Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
0802徳丸.pdf
Search
tanakata
August 02, 2017
0
40
0802徳丸.pdf
tanakata
August 02, 2017
Tweet
Share
More Decks by tanakata
See All by tanakata
20171201
tanakata
0
26
20171110
tanakata
0
35
1013
tanakata
0
41
徳丸0922
tanakata
0
48
0901
tanakata
0
30
2017/08/25
tanakata
0
39
徳丸20170721.pdf
tanakata
0
32
Featured
See All Featured
Statistics for Hackers
jakevdp
789
220k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
226
16k
Fontdeck: Realign not Redesign
paulrobertlloyd
76
4.9k
A Modern Web Designer's Workflow
chriscoyier
689
190k
Git: the NoSQL Database
bkeepers
PRO
422
63k
Facilitating Awesome Meetings
lara
41
5.6k
Into the Great Unknown - MozCon
thekraken
10
990
Bash Introduction
62gerente
604
210k
GitHub's CSS Performance
jonrohan
1024
450k
The Pragmatic Product Professional
lauravandoore
24
5.8k
Imperfection Machines: The Place of Print at Facebook
scottboms
259
12k
How STYLIGHT went responsive
nonsquared
92
4.8k
Transcript
2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ
͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ
͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ
ηογϣϯͷ͓͞Β͍
ηογϣϯͱ ϩάΠϯ͔ͯ͠ΒϩάΞτ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ ใΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ
ηογϣϯϋΠδϟοΫͱ ౪ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧϯτΛͬऔΔ߈ܸ
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰͯΕͦ͏ͳจࣈྻʣ
ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ରΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰରΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ͏
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
౪ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥβ͕ ૹ৴ͯ͘͠Δ
REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍߹ʹ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ߹ɺͦͷηογϣϯIDΛݩʑ ͍ͬͯΔѱҙΛ࣋ͬͨϢʔβϩάΠϯͨ͠ϢʔβʹΓΘͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ
ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱผʹೝՄ͞Εͨ͜ͱΛূ໌͢ΔใΛՃ͢Δɻ
·ͱΊ
·ͱΊ ɾηογϣϯཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪ରࡦʣ →ΫοΩʔͰηογϣϯIDΛཧ͢Δ ɾೝূޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ
͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