Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
XSSの入力値を調べてみた / searching xss insertion value
Search
Tomoyuki KOYAMA
February 03, 2018
Technology
3
1.4k
XSSの入力値を調べてみた / searching xss insertion value
2018/02/03 学生LT at freee
Tomoyuki KOYAMA
February 03, 2018
Tweet
Share
More Decks by Tomoyuki KOYAMA
See All by Tomoyuki KOYAMA
Reading HTTP Client Hints
tomoyk
0
33
Log message with JSON item count for root cause analysis in microservices
tomoyk
0
100
Distributed Log Search Based on Time Series Access and Service Relations
tomoyk
0
230
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
tomoyk
0
330
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
tomoyk
2
750
この先生きのこるための学び方 / how-to-learn-tech
tomoyk
1
340
佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site
tomoyk
1
140
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
tomoyk
0
150
パケットを覗いてみよう / Packet workshop for beginners
tomoyk
0
270
Other Decks in Technology
See All in Technology
watsonx.ai Dojo 環境準備について
oniak3ibm
PRO
0
300
プロダクトエンジニアを支えるための開発生産性向上施策
tsukakei
0
140
タイミーのレコメンドにおける ABテストの運用
ozeshun
1
140
2024年のナビゲーション・フォーカス対応:Composeでキーボード・ナビゲーションをサポートしよう
tahia910
0
110
実務における脅威モデリングを考えよう
nikinusu
0
630
持続可能なソフトウェア開発を支える『GitHub CI/CD実践ガイド』
tmknom
6
1.4k
より快適なエラーログ監視を目指して
leveragestech
4
1.4k
Oracle Autonomous Database:サービス概要のご紹介
oracle4engineer
PRO
1
7.1k
Next.js のページ遷移を全力で止める
ypresto
7
3.2k
GC24 Recap: Interface Internals
task4233
0
140
事前準備が肝!AI活用のための業務改革
layerx
PRO
1
380
なにもしてないのにNew Relicのデータ転送量が増えていたときに確認したこと
tk3fftk
2
230
Featured
See All Featured
Agile that works and the tools we love
rasmusluckow
327
20k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
131
32k
Producing Creativity
orderedlist
PRO
340
39k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
23
1.7k
Rails Girls Zürich Keynote
gr2m
93
13k
Testing 201, or: Great Expectations
jmmastey
36
7k
GraphQLの誤解/rethinking-graphql
sonatard
65
9.8k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
24
610
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
103
48k
Designing for humans not robots
tammielis
248
25k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
45
4.8k
Building a Modern Day E-commerce SEO Strategy
aleyda
36
6.8k
Transcript
XSS
B1 Twitter: @tmyk_kym : https://blog.koyama.me/ : Network/Web/Server/Security : PyCon JP,
Seccamp, etc
XSS (Cross Site Scripting) HTML CWE-79: Improper Neutralization of Input
During Web Page Generation ('Cross-site Scripting') (3.0)
... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode'];
?></h1> $_GET['mode'] hello <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1>hello</h1>
... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode'];
?></h1> $_GET['mode'] <script>alert()</script> <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><script>alert()</script></h1>
XSS Stored XSS( ) Re ected XSS( ) DOM Based
XSS
XSS == XSS
<script>alert(1)</script> "><script>alert(1)</script> " onmouseover="alert(1) x" onerror="alert(1) <- img src javascript:alert(1)
<- a href
XSS
? / . XSS . XSS .
?
OWASP OWASP XSS 2015 XSS - OWASP https://jpcertcc.github.io/OWASPdocuments/CheatSheets/XSSFilterEvasion.html
( ) 3
[1] <SCRIPT/XSS SRC="http://example.com/xss.js"> </SCRIPT> / . ... <script xss="" src="http://example.com/xss.js">
</script>
[2] <<SCRIPT>alert("XSS");//<</SCRIPT> HTML XSS . ... "><script> alert("XSS");//< </script>
[3] <img src=x onerror=javas cript:ale rt('XSS')> &#x... HTML (16 )
. ... <img src="x" onerror="javascript:alert('XSS')">
( )
( ) <img src=javascript:alert('XSS')> <img src=javascript: alert(String.fromCharCode(88,83,83))> <META HTTP-EQUIV="refresh" CONTENT="3;
URL=http://;URL=http://yahoo.co.jp/;">
None
Electron Marp Electron Web ... <script>alert()</script> alert ...( )
?
JVN#21174546: Marp JavaScript https://jvn.jp/jp/JVN21174546/ However, sanitizing inline script should consider
on future. [Security issue] Remote script can read user local resource · Issue #187 · yhatt/marp “ “
XSS XSS alert() Electron