Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Sign up for free
Menu
Search
Features
All features
Private URLs
Password Protection
Custom URLS
Scheduled publishing
Remove Branding
Restrict embedding
Deck Collections
Notes
Features
All features
Private URLs
Password Protection
Custom URLS
Scheduled publishing
Remove Branding
Restrict embedding
Deck Collections
Notes
Explore
Featured decks
Featured speakers
Programming
Technology
Storyboards
Explore
Featured decks
Featured speakers
Programming
Technology
Storyboards
Pricing
Search
Sign in
Sign up for free
"Gimme a bit!" - Exploring Attacks in the "Post...
Search
Takashi Yoneuchi
May 16, 2019
Technology
6.4k
9
Share
Embed
Copy iframe code
Copy JS code
Copy link
Start on current slide
"Gimme a bit!" - Exploring Attacks in the "Post-XSS" World
Presented at:
https://shibuyaxss.connpass.com/event/128168/
Takashi Yoneuchi
May 16, 2019
More Decks by Takashi Yoneuchi
See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
990
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
3.7k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
410
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
450
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
4
2.7k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
2.3k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
11k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
12k
Go をセキュアに書き進めるための 「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
6.1k
Other Decks in Technology
See All in Technology
1週間、Opus封印でお願いします
kintotechdev
0
340
仕様駆動開発の、その先へ。決める力と確かめる仕組み
inariku
0
110
シンプルな設定ファイルで実現する AWS IAM Identity Center の ユーザー管理Terraformフレームワークを公開しました / Simplifying AWS IAM Identity Center User Management: An Open-Source Terraform Framework
yamaguchitk333
1
330
ガチで放置できるClaude Code実行環境の作り方.pdf
lamaglama39
5
9.9k
構造で守らせる データ・法務・セキュリティ・開発チームとつくる AI時代のデータガバナンスとデータ基盤のリアル
legalontechnologies
PRO
2
630
GitHub、使う？使わない？
happysamurai294
0
110
自宅サーバと脆弱性
masakiokuda
1
120
外国人エンジニアがVueプロトタイプで仕様を合わせている話 / Vue Fes Japan 2026 LT
eluwing
0
280
Agent × Maestro で始める モバイル E2E 端末準備からテスト実行・結果確認まで
sansantech
PRO
0
230
Autonomous AI Lakehouse - Live AI Hubから始めるセキュアなAIデータ活用 -
oracle4engineer
PRO
2
160
AIに任せられるFlutterコードベースを作る 〜仕様をコードで表し、ハーネスで守る〜
myohei
1
340
[re:Invent2026事前勉強会(有志開催)]続きは、ラスベガスの廊下で / continue-in-the-vegas-hallway
sh_fk2
0
350
Featured
See All Featured
Crafting Experiences
bethany
1
390
The AI Search Optimization Roadmap by Aleyda Solis
aleyda
2
6.3k
Navigating Team Friction
lara
192
16k
