΈࠐ·Ε͍ͯΔͷΛڐՄ
'unsafe-inline' ΠϯϥΠϯεΫϦϓτͷ࣮ߦΛڐՄ (࣮࣭తʹ XSS ͷରࡦʹͳΒͳ͍
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 51
Slide 51 text
#ctf4b
TUSJDUEZOBNJD
/PODFϋογϡͰ৴པ͞Εͨ+BWB4DSJQU͔Βಈతʹ
OPOQBSTFSJOTFSUFEͳํ๏ͰಡΈࠐ·Ε͍ͯΔͷΛڐՄ
4PNFO
TUSJDUEZOBNJD
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
51
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 52
Slide 52 text
#ctf4b
3FqFDUFE944
߈ܸऀ͕తͱ͢Δ+BWB4DSJQU͕Ϩεϙϯε͞ΕΔΑ͏ͳϦΫΤετΛૹͬͨࡍʹɺ
ͦΕ͕ࣹͯ͠λʔήοτͷϒϥβ্Ͱ࣮ߦ͞ΕΔΑ͏ͳ944
ࠓճͷ߹
ʹ$_GET["username"]ͷ༰Λͦͷ··μϯϓ͍ͯ͠Δ
FH username='alert(1)'
ࠓճͷ߹$41ʹΑΔ੍ݶ͕͋ΔͨΊɺ্هͷ߈ܸϖΠϩʔυͰൃՐ͠ͳ͍
w script-src: 'unsafe-inline' ͕ࢦఆ͞Ε͍ͯͳ͍ͨΊɺΠϯϥΠϯεΫϦϓτͷ࣮ߦڐՄ͞Εͳ͍
4PNFO
3FqFDUFE944
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
52
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 53
Slide 53 text
#ctf4b
%0.CBTFE944
+BWB4DSJQU͔Βಈతʹ)5.-Λߏங͍ͯ͠Δ߹ʹൃੜ͢Δ944
ಛఆͷཁૉʹର͢ΔinnerHTMLͷೖΛىͱͯ͠ൃੜ͢Δ
ࠓճͷ߹
ͷJOOFS)5.-ʹର͢Δೖ͕ଘࡏ͢Δ
JFೖʹϢʔβ͕ೖྗ͕ͨͦ͠ͷ··ө͞ΕΔ߹ɺ944͕Մೳ
w FHusername = 'alert(1)
' ࠓճͷ߹$41ʹΑΔ੍ݶ͕͋ΔͨΊɺ্هͷ߈ܸϖΠϩʔυͰൃՐ͠ͳ͍ w script-src: 'unsafe-inline' ͕ࢦఆ͞Ε͍ͯͳ͍ͨΊɺΠϯϥΠϯεΫϦϓτͷ࣮ߦڐՄ͞Εͳ͍ w ϒϩοΫͷ࡞͕parser-insertedͰ͋ΔͨΊɺ'strict-dynamic' ͷ݅ʹҾ͔͔ͬΔ 4PNFO %0.CBTFE944 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 53 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
Slide 54
Slide 54 text
#ctf4b
TFDVSJUZKT
ϒϩοΫͷ಄ͰಡΈࠐ·Ε͍ͯΔ+BWB4DSJQU
usernameΫΤϦʹඇৗʹݫ͍݅͠ ^[a-zA-Z0-9]*$
Λ՝͠ɺ
ҧͨ͠߹error.phpʹڧ੍తʹϦμΠϨΫτͤ͞Δ
4PNFO
TFDVSJUZKT
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
54
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 55
Slide 55 text
#ctf4b
TFDVSJUZKT͕͋Δͱ͏·͍͔͘ͳ͍
͋·Γʹೖྗͷ͕݅ݫ͗͢͠ΔͨΊ
͜Ε͕͏·࣮͘ߦ͞Εͳ͍Α͏ʹ͍ͨ͠
ΠϯϥΠϯεΫϦϓτͷ࣮ߦ͕ڐՄ͞Εͳ͍
script-src: 'unsafe-inline' ͕ࢦఆ͞Ε͍ͯͳ͍ͨΊ
/PODFͰ৴པ͞ΕͨϒϩοΫ͔Β͏·͘+BWB4DSJQUΛྲྀ͠ࠐΜͰΔඞཁ͕͋Δ
%0.CBTFE944ΛൃՐ͍ͤͨ͞
id="message"ͳཁૉͷinnerHTMLͷೖΛ͏·͘׆༻͍ͨ͠
parser-insertedͳํ๏Ͱ<script>ϒϩοΫΛ࡞࣮ͯ͠ߦ͞Εͳ͍
w id="message" ͳཁૉ͕ͱͱ <script> ϒϩοΫͳΒɺnon-"parser-inserted" ͳͷͰ OK
4PNFO
ํ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
55
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 56
Slide 56 text
#ctf4b
CBTFUBHJOKFDUJPO
CBTFλάΛૠೖ͢Δ͜ͱͰ૬ର63*ͷىΛແཧΓ্ॻ͖͢Δ͜ͱ͕Ͱ͖Δɻ
w FH Λૠೖ͢Δͱ
