Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
"Gimme a bit!" - Exploring Attacks in the "Post...
Search
Takashi Yoneuchi
May 16, 2019
Technology
9
5.8k
"Gimme a bit!" - Exploring Attacks in the "Post-XSS" World
Presented at:
https://shibuyaxss.connpass.com/event/128168/
Takashi Yoneuchi
May 16, 2019
Tweet
Share
More Decks by Takashi Yoneuchi
See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
660
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.7k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
210
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
210
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
3
2.1k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.6k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.1k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための 「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.4k
Other Decks in Technology
See All in Technology
複雑なState管理からの脱却
sansantech
PRO
1
140
Amazon Personalizeの レコメンドシステム構築、実際何するの？ 〜大体10分で具体的なイメージをつかむ〜
kniino
1
100
SSMRunbook作成の勘所_20241120
koichiotomo
2
130
AWS Media Services 最新サービスアップデート 2024
eijikominami
0
200
SREが投資するAIOps ~ペアーズにおけるLLM for Developerへの取り組み~
takumiogawa
1
190
Lambda10周年！Lambdaは何をもたらしたか
smt7174
2
110
AGIについてChatGPTに聞いてみた
blueb
0
130
サイバーセキュリティと認知バイアス：対策の隙を埋める心理学的アプローチ
shumei_ito
0
380
テストコード品質を高めるためにMutation Testingライブラリ・Strykerを実戦導入してみた話
ysknsid25
7
2.6k
誰も全体を知らない ～ ロールの垣根を超えて引き上げる開発生産性 / Boosting Development Productivity Across Roles
kakehashi
1
220
障害対応指揮の意思決定と情報共有における価値観 / Waroom Meetup #2
arthur1
5
470
オープンソースAIとは何か？ --「オープンソースAIの定義 v1.0」詳細解説
shujisado
7
820
Featured
See All Featured
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
44
6.8k
Agile that works and the tools we love
rasmusluckow
327
21k
Scaling GitHub
holman
458
140k
Designing for Performance
lara
604
68k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
131
33k
How GitHub (no longer) Works
holman
310
140k
Building Applications with DynamoDB
mza
90
6.1k
Mobile First: as difficult as doing things right
swwweet
222
8.9k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
47
2.1k
Navigating Team Friction
lara
183
14k
Writing Fast Ruby
sferik
627
61k
Bash Introduction
62gerente
608
210k
Transcript
(JNNFBCJU &YQMPSJOH"UUBDLTJOUIF1PTU9448PSME 5BLBTIJ:POFVDIJ !MNU@TXBMMPX %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP IUUQTTIJGUKTJOGP
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZ
PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ 4&$$0/#FHJOOFSTDUGC ‣ 4FDVSJUZ$BNQTFDDBNQ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF ‣ 1PTU9448PSME ‣ 2VFTUJPO8IBUDPNFTBGUFS944
