超絶技巧CSRF / Shibuya.XSS techtalk #7

by mala

Slide 1

Slide 1 text

$43' NBMB ௒ઈٕ޼

Slide 2

Slide 2 text

ࠓ೔ͷςʔϚ w $43'ʹ͍ͭͯ w Έͳ͞Μ͝ଘ஌Ͱ͢ΑͶ w ͋·Γ೉͍͜͠ͱ͸࿩͠·ͤΜ

Slide 3

Slide 3 text

$43'PS943' w DSPTTTJUFSFRVFTUGPSHFSZ w ΫϩεαΠτͰϦΫΤετΛڧ੍͢Δ߈ܸख๏ w 944ͱฒΜͰྑ͘ݟ͔ͭΔ8FCΞϓϦέʔγϣ ϯͷ୅දతͳ੬ऑੑͷҰͭ

Slide 4

Slide 4 text

Կ͕ग़དྷΔ͔ʁ w ةݥ౓௿উखʹॻ͖ࠐΈ ͜Μʹͪ͸͜Μʹͪ͸ w ةݥ౓ߴύεϫʔυΛউखʹมߋ w $43'ͰՄೳͳΞΫγϣϯʹΑ༷ͬͯʑ w ୯ͳΔΠλζϥ͔ΒΞΧ΢ϯτ৐ͬऔΓ·Ͱ

Slide 5

Slide 5 text

ະͩʹଟ͋͘Δ w 944͸ਖ਼͍͠ίʔυΛॻ͍͍ͯΕ͹ݩʑى͖ͳ ͍ w $43'ରࡦ͸ηΩϡϦςΟͷͨΊͷ௥Ճͷࢪࡦ w ϑϨʔϜϫʔΫͳͲͰࣗಈԽ͞Εͯͳ͍ͱ࿙ΕΔ w อޢ͢΂͖͔Ͳ͏͔ͷ൑அ͕೉͍͠

Slide 6

Slide 6 text

$43'͸ࣄޙରॲʹͳΓ͕ͪ w ·͋ɺͿͬͪΌ͚ܝࣔ൘ͱ͔౤ථͱ͔ίϝϯτ ػೳͱ͔͸ࣄޙରॲͰྑ͍ͱࢥ͍·͢ w ॏཁػೳ͕ಉ͡ײ֮ͰࣄޙରॲͩͱϠόΠʂ w ˠϦεΫͷߴ͍$43'ʹ͍ͭͯ঺հ͠·͢

Slide 7

Slide 7 text

ΞΧ΢ϯτ৐ͬऔΓ w ةݥͳ$43'ͷ୅දతͳ΋ͷ w ύεϫʔυมߋ͕$43'ͰՄೳ w ϝʔϧΞυϨεมߋ͕$43'ͰՄೳ

Slide 8

Slide 8 text

࿈ܞΞΧ΢ϯτ௥Ճ w 0"VUITUBUFύϥϝʔλ࢖ͬͯͳ͍ w ෳ਺ϓϩόΠμͷJEͰϩάΠϯ͕Մೳ w ׂͱ͋Γ͕ͪ

Slide 9

Slide 9 text

ωοτϫʔΫػث΁ͷ߈ܸ w +7/ϧʔλʔ$43'ͳͲͰάάοͯΈͯͶ

Slide 10

Slide 10 text

͍ΖΜͳ΋ͷʹ$43'͢Δ w $43'Ͱ+40/΍9.-ΛૹΔ w GPSNFODUZQFUFYUQMBJOΛ࢖͏ w IUUQJUTFDVSJUZDPODFQUTDPN DTSGPOKTPOSFRVFTUT w IUUQQFOUFTUNPOLFZOFUCMPHDTSGYNM QPTUSFRVFTU

Slide 11

Slide 11 text

Ԡ༻ set hoge 0 1000000 8 hogehoge

Slide 12

Slide 12 text

$43'ͰNFNDBDIFEʹॻ͖ࠐΉ set hoge 0 1000000 8 hogehoge

Slide 13

Slide 13 text

͑ͬʁ w ͍͖ͳΓIUUQͷนΛӽ͑ͯߦ͖·ͨ͠Ͷ w ରԠ͍ͯ͠ͳ͍ίϚϯυ͸ແࢹ͞ΕΔ POST / HTTP/1.1 ERROR w NFNDBDIFEQSPUPDPMͱͯ͠ղऍՄೳͳ෦෼ͩ ͚ධՁ͞ΕΔɻ

Slide 14

Slide 14 text

͍ΖΜͳ΋ͷʹ$43'͢Δ w $SPTTQSPUPDPMͳSFRVFTUGPSHFSZ w ରԠ͍ͯ͠ͳ͍ίϚϯυΛదٓແࢹͯ͘͠Εͯί ωΫγϣϯΛ੾அ͠ͳ͍5$1αʔόʔ w ˢ͜͏͍͏ੑ࣭ͷαʔόʔʹ͸$43'ͰίϚϯυ ൃߦՄೳ