http://hoge.example/security.js ͕࣮ߦ͞ΕΔ
w ࠓճͷ߹ɺଘࡏ͠ͳ͍υϝΠϯΛదʹࢦఆͯ͠Εɺsecurity.js ͷ࣮ߦΛ્͢Δ͜ͱ͕Ͱ͖Δ
ղ๏
ࠓճUJUMFλάͳͷͰɺ͜ΕΛҰ୴ดͯ͡Δඞཁ͕͋Δ
JF
4PNFO
TFDVSJUZKTΛ࣮ߦͤ͞ͳ͍Α͏ʹ͢Δ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
56
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 57
Slide 57 text
#ctf4b
%0.$MPCCFSJOHͷ׆༻
id="message"ͳཁૉͷinnerHTMLͷೖΛ͏·͘׆༻͍ͨ͠
w ͏·͘׆༻Ͱ͖ΕɺOPOQBSTFSJOTFSUFEͷ݅ΛΫϦΞͰ͖Δ
ΛΑΓઌʹ͖࣋ͬͯͯΕ
document.getElementById("message")͕Λ͘Α͏ʹͳΔ
ղ๏
<script id="message">Λૠೖ͢Δ
4PNFO
%0.CBTFE944Λ࣮ݱͤ͞Δ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
57
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 58
Slide 58 text
#ctf4b
ղʹඞཁͳཁૉ
CBTFUBHJOKFDUJPOʹΑΔTFDVSJUZKT࣮ߦͷ્
%0.$MPCCFSJOHʹΑΔ%0.CBTFE944ͷൃՐ
w 944ʹΑͬͯɺ"ENJOͷΫϩʔϥͷ$PPLJFΛऔ͢Δ
ͷ·ͱΊͱڭ܇
$41ʹཔΓ͗͢ͳ͍
w ͋͘·ͰՃతͳηΩϡϦςΟϨΠϠʔͰ͋ΓɺదͳΤεέʔϓॲཧෆՄܽͰ͋Δ ସࡦͰͳ͍
$41ΛͪΌΜͱ͏
w script-src͚ͩͰͳ͘ɺbase-uriconnect-srcదʹΈ߹Θͤͯ͏ඞཁ͕͋Δ
w DG$41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN
4PNFO
ղ๏ͷ·ͱΊ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
58
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 59
Slide 59 text
#ctf4b
ࠓճͷϖʔδΛ$41&WBMVBUPSͰݟͯΈΔͱ
4PNFO
$41&WBMVBUPS
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
59
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 60
Slide 60 text
#ctf4b
"HFOEB
ൃද༰
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
60
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ
4QZ
8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS
(SBQI2-"1*&YQMPJUBUJPO
4PNFO
$POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏
$PODMVTJPO
ຊൃදͷ·ͱΊ
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ
Slide 61
Slide 61 text
#ctf4b
ຊ͓ͨ͠༰
8FCηΩϡϦςΟͱ$5'ʹ͓͚Δ8FCͷ֓ཁ
#FHJOOFST$5'8FCδϟϯϧͷ݁Ռ
֤ͷղઆ
w 4QZೝূใͷཧͱλΠϛϯά߈ܸ
w QSPpMFS(SBQI2-&YQMPJUBUJPO
w 4PNFO$41#ZQBTTJOH
8FCָ͍͠
ࠓճհͨ͠߈ܸͷςΫχοΫʹର͢ΔΞϓϩʔνͷํ΄ΜͷҰ෦
8FCʹߋʹ໘നͯ͘ߴͳ߈ܸख๏ٕज़͕ͨ͘͞Μଘࡏ͠·͢
΄΅
ຖि։࠵͞ΕΔ$5'ʹࢀઓɺόάόϯςΟͰΛຏ͘ɺಓͨ͘͞Μ͋Γ·͢
5SZ)BSEFS
$PODMVTJPO
ຊൃදͷ·ͱΊ
4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ
61
*OUSPEVDUJPO
8FCηΩϡϦςΟͱ
8FCͷ֓ཁ
4QZ
ೝূใͷཧͱ
λΠϛϯά߈ܸ
QSPpMFS
(SBQI2-"1*
&YQMPJUBUJPO
4PNFO
$41#ZQBTTJOH
$PODMVTJPO
ຊൃදͷ·ͱΊ