Upgrade to Pro — share decks privately, control downloads, hide ads and more …

0802徳丸.pdf

Avatar for tanakata tanakata
August 02, 2017
0
50

 0802徳丸.pdf

Avatar for tanakata

tanakata

August 02, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
37
20171110
Avatar for tanakata tanakata
0
47
1013
Avatar for tanakata tanakata
0
50
徳丸0922
Avatar for tanakata tanakata
0
75
0901
Avatar for tanakata tanakata
0
42
2017/08/25
Avatar for tanakata tanakata
0
46
徳丸20170721.pdf
Avatar for tanakata tanakata
0
39

Featured

See All Featured
Tell your own story through comics
Avatar for letsgokoyo letsgokoyo
1
810
16th Malabo Montpellier Forum Presentation
Avatar for AKADEMIYA2063 akademiya2063
PRO
0
49
Digital Projects Gone Horribly Wrong (And the UX Pros Who Still Save the Day) - Dean Schuster
Avatar for UX Y'all uxyall
0
320
<Decoding/> the Language of Devs - We Love SEO 2024
Avatar for Nikki Halliwell nikkihalliwell
1
130
Ecommerce SEO: The Keys for Success Now & Beyond - #SERPConf2024
Avatar for Aleyda Solis aleyda
1
1.8k
How to Get Subject Matter Experts Bought In and Actively Contributing to SEO & PR Initiatives.
Avatar for Liv Day livdayseo
0
64
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
4.2k
A Guide to Academic Writing Using Generative AI - A Workshop
Avatar for Kenji Saito ks91
PRO
0
200
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
230k
Build The Right Thing And Hit Your Dates
Avatar for Maggie C. maggiecrowley
38
3k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
31
6.6k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
275
41k

Transcript

  1. 2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ

  2. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ

  3. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ

  4. ηογϣϯͷ͓͞Β͍

  5. ηογϣϯͱ͸ ϩάΠϯ͔ͯ͠ΒϩάΞ΢τ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯ؅ཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ৘ ใ΍ΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷ৘ใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ

  6. ηογϣϯϋΠδϟοΫͱ͸ ౪೉ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧ΢ϯτΛ৐ͬऔΔ߈ܸ

  7. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  8. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  9. ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰ౰ͯΕͦ͏ͳจࣈྻʣ

  10. ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ର৅ΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰର৅ΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ࢖͏

  11. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  12. ౪೉ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ৔߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥ΢β͕ ૹ৴ͯ͘͠Δ

    REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID ͸ COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍৔߹ʹ ΋ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ

  13. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  14. ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸ͸ɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ৔߹ɺͦͷηογϣϯIDΛݩʑ ஌͍ͬͯΔѱҙΛ࣋ͬͨϢʔβ͸ϩάΠϯͨ͠Ϣʔβʹ੒Γ୅Θͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ

  15. ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱ͸ผʹೝՄ͞Εͨ͜ͱΛূ໌͢Δ৘ใΛ෇Ճ͢Δɻ

  16. ·ͱΊ

  17. ·ͱΊ ɾηογϣϯ؅ཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ࢖͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪೉ରࡦʣ →ΫοΩʔͰηογϣϯIDΛ؅ཧ͢Δ ɾೝূ੒ޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ

  18. ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