‣ *OUSPEVDUJPOUP94-FBLTBOE944FBSDI ‣ 0WFSWJFX ‣ &YBNQMFT ‣ 'SBNF$PVOU ‣ 5JNJOH*OGPSNBUJPO ‣ &⒎FDUT.JUJHBUJPO ‣ $PODMVTJPO
1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 3PBENBQUP1PTU9448PSME .JUJHBUJPO 944FBSDI 94-FBL
4DSJQUMFTT "UUBDL 4DSJQU (BEHFUT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT4JUF4DSJQUJOH 944 BDPNNPOqBXJO8FCBQQMJDBUJPOT ‣ .BOZEFWFMPQFSTBOESFTFBSDIFSTIBWFTUSVHHMFEXJUI944
‣ .PEFSO8FCGSBNFXPSLTQSPWJEFQSFWFOUJPO ‣ "VUPNBUJDFTDBQJOH ‣ 'PPMQSPPG FHEBOHFSPVTMZ4FU*OOFS)5.- ‣ 8FCCSPXTFSTBMTPIBWFEFGFOTFMJOFT ‣ $POUFOU4FDVSJUZ1PMJDZ $41 ‣ 944"VEJUPS <?= $_GET['q'] ?>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT
"UUBDL 4DSJQU (BEHFUT 3PBENBQUP1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $POUFOU4FDVSJUZ1PMJDZ &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ $POUFOU4FDVSJUZ1PMJDZ $41 ‣
4QFDJpDBUJPOIUUQTXXXXPSH53$41JOUSP ‣ *USFEVDFTUIFIBSNDBVTFECZDPOUFOUJOKFDUJPOBUUBDLT ‣ "QQSPQSJBUFQPMJDJFTSFRVJSFBUUBDLFSTUPNBLFBCVODIPG F⒎PSUTUPFYFDVUF+4TVDDFTTGVMMZ Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE 944JTGPVOE
‣ 5IFSFBSFUXPNPEFT ‣ pMUFS ‣ CMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT
"UUBDL 4DSJQU (BEHFUT 3PBENBQUP1PTU9448PSME
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &WPMVUJPOPG944 4DSJQU(BEHFUT$PEFSFVTJOHTJNJMBSUP301 ‣ &OUIVTJBTUTPG944IBWFUSJFEUPCZQBTT$41 ‣ 0OFPG4PMVUJPOT4DSJQU(BEHFUT -FLJFTFUBM
‣ *EFBSFVTFUSVTUFE MFHJUJNBUF TPVSDFDPEFTUPFYFDVUF BSCJUSBSZTDSJQUT DGSFUVSOPSJFOUFEQSPHSBNNJOH 301 <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')>
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4DSJQUMFTT"UUBDLT /PUPOMZ+4 CVUBMTP$44IFMQTBUUBDLFST ‣ 3FTFBSDI2VFTUJPO *G+4FYFDVUJPOJTSFTUSJDUFE XIBUDBOBUUBDLFSTEP
‣ 0OFPG"OTXFST4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ‣ #BDLJOIJTUPSZ UIJTDMBTTPGBUUBDLTIBTCFFOJOWFTUJHBUFECZ SFTFBSDIFST BOEXBTPGUFOSFEJTDPWFSFE ‣ 8FMMLOPXO"UUSJCVUFSFBEJOH 'POUMJHBUVSFUFDIOJRVF GPOU SBOHFUFDIOJRVF FUD ‣ /FXSFTFBSDIMJOFJNQPSUSFDVSTJPOUFDIOJRVFT 1FQF7JMB IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 94-FBLT944FBSDI "UUBDLTBJNJOHUIFQPTU944XPSME ‣ 3FTFBSDI2VFTUJPO *TUIFSFZFUBOPUIFSBUUBDLJOHUFDIOJRVFXIFOBEWFSTBSJFT IBWFOPDPOUFOUJOKFDUJPOWVMOFSBCJMJUJFTJOUBSHFUT
‣ "OTXFS:FT ‣ *EFBEBUBUPXIJDIDSPTTPSJHJOBDDFTTJTHSBOUFEIFMQTPOF FTUJNBUFUIFGFBUVSFT DIBSBDUFSJTUJDT PGB)551SFTQPOTF ‣ &YBNQMF FYQMBJOFEMBUFS ‣ $SPTTTJUF-FBLT 94-FBLT ‣ $SPTTTJUF4FBSDI 944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC #"%/0/$& 54($5' "EEJUJPOBM/PUFT <?php session_start();