Slide 15

Slide 15 text

࣮͸ݹ͔͘Β͋Δ߈ܸख๏ w )5.-'PSN1SPUPDPM"UUBDL ೥ w IUUQTXXXKPDIFOUPQGDPNIGQB w 5IJTDBOCFVTFEUPTFOEDPNNBOETUP TFSWFSTVTJOH"4$**CBTFEQSPUPDPMTMJLF 4.51 //51 101 *."1 *3$ BOEPUIFSTz w )5.-ϑΥʔϜ͔Β4.51ʹίϚϯυૹ৴

Slide 16

Slide 16 text

ৄ͘͠͸ ͜ͷຊͷষʹॻ͍ͯ͋Δ

Slide 17

Slide 17 text

ϒϥ΢βଆͰͷରࡦ w $SPTT1SPUPDPMTDSJQUJOHBUUBDL w IUUQXXXBSDIJWFNP[JMMBPSHQSPKFDUTOFUMJC 1PSU#BOOJOHIUNM w Α͘஌ΒΕ͍ͯΔαʔϏε͕ϒϩοΫ͞Εͨ w XFMMLOPXOͰ͸ͳ͍QPSU͸ೖͬͯͳ͍ w ϙʔτมߋͯ͠ͷӡ༻΍࠷ۙͷ/P42-αʔόʔͳΜ͔ ͸อޢ͞Ε͍ͯͳ͍

Slide 18

Slide 18 text

αʔόʔଆͰͷରࡦ w ରԠ͍ͯ͠ͳ͍ίϚϯυ͕ૹΒΕͨΒ੾அ w )551͕ૹΒΕ͖ͯͨΒ੾அ͢Δ w ͱ͍͏࣮૷ͷαʔόʔ΋͋ΔΒ͍͠

Slide 19

Slide 19 text

8IBU`TOFX w ೥ͱݱ୅Ͱ΍΍ঢ়گ͕ҟͳ͍ͬͯΔ w ϒϥ΢β͔ΒϢʔβʔΞΫγϣϯແ͠ͰͷόΠφ Ϧσʔλૹ৴͕Մೳʹͳ͍ͬͯΔ w ੲϑΝΠϧΞοϓϩʔυ΍ϓϥάΠϯܦ༝͠ͳ ͚Ε͹ແཧͩͬͨ w ࠓYISTFOE CMPC ͰՄೳ

Slide 20

Slide 20 text

ࡉ͔͍࿩ w ϑΝΠϧΞοϓϩʔυ͢Δ$43' w 'MBTIͰېࢭ͞Ε͕ͨ9)3MFWFMͰΉ͠Ζॊೈʹͳ͍ͬͯΔ w 'MBTI͔Β'JMF6QMPBE૬౰ͷ1045ϦΫΤετ͸ DSPTTEPNBJOYNM͕ඞཁ IUUQXXXBEPCFDPNKQEFWOFU qBTIQMBZFSBSUJDMFTGQMBZFS@TFDVSJUZ@DIBOHFTIUNM w ϩʔΧϧϑΝΠϧΛউखʹΞοϓϩʔυˠ౰વແཧ w NVMUJQBSUGPSNEBUBΛ$43'ˠՄೳ w $034ͷϓϦϑϥΠτର৅֎

Slide 21

Slide 21 text

όΠφϦ΋ૹΕΔΑ͏ʹ͢Δ w UFYUQMBJOͩͱόΠφϦૹΕͳ͔ͬͨΓ͢Δ  ˞ૹ৴͢ΔจࣈίʔυͷൣғͰ͔͠ૹΕͳ͍ɺؒҧͬͯͨΒڭ͑ͯ w NVMUJQBSUGPSNEBUBͰϑΝΠϧૹΕ͹ॊೈʹόΠφ Ϧૹ৴Մೳˠͨͩ͠Ϣʔβʔૢ࡞͕ඞཁͩͬͨ w /&8YISTFOE CMPC ͰόΠφϦ΋ૹΕΔΑ͏ʹɻ w ΤϥʔΛద౓ʹແࢹͯ͘͠ΕΕ͹ όΠφϦϓϩτί ϧͰ΋$43'Ͱ஻ΕΔ

Slide 22

Slide 22 text

΋ͬͱѱ༻͢Δ w NFNDBDIFEʹόΠφϦσʔλΛॻ͖ࠐΉ w SFNPUFDPEFFYFDVUJPOͷFYQMPJU w ΦϒδΣΫτσγϦΞϥΠβΛ௨ͨ͡ίʔυ࣮ ߦ w EFNP

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

Կ͕ग़དྷΔ͔ w σγϦΞϥΠβΛ௨ͨ͠೚ҙίʔυ࣮ߦ  ˠେ൒ͷݴޠͰಉ༷ͷ߈ܸख๏͕͋Δ w NFNDBDIFEͷΞυϨε͕ط஌ͩͬͨΒ೚ҙͷ Ωʔʹ೚ҙͷσʔλΛॻ͖ࠐΜͩΓ w ߈ܸ༻ͷσʔλΛૹΓࠐΊ͹"QQαʔόʔ্Ͱ ೚ҙίʔυ࣮ߦΛҾ͖ى͜͢͜ͱ͕ग़དྷΔ

Slide 25

Slide 25 text

ύεϫʔυೝূʹΑΔରࡦ w NFNDBDIFE͸ೝূػߏ͕ແ͍ w *1ΞυϨε΍ΠϯλϑΣʔε੍ݶͰೝূػߏΛඋ ͍͑ͯͳ͍ϛυϧ΢ΣΞ΋ଟ͍ w ೝূ͔͚͓͚ͯ͹0, ˠ൒෼ਖ਼ղ൒෼ؒҧ͍

Slide 26

Slide 26 text

ೝূΛಥഁ͢Δ$43' w 3FEJTͩͱύεϫʔυΛ͔͚ΒΕΔ w 3FEJTͷύεϫʔυೝূ BVUINZTFDSFUQBTTXPSE  TFULFZWBMVF w ͜ΜͳͷΛૹΕ͹ྑ͍͚ͩͳͷͰಥഁՄೳ

Slide 27

Slide 27 text

ϛυϧ΢ΣΞͷύεϫʔυ w ͔͚͓ͯ͘ʹͨ͜͜͠ͱ͸ͳ͍͕ w ಺෦ͷωοτϫʔΫߏ੒ͳͲ͕ط஌ʹͳΔέʔε  ˠιʔείʔυ΍ઃఆ৘ใ΋࿙Ӯ͍ͯ͠Δ͜ͱ΋ ૝ఆ͢΂͖ w ྫ͑͹ୀ৬ऀ͕಺෦৘ใΛώϯτʹݱ৬ࣾһΛ ᠘ʹ͔͚ͯSFNPUFDPEFFYFDVUJPOՄೳ

Slide 28

Slide 28 text

$43'ͰಥഁͰ͖Δೝূ w ݁ՌͷಡΈऔΓͷඞཁ͕ͳ͍ೝূํࣜͰ͋Ε͹ɺ ύεϫʔυΛૹΓ͚ͭΔ͚ͩͳͷͰಥഁՄೳ w νϟϨϯδϨεϙϯεܗࣜͷೝূͰ͋Ε͹ಥഁ Ͱ͖ͳ͍ w $43'Ͱ͸ϦΫΤετͷ݁Ռ͕ಡΊͳ͍ͷͰ

Slide 29

Slide 29 text

ϛυϧ΢ΣΞ΁ͷ$43'ରࡦ w "$-͋Δ͔Β҆શͱࢥͬͯ·ͤΜ͔ʁ w ωοτϫʔΫࣗମΛִ཭͢Δͷ͕ྑ͍ w ִ཭͢Δ΋ͷ͸ͪΌΜͱִ཭ɺιʔείʔυ΍ ύεϫʔυ͕ط஌ͳΒ߈ܸͰ͖ΔΑ͏ͳͷ͸  ʮୀ৬ऀ޲͚όοΫυΞʯ

Slide 30

Slide 30 text

ࠓޙͷ܏޲ͱରࡦ w ϙʔτ੍ݶʹ͍ͭͯ͸࢓༷͕໌֬Խ͞ΕΔΑ͏ ʹͳͬͨ w IUUQTGFUDITQFDXIBUXHPSHQPSU CMPDLJOH w ͔͠͠XFMMLOPXOͰͳ͍QPSU͸Ҿ͖ଓ͖  DSPTTQSPUPDPMBUUBDL͕ՄೳͰ͠ΐ͏

Slide 31

Slide 31 text

ࠓޙͷ܏޲ͱରࡦ w ಺෦ωοτϫʔΫ޲͚ͷ$43'ରࡦ w $034BOE3'$  IUUQTNJLFXFTUHJUIVCJPDPSTSGD w ϒϥ΢βଆͰͷରࡦ΋ೖΔ͔΋

Slide 32

Slide 32 text

ྨࣅͷ໰୊ w $SPTTTJUF TDSJQUJOHSFRVFTUGPSHFSZ w TJUFˠQSPUPDPMTJUFˠBQQ w *1$ͷͨΊͷϩʔΧϧαʔόʔΛ࡞ΔΞϓϦ w ΧελϜεΩʔϜ΁ͷϦΫΤετڧ੍ w ϦΫΤετ͸ҰํతʹૹΕΔ૬ޓʹೝূ͢Δϓ ϩτίϧʹͳ͍ͬͯΔ͔֬ೝ͠·͠ΐ͏

Slide 33

Slide 33 text

·ͱΊ w $43'ΛͳΊͯ͸͍͚ͳ͍ w ʮউखʹॻ͖ࠐΈʯग़དྷΔ͚͕ͩͩ  ॻ͖ࠐΈର৅ʹΑͬͯ͸ग़དྷΔ͜ͱ͕෯޿͍ w DSPTTQSPUPDPMͳ$43'  YISTFOE CMPC ͰόΠφϦૹΕΔ w )5.-Ͱػೳ͕૿͑Δˠ߈ܸํ๏΍ϦεΫ૿Ճ

Slide 34

Slide 34 text

ऴΘΓ w "OZRVFTUJPOT