Building a A Zero-Code AI SEO Workflow
portentint
PRO
0
800
The agentic SEO stack - context over prompts
schlessera
0
980
Marketing to machines
jonoalderson
1
5.9k
The Spectacular Lies of Maps
axbom
PRO
1
1.1k
WENDY [Excerpt]
tessaabrams
14
40k
Digital Projects Gone Horribly Wrong (And the UX Pros Who Still Save the Day) - Dean Schuster
uxyall
1
3.5k
Statistics for Hackers
jakevdp
799
230k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
35
2.9k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
508
140k
Transcript
(JNNFBCJU &YQMPSJOH"UUBDLTJOUIF1PTU9448PSME 5BLBTIJ:POFVDIJ !MNU@TXBMMPX %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP IUUQTTIJGUKTJOGP
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZ
PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ 4&$$0/#FHJOOFSTDUGC ‣ 4FDVSJUZ$BNQTFDDBNQ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF ‣ 1PTU9448PSME ‣ 2VFTUJPO8IBUDPNFTBGUFS944
‣ *OUSPEVDUJPOUP94-FBLTBOE944FBSDI ‣ 0WFSWJFX ‣ &YBNQMFT ‣ 'SBNF$PVOU ‣ 5JNJOH*OGPSNBUJPO ‣ &⒎FDUT.JUJHBUJPO ‣ $PODMVTJPO
1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 3PBENBQUP1PTU9448PSME .JUJHBUJPO 944FBSDI 94-FBL
4DSJQUMFTT "UUBDL 4DSJQU (BEHFUT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT4JUF4DSJQUJOH 944 BDPNNPOqBXJO8FCBQQMJDBUJPOT ‣ .BOZEFWFMPQFSTBOESFTFBSDIFSTIBWFTUSVHHMFEXJUI944
‣ .PEFSO8FCGSBNFXPSLTQSPWJEFQSFWFOUJPO ‣ "VUPNBUJDFTDBQJOH ‣ 'PPMQSPPG FHEBOHFSPVTMZ4FU*OOFS)5.- ‣ 8FCCSPXTFSTBMTPIBWFEFGFOTFMJOFT ‣ $POUFOU4FDVSJUZ1PMJDZ $41 ‣ 944"VEJUPS <?= $_GET['q'] ?>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT
"UUBDL 4DSJQU (BEHFUT 3PBENBQUP1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $POUFOU4FDVSJUZ1PMJDZ &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ $POUFOU4FDVSJUZ1PMJDZ $41 ‣
4QFDJpDBUJPOIUUQTXXXXPSH53$41JOUSP ‣ *USFEVDFTUIFIBSNDBVTFECZDPOUFOUJOKFDUJPOBUUBDLT ‣ "QQSPQSJBUFQPMJDJFTSFRVJSFBUUBDLFSTUPNBLFBCVODIPG F⒎PSUTUPFYFDVUF+4TVDDFTTGVMMZ Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE 944JTGPVOE
‣ 5IFSFBSFUXPNPEFT ‣ pMUFS ‣ CMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT
"UUBDL 4DSJQU (BEHFUT 3PBENBQUP1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &WPMVUJPOPG944 4DSJQU(BEHFUT$PEFSFVTJOHTJNJMBSUP301 ‣ &OUIVTJBTUTPG944IBWFUSJFEUPCZQBTT$41 ‣ 0OFPG4PMVUJPOT4DSJQU(BEHFUT -FLJFTFUBM
‣ *EFBSFVTFUSVTUFE MFHJUJNBUF TPVSDFDPEFTUPFYFDVUF BSCJUSBSZTDSJQUT DGSFUVSOPSJFOUFEQSPHSBNNJOH 301 <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4DSJQUMFTT"UUBDLT /PUPOMZ+4 CVUBMTP$44IFMQTBUUBDLFST ‣ 3FTFBSDI2VFTUJPO *G+4FYFDVUJPOJTSFTUSJDUFE XIBUDBOBUUBDLFSTEP
‣ 0OFPG"OTXFST4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ‣ #BDLJOIJTUPSZ UIJTDMBTTPGBUUBDLTIBTCFFOJOWFTUJHBUFECZ SFTFBSDIFST BOEXBTPGUFOSFEJTDPWFSFE ‣ 8FMMLOPXO"UUSJCVUFSFBEJOH 'POUMJHBUVSFUFDIOJRVF GPOU SBOHFUFDIOJRVF FUD ‣ /FXSFTFBSDIMJOFJNQPSUSFDVSTJPOUFDIOJRVFT 1FQF7JMB IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 94-FBLT944FBSDI "UUBDLTBJNJOHUIFQPTU944XPSME ‣ 3FTFBSDI2VFTUJPO *TUIFSFZFUBOPUIFSBUUBDLJOHUFDIOJRVFXIFOBEWFSTBSJFT IBWFOPDPOUFOUJOKFDUJPOWVMOFSBCJMJUJFTJOUBSHFUT
‣ "OTXFS:FT ‣ *EFBEBUBUPXIJDIDSPTTPSJHJOBDDFTTJTHSBOUFEIFMQTPOF FTUJNBUFUIFGFBUVSFT DIBSBDUFSJTUJDT PGB)551SFTQPOTF ‣ &YBNQMF FYQMBJOFEMBUFS ‣ $SPTTTJUF-FBLT 94-FBLT ‣ $SPTTTJUF4FBSDI 944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC #"%/0/$& 54($5' "EEJUJPOBM/PUFT <?php session_start();
$nonce = md5(session_id()); $_SESSION['count'] = isset($_SESSION['count']) ? $_SESSION['count'] + 1 : 0; if ($_SESSION['count'] > 3){ setcookie('flag', null, -1, '/'); } ?> <head><meta http-equiv="Content-Security-Policy" content="script-src 'nonce-<?= $nonce ?>';"></head> <body><script nonce=<?= $nonce ?>>/* ... */</script> <?= $_GET['q'] ?> </body> UIFOPODFJTpYFE :PVIBWFUPMFBLDPPLJFT XJUIPOMZUXPSFR
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT 1PTU9448PSME ‣ *O .JDIBFM;BMFXTLJ !MDBNUVG OPUFEUIBUUIF
DPMMFDUJPOPGBUUBDLTBMUFSOBUJWFUP944IFQSPWJEFEIBWF BMNPTUTBNFDBQBCJMJUJFTBT944 1PTUDBSETGSPNUIFQPTU944XPSMEIUUQMDBNUVGDPSFEVNQDYQPTUYTT ‣ FH3FSPVUJOHPGFYJTUJOHGPSNT ‣ FHIJKBDLSFMBUJWF63-TXJUI CBTF ‣ DG3FMBUJWF1BUI0WFSXSJUF ‣ 4FF"STIBE GPSUIFSFBMBOBMZTJT-BSHFTDBMFBOBMZTJTPG TUZMFJOKFDUJPOCZSFMBUJWFQBUIPWFSXSJUF IUUQTEMBDNPSHDJUBUJPODGN JE
*OUSPEVDUJPOUP 94-FBLTBOE944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF-FBLT BLB94-FBLT ‣ $SPTTTJUFMFBLT 94-FBL BSFBGBNJMZPGCSPXTFSTJEF DIBOOFMUFDIOJRVFT
‣ 94-FBLBUUBDLTBJNUPDJSDVNWFOUTFDVSJUZDPOUSPMTJO8FC CSPXTFSTCZUXPTUFQT ‣ 3FRVFTUJOH ‣ FHFNCFEEJOHBDSPTTTJUFDPOUFOU FH JGSBNF ‣ 0CTFSWJOHCSPXTFSTJEFDIBOOFMT ‣ FHBCVTJOHGFBUVSFTPG8FCCSPXTFST FH944"VEJUPS ‣ 0OFPGUIFVTBHFT$SPTTTJUF4FBSDI 944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF4FBSDI BLB944FBSDI ‣ $SPTTTJUFTFBSDI 944FBSDI
BUUBDLJTBLJOEPGBUUBDLT XIJDIBTLTTPNFRVFTUJPOTWJDUJNGSPNBVTFSTCSPXTFSUP B8FCFOEQPJOU ‣ FH*TUIFSFBFNBJMXIJDIDPOUBJOTUIFXPSEBQQMFJOUIF CPEZ GPSBOFNBJMTFSWJDF ‣ FH*OUIFSFBQMBOUPHPTPNFXIFSFUIJTXFFLFOE GPSB DBMFOEBSTFSWJDF ‣ 5IFBOTXFSPGUIFTFSWFSXJMMCFPCUBJOFECZVTJOH94 -FBLT FHSFTQPOTFTJ[FFTUJNBUJPO FUD
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBUUBDLFSMVSFTBVTFSUPB QBHFUIBUJOJUJBUFTSFRVFTUT UPBTFSWJDF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT /FYU "OBEWFSTBSZJOJUJBUFT EVNNZSFRVFTUTXIPTF SFTQPOTFTBSFLOPXOJOBEWBODF &YBNQMFBSFRVFTUXJUIBTFBSDI RVFSZXIPTFSFTVMUDBOOPUFYJTU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "GUFSSFRVFTUJOHEVNNJFT BOBEWFSTBSZTUBSUTUP JOJUJBUFSFRVFTUTXJUI BDUVBMTFBSDIRVFSJFT %J⒎CFUXFFOEBUB FYQPTFECZ94-FBLGPS EVNNJFTBOEPOFGPS DIBMMFOHFTDPSSFTQPOETUIF EJ⒎CFUXFFOSFTQPOTFT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBEWFSTBSZSFQFBUTUIF QSPDFTTBOE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBEWFSTBSZTFOETUIF DPMMFDUFESFTVMUTGSPN WJDUJNTCSPXTFSTUPJUT PXOTFSWFS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 6NN JTJUSFBMJTUJD 8IBU94-FBLT944FBSDIHJWFTVT ‣
6OMJLF944 94-FBLT944FBSDI ‣ EPFTOPUQSPWJEFBDUVBMDPOUFOUTPGEBUB ‣ EVFUP4BNF0SJHJO1PMJDZ ‣ EPQSPWJEFGFBUVSFT DIBSBDUFSJTUJDT PGEBUB ‣ FH8IFUIFSUIFEBUBDPOUBJOTBTQFDJpDWBMVFPSOPU ‣ 3FTQPOTFTXJUITFBSDISFTVMUTIBWFMPOHFSMFOHUIUIBOPOFXJUI OPSFTVMUT ‣ FH8IFUIFSUIFEBUBIBTDPNQMFYJUZPSOPU ‣ $PNQMFYJUZPGUFOSFTVMUTJOMPOHFSQSPDFTTJOHUJNF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC )JTUPSZ94-FBLT /PXBEBZT BCVODIPG1P$TBSFCFDPNJOHBWBJMBCMFJOPOMJOF )551$BDIF$SPTT4JUF-FBLT IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM
$SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB &WBOTQSFTFOUFEUIFQSJNJUJWFGPSNPG944FBSDIXJUI JNH MPBEUJNJOH &WBOT $SPTTEPNBJOTFBSDIUJNJOH IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBMHBWFUIFTPQIJTUJDBUFEBUUBDLTGPSTJUFTXJUI TFBSDIFOHJOFTOBNFE944FBSDI (FMFSOUFSFUBM
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT 94-FBLT944FBSDI ‣ 94-FBLTIBWFBUUSBDUFEBUUFOUJPO CVUOPUFOPVHI ‣ #PUIBDDVSBDZBOEF⒎FDUJWFOFTTIBWFCFFOJNQSPWFE
‣ 3FGFSFODFT ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFS JOGPSNBUJPOCZ1PSU4XJHHFS IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT
&YBNQMF 'SBNF$PVOU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC XJOEPXMFOHUI "VTFGVMQSPQFSUZGPSDSPTTPSJHJOBUUBDLFST ‣ XJOEPXMFOHUI XJOEPXGSBNFTMFOHUI SFUVSOTUIF OVNCFSPGGSBNFTJOUIFXJOEPX
2VPUFEIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC"1* 8JOEPXMFOHUI ‣ $SPTTPSJHJOBDDFTTUP XJOEPXMFOHUIJTBMMPXFEVOEFS TBNFPSJHJOQPMJDZ 401 4FFIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNF PSJHJO@QPMJDZ ‣ $BOUIJTQSPQFSUZCFVUJMJ[FEGPS TPNFLJOETPGBUUBDLT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO
3FqFDUFE 944JTGPVOE ‣ 5IFSFBSFUXPNPEFT pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS XJOEPXMFOHUI ‣ 8IFOUIFSFJTTQFDJpDDPOUFOUUIBUDBOXBLF944"VEJUPSJO BQBHFBOEUIFQBHFIBT BUMFBTUPOF JGSBNF
‣ 8IFO944"VEJUPSCMPDLT XJOEPXMFOHUI ‣ 8IFOOPU XJOEPXMFOHUI ‣ 8FDBOHFUBCJU XIFUIFSUIFTQFDJpDDPOUFOUJT JODMVEFEPSOPUCZUIFQBHFBTMPOHBTUIFDPOUFOUDBO XBLF944"VEJUPS:BZ <iframe src="..."></iframe> <script>let secret_flag = true;</script>
%&.054($5' 3&$0/ /05&.PSFTJNQMZ XFDBOEFUFDUUIFXBLFPG944"VEJUPSCZPCTFSWJOHIPX NBOZUJNFTJGSBNFTPOMPBEFWFOUPDDVST &YBNQMFD$5'pMFNBOBHFS IUUQTHJTUHJUIVCDPNMXJPBFBBFBBDEBDEDBE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4JEF&⒎FDUTPG#MPDLJOH 8IBU944"VEJUPSDBVTFT ‣ *G944"VEJUPSCMPDLT ‣ TPNFQSPQFSUJFTNBZTFFNTUPCFEJ⒎FSFOUGSPNUIFWBMVFT
XIFOUIFQBHFJTTIPXOVTVBMMZ ‣ *G944"VEJUPSpMUFST ‣ 1BHFTUSVDUVSFT FTQFDJBMMZUIFqPXPGBQQSPQSJBUF+4 FYFDVUJPOqPX DBOCFCSPLFO ‣ &YBNQMF9944/JHIUNBSF NPEF BUUBDL944"UUBDLT &YQMPJUJOH944'JMUFS !NBTBUPLJOVHBXB IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS IUUQTXXXNCTEKQCMPHIUNM
&YBNQMF 5JNJOH*OGPSNBUJPO
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5JNJOH"UUBDL 8FC "LJOEPGTJEFDIBOOFMBUUBDLT ‣
3FTFBSDI2VFTUJPO 8IBUBUUBDLFSTDBOEPXJUIUJNJOHJOGPSNBUJPO ‣ 'JSTU*EFB 'FMUFOBOE4DIOFJEFS ‣ #SPXTFSTDBDIFIBTF⒎FDUTPOUIFMPBEJOHUJNFPGSFTPVSDFT ‣ $BDIFTBSFPGUFOBWBJMBCMFGPSSFTPVSDFTBDDFTTFESFDFOUMZ ‣ )FODF UIFMPBEJOHUJNFSFqFDUTCSPXTJOHIJTUPSZ ‣ 5IFSFBSFUXPWJFXQPJOUT ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC %JSFDU5JNJOH"UUBDL #PSU[BOE#POFI $SPTCZFUBM ‣
$POEJUJPOT*OGPSNBUJPOUIBUBUUBDLFSTXBOUUPMFBLB⒎FDUTUP TJUFXJEFCFIBWJPS ‣ "UUBDLT ‣ )JEEFOCPPMFBOWBMVFTEBUBTJ[FDBOCFFTUJNBUFEXJUI NFBTVSJOHQSPDFTTJOHUJNF #PSU[BOE#POFI ‣ 5PUIFCFTUPGNZLOPXMFEHF UIFZBSFUIFpSTUXIPEFTDSJCFEUIF DPODFQUPGEJSFDUUJNJOHBUUBDL ‣ &WFOSFNPUFUJNJOHBUUBDLT BQQSPQSJBUFTUBUJTUJDBMNFUIPET HJWFBUUBDLFSTBDDVSBUFBOBMZTJT $SPTCZFUBM ‣ 5IFCPYUFTUUIFZQSFTFOUFEBSFPGUFOVTFEJOPUIFSSFTFBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF5JNJOH"UUBDL #PSU[BOE#POFI ‣ "UUBDLT
‣ 8JUITFSWFSTJEFUJNJOH ‣ *OJUJBMDPODFQUPG944FBSDIJTCBTFEPOTFSWFSTJEFUJNJOH ‣ &WBOT NFOUJPOFECFGPSF ‣ (FMFSOUFSFUBM NFOUJPOFECFGPSF ‣ 8JUIDMJFOUTJEFUJNJOH ‣ BMTPLOPXOBTCSPXTFSCBTFEUJNJOHBUUBDLT ‣ &YBNQMFT ‣ $BDIF'FMUFOBOE4DIOFJEFS 7BO(PFUIFNFUBM ‣ $444UPOF ,PUDIFSFUBM 4NJUIFUBM FUD
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣
*EFB ‣ $BDIFTIBWFF⒎FDUTPOQSPDFTTJOHUJNF ‣ "UUBDLT ‣ 5IFpSTUDPODFQUPGUJNJOHBUUBDLJOUIF8FCEFSJWFTGSPN DBDIFCBTFEBUUBDLT 'FMUFOBOE4DIOFJEFS ‣ 'FBUVSFTJOUSPEVDFEPONPEFSOCSPXTFSTDBOCFOFXTJEF DIBOOFMTUIBUMFUBEWFSTBSJFTNFBTVSFNPSFBDDVSBUFUJNJOH 7BO(PFUIFNFUBM ‣ FH$BDIF"1* PG4FSWJDF8PSLFS ‣ FH"QQMJDBUJPO$BDIF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣
*EFB ‣ 3FOEFSJOHIBTBUJHIUSFMBUJPOXJUIBDPOUFOUUPCFSFOEFSFE ‣ &WFOEBUBXIJDIDBOOPUCFUPVDIFEGSPN+4DBOCFSFOEFSFE ‣ "UUBDLT ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .PSF4PQIJTUJDBUFE0OFT 1PTTJCMFBUUBDLTXBUDIJOHZPVSFOWJSPONFOUT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMTJEFDIBOOFMBUUBDLT FYQMPJUUJNJOHBOECFIBWJPSEJ⒎FSFODFTUIBUBSF
QBSUJBMMZ DBVTFEUISPVHINJDSPBSDIJUFDUVSBM PQUJNJ[BUJPOT JF EJ⒎FSFODFTUIBUBSFOPUBSDIJUFDUVSBMMZ EPDVNFOUFE 4PGUXBSFCBTFE.JDSPBSDIJUFDUVSBM"UUBDLTIUUQTBSYJWPSHBCT ‣ 3FTFBSDI2VFTUJPOT+BWB4DSJQU XIJDIJTFYFDVUFEJOUIF TBOECPY JTFOPVHIUPCFVTFEGPSNJDSPBSDIJUFDUVSBM BUUBDLT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SPN+44BOECPY 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 3FTVMUT ‣ 5JNFSTBWBJMBCMFJO+BWB4DSJQUJTFOPVHIGPSBUUBDLFSTUP QFSGPSNNJDSPBSDIJUFDUVSBMBUUBDLT
4DIXBS[FM 'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQU IUUQTHSVTTDDpMFTGBOUBTUJDUJNFSTQEG ‣ 5IFZEFNPOTUSBUFEBOFX%3".CBTFEDPWFSUDIBOOFMXJUI+4 ‣ ,FZTUSPLFUJNJOHBUUBDLTJOTBOECPYFE+4 -JQQFUBM 1SBDUJDBM,FZTUSPLF5JNJOH"UUBDLTJO4BOECPYFE+BWB4DSJQUIUUQTMJOLTQSJOHFSDPNDIBQUFS @ ‣ +45FNQMBUF"UUBDLT 4DIXBS[FUBM +BWB4DSJQU5FNQMBUF"UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE&YQMPJUTIUUQT XXXOETTTZNQPTJVNPSHXQDPOUFOUVQMPBETOETT@#@4DIXBS[@QBQFSQEG ‣ /05&4JUF*TPMBUJPOBOEEJTBCMJOH4IBSFE"SSBZ#V⒎FS DVSSFOUMZ NJUJHBUFUIPTFBUUBDLT
&⒎FDUT.JUJHBUJPO
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &⒎FDUTPG94-FBLT 94MFBLTQSPWJEFBQBSUPGJOGPSNBUJPO OPUUIFXIPMF ‣ &WFOTFDVSF8FCTJUFTIBWFBQPUFOUJBMUPCFUBSHFUFE
‣ &WFOJG)551IFBEFSTBSFTFUTFDVSFMZ ‣ FH3FRVFTUBOE$PORVFS&YQPTJOH$SPTT0SJHJO3FTPVSDF4J[F IUUQTUPNWHQBQFSTSFRVFTU@BOE@DPORVFS@VTFOJYQEG ‣ DG6944 ‣ *UOFFETBMPUPGF⒎PSUTUPNJUJHBUFDPNQMFUFMZ ‣ )BWFZPVFWFSCFFOUIPVHIUBCPVUEBUBMFBLBHFGSPNUJNJOH JOGPSNBUJPO ‣ /FXQPMJDJFTUPNJUJHBUFUIFNIBWFCFFOEJTDVTTFE CVU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .JUJHBUJPO 8IBUDBOXFEPGPSUIPTFBUUBDLT ‣ "MPUPGTFDVSJUZIFBEFSTBUUSJCVUFT ‣ 4BNFTJUF$PPLJF ‣
9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ $SPTT0SJHJO0QFOFS1PMJDZ $001 ‣ $SPTT0SJHJO3FTPVSDF1PMJDZ $031 ‣ $SPTT0SJHJO3FTPVSDF#MPDLJOH $03# ‣ 'FUDI.FUBEBUB ‣ 4PNFPGUIFNIBWFCFFOTUJMMEJTDVTTFE ‣ ,FFQXBUDIJOHXDXFCBQQTFD JO(JU)VC
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4BNFTJUF$PPLJF 3FTUSJDUJPOPGDPPLJFTVTBHFBUDSPTTTJUFSFRVFTUJOH ‣ 1SPCMFN$SPTTPSJHJOSFRVFTUTXJUIDPPLJFTPGUFODBVTFUIF TFDVSJUZJTTVFTTVDIBT$43' ‣ 4PMVUJPO4BNFTJUF$PPLJF
‣ #Z4BNF4JUFBUUSJCVUFTPGDPPLJF TJUFPXOFSTDBOQSPIJCJUT CSPXTFSTGSPNTFOEJOHDSPTTTJUFSFRVFTUTXJUIDPPLJFT ‣ 4BNF4JUF -BY0OMZUPQMFWFMOBWJHBUJPOTJTBMMPXFE ‣ 4BNF4JUF 4USJDU/PDSPTTTJUFSFRVFTUXJUIDPPLJFTJTBMMPXFE ‣ 4FF4BNF4JUFDPPLJFTFYQMBJOFE IUUQTXFCEFWTBNFTJUFDPPLJFTFYQMBJOFE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SBNJOH3FTUSJDUJPO 9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ (FOFSBM1SPCMFN 3FBM8PSME&YBNQMFTPGUFOSFMJFTPOXJOEPXMFOHUI
IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ3FBM8PSME&YBNQMFT ‣ $BTFXIFOBQBHFJTGSBNFE CPUIPGUIFQBHF DIJME BOE JUTQBSFOUIBWFSFGFSFODFTUPAXJOEPXAUPFBDIPUIFS ‣ GSPNDIJMEUPQBSFOUXJOEPXQBSFOUPSXJOEPXUPQ ‣ GSPNQBSFOUUPDIJME GSBNF@FMNFOU DPOUFOU8JOEPX ‣ 4PMVUJPOT9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ 3FTUSJDUJOHDSPTTTJUFGSBNJOHSFEVDFTBUUBDLTVSGBDFT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO0QFOFS1PMJDZ 3FTUSJDUJPOPGVTJOHAXJOEPXASFGFSFODFGSPNPQFOFST ‣ $BTFXIFOXJOEPXPQFOJTFYFDVUFE UIFPQFOFEXJOEPX DBOBDDFTTUPAXJOEPXAPGJUTPQFOFS ‣
XJOEPXPQFOFSMPDBUJPO IUUQFWJMDPN ‣ 4PMVUJPO$SPTT0SJHJO0QFOFS1PMJDZ $001 ‣ $SPTT0SJHJO0QFOFS1PMJDZIFBEFSEFpOFTXIFO AXJOEPXPQFOFSAJTBWBJMBCMF ‣ 4FFBOOFWLDPPQNE BTFNJGPSNBMEFpOJUPOPG$001 IUUQTHJTUHJUIVCDPNBOOFWLGEEDDGGCEBDGF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO3FTPVSDF1PMJDZ 3FTUSJDUJPOPGUIFBWBJMBCMFPSJHJOPGSFTPVSDFT ‣ 1SPCMFN$SPTTPSJHJOOPDPSTSFRVFTUTDBVTFTFDVSJUZ JTTVFTTVDIBTTJEFDIBOOFMBUUBDLT ‣ DG4FSWJDF8PSLFSBCVTF
7BO(PFUIFNFUBM ‣ 4PMVUJPO$SPTT0SJHJO3FTPVSDF1PMJDZ $031 ‣ 5IJTIFBEFSQSFWFOUCSPXTFSTGSPNMPBEJOHSFTPVSDFTGFUDIFE CZDSPTT TJUFcPSJHJO OPDPSTSFRVFTUT ‣ /05&GPSNFSMZ UIJTJTDBMMFE'SPN0SJHJO Cross-Origin-Resource-Policy: same-site | same-origin
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'FUDI.FUBEBUB *OGPUIBUIFMQTTFSWFSEFUFDUVOVTVBMSFRVFTUTGPSSFTPVSDFT ‣ 1SPCMFN ‣ 4FSWFSTDBOOPULOPXIPXUIFJSSFTPVSDFTXJMMCFVTFE ‣
4PMVUJPO'FUDI.FUBEBUB ‣ *UXPVMECFIFMQGVMJGTFSWFSTDPVMENBLFNPSFJOUFMMJHFOU EFDJTJPOTBCPVUXIFUIFSPSOPUUPSFTQPOEUPBHJWFO SFRVFTUCBTFEPOUIFXBZUIBUJU`TNBEF IUUQT NJLFXFTUHJUIVCJPTFDNFUBEBUB ‣ 1SPWJEFEXJUI4FD'FUDI IFBEFST
5IBOLZPVGPS-JTUFOJOH !MNU@TXBMMPX !ZOVDIZ IUUQTTIJGUKTJOGP
lmt_swallow
kintotechdev
inariku
yamaguchitk333
.jpg){kind=avatar}
lamaglama39
legalontechnologies
happysamurai294
masakiokuda
eluwing
sansantech
oracle4engineer
myohei
sh_fk2
bethany
aleyda
lara
portentint
schlessera
jonoalderson
axbom
tessaabrams
uxyall
jakevdp
jcasabona
chriscoyier