$nonce = md5(session_id()); $_SESSION['count'] = isset($_SESSION['count']) ? $_SESSION['count'] + 1 : 0; if ($_SESSION['count'] > 3){ setcookie('flag', null, -1, '/'); } ?> <head><meta http-equiv="Content-Security-Policy" content="script-src 'nonce-<?= $nonce ?>';"></head> <body><script nonce=<?= $nonce ?>>/* ... */</script> <?= $_GET['q'] ?> </body> UIFOPODFJTpYFE :PVIBWFUPMFBLDPPLJFT XJUIPOMZUXPSFR
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT 1PTU9448PSME ‣ *O .JDIBFM;BMFXTLJ !MDBNUVG OPUFEUIBUUIF
DPMMFDUJPOPGBUUBDLTBMUFSOBUJWFUP944IFQSPWJEFEIBWF BMNPTUTBNFDBQBCJMJUJFTBT944 1PTUDBSETGSPNUIFQPTU944XPSMEIUUQMDBNUVGDPSFEVNQDYQPTUYTT ‣ FH3FSPVUJOHPGFYJTUJOHGPSNT ‣ FHIJKBDLSFMBUJWF63-TXJUI CBTF ‣ DG3FMBUJWF1BUI0WFSXSJUF ‣ 4FF"STIBE GPSUIFSFBMBOBMZTJT-BSHFTDBMFBOBMZTJTPG TUZMFJOKFDUJPOCZSFMBUJWFQBUIPWFSXSJUF IUUQTEMBDNPSHDJUBUJPODGN JE
*OUSPEVDUJPOUP 94-FBLTBOE944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF-FBLT BLB94-FBLT ‣ $SPTTTJUFMFBLT 94-FBL BSFBGBNJMZPGCSPXTFSTJEF DIBOOFMUFDIOJRVFT
‣ 94-FBLBUUBDLTBJNUPDJSDVNWFOUTFDVSJUZDPOUSPMTJO8FC CSPXTFSTCZUXPTUFQT ‣ 3FRVFTUJOH ‣ FHFNCFEEJOHBDSPTTTJUFDPOUFOU FH JGSBNF ‣ 0CTFSWJOHCSPXTFSTJEFDIBOOFMT ‣ FHBCVTJOHGFBUVSFTPG8FCCSPXTFST FH944"VEJUPS ‣ 0OFPGUIFVTBHFT$SPTTTJUF4FBSDI 944FBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF4FBSDI BLB944FBSDI ‣ $SPTTTJUFTFBSDI 944FBSDI
BUUBDLJTBLJOEPGBUUBDLT XIJDIBTLTTPNFRVFTUJPOTWJDUJNGSPNBVTFSTCSPXTFSUP B8FCFOEQPJOU ‣ FH*TUIFSFBFNBJMXIJDIDPOUBJOTUIFXPSEBQQMFJOUIF CPEZ GPSBOFNBJMTFSWJDF ‣ FH*OUIFSFBQMBOUPHPTPNFXIFSFUIJTXFFLFOE GPSB DBMFOEBSTFSWJDF ‣ 5IFBOTXFSPGUIFTFSWFSXJMMCFPCUBJOFECZVTJOH94 -FBLT FHSFTQPOTFTJ[FFTUJNBUJPO FUD
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBUUBDLFSMVSFTBVTFSUPB QBHFUIBUJOJUJBUFTSFRVFTUT UPBTFSWJDF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT /FYU "OBEWFSTBSZJOJUJBUFT EVNNZSFRVFTUTXIPTF SFTQPOTFTBSFLOPXOJOBEWBODF &YBNQMFBSFRVFTUXJUIBTFBSDI RVFSZXIPTFSFTVMUDBOOPUFYJTU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "GUFSSFRVFTUJOHEVNNJFT BOBEWFSTBSZTUBSUTUP JOJUJBUFSFRVFTUTXJUI BDUVBMTFBSDIRVFSJFT %J⒎CFUXFFOEBUB FYQPTFECZ94-FBLGPS EVNNJFTBOEPOFGPS DIBMMFOHFTDPSSFTQPOETUIF EJ⒎CFUXFFOSFTQPOTFT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBEWFSTBSZSFQFBUTUIF QSPDFTTBOE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE %VNNZ3FRVFTU 3FTQPOTF
$IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT "OBEWFSTBSZTFOETUIF DPMMFDUFESFTVMUTGSPN WJDUJNTCSPXTFSTUPJUT PXOTFSWFS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 6NN JTJUSFBMJTUJD 8IBU94-FBLT944FBSDIHJWFTVT ‣
6OMJLF944 94-FBLT944FBSDI ‣ EPFTOPUQSPWJEFBDUVBMDPOUFOUTPGEBUB ‣ EVFUP4BNF0SJHJO1PMJDZ ‣ EPQSPWJEFGFBUVSFT DIBSBDUFSJTUJDT PGEBUB ‣ FH8IFUIFSUIFEBUBDPOUBJOTBTQFDJpDWBMVFPSOPU ‣ 3FTQPOTFTXJUITFBSDISFTVMUTIBWFMPOHFSMFOHUIUIBOPOFXJUI OPSFTVMUT ‣ FH8IFUIFSUIFEBUBIBTDPNQMFYJUZPSOPU ‣ $PNQMFYJUZPGUFOSFTVMUTJOMPOHFSQSPDFTTJOHUJNF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC )JTUPSZ94-FBLT /PXBEBZT BCVODIPG1P$TBSFCFDPNJOHBWBJMBCMFJOPOMJOF )551$BDIF$SPTT4JUF-FBLT IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM
$SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB &WBOTQSFTFOUFEUIFQSJNJUJWFGPSNPG944FBSDIXJUI JNH MPBEUJNJOH &WBOT $SPTTEPNBJOTFBSDIUJNJOH IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBMHBWFUIFTPQIJTUJDBUFEBUUBDLTGPSTJUFTXJUI TFBSDIFOHJOFTOBNFE944FBSDI (FMFSOUFSFUBM
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT 94-FBLT944FBSDI ‣ 94-FBLTIBWFBUUSBDUFEBUUFOUJPO CVUOPUFOPVHI ‣ #PUIBDDVSBDZBOEF⒎FDUJWFOFTTIBWFCFFOJNQSPWFE
‣ 3FGFSFODFT ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFS JOGPSNBUJPOCZ1PSU4XJHHFS IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT
&YBNQMF 'SBNF$PVOU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC XJOEPXMFOHUI "VTFGVMQSPQFSUZGPSDSPTTPSJHJOBUUBDLFST ‣ XJOEPXMFOHUI XJOEPXGSBNFTMFOHUI SFUVSOTUIF OVNCFSPGGSBNFTJOUIFXJOEPX
2VPUFEIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC"1* 8JOEPXMFOHUI ‣ $SPTTPSJHJOBDDFTTUP XJOEPXMFOHUIJTBMMPXFEVOEFS TBNFPSJHJOQPMJDZ 401 4FFIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNF PSJHJO@QPMJDZ ‣ $BOUIJTQSPQFSUZCFVUJMJ[FEGPS TPNFLJOETPGBUUBDLT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO
3FqFDUFE 944JTGPVOE ‣ 5IFSFBSFUXPNPEFT pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS XJOEPXMFOHUI ‣ 8IFOUIFSFJTTQFDJpDDPOUFOUUIBUDBOXBLF944"VEJUPSJO BQBHFBOEUIFQBHFIBT BUMFBTUPOF JGSBNF
‣ 8IFO944"VEJUPSCMPDLT XJOEPXMFOHUI ‣ 8IFOOPU XJOEPXMFOHUI ‣ 8FDBOHFUBCJU XIFUIFSUIFTQFDJpDDPOUFOUJT JODMVEFEPSOPUCZUIFQBHFBTMPOHBTUIFDPOUFOUDBO XBLF944"VEJUPS:BZ <iframe src="..."></iframe> <script>let secret_flag = true;</script>
%&.054($5' 3&$0/ /05&.PSFTJNQMZ XFDBOEFUFDUUIFXBLFPG944"VEJUPSCZPCTFSWJOHIPX NBOZUJNFTJGSBNFTPOMPBEFWFOUPDDVST &YBNQMFD$5'pMFNBOBHFS IUUQTHJTUHJUIVCDPNMXJPBFBBFBBDEBDEDBE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4JEF&⒎FDUTPG#MPDLJOH 8IBU944"VEJUPSDBVTFT ‣ *G944"VEJUPSCMPDLT ‣ TPNFQSPQFSUJFTNBZTFFNTUPCFEJ⒎FSFOUGSPNUIFWBMVFT
XIFOUIFQBHFJTTIPXOVTVBMMZ ‣ *G944"VEJUPSpMUFST ‣ 1BHFTUSVDUVSFT FTQFDJBMMZUIFqPXPGBQQSPQSJBUF+4 FYFDVUJPOqPX DBOCFCSPLFO ‣ &YBNQMF9944/JHIUNBSF NPEF BUUBDL944"UUBDLT &YQMPJUJOH944'JMUFS !NBTBUPLJOVHBXB IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS IUUQTXXXNCTEKQCMPHIUNM
&YBNQMF 5JNJOH*OGPSNBUJPO
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5JNJOH"UUBDL 8FC "LJOEPGTJEFDIBOOFMBUUBDLT ‣
3FTFBSDI2VFTUJPO 8IBUBUUBDLFSTDBOEPXJUIUJNJOHJOGPSNBUJPO ‣ 'JSTU*EFB 'FMUFOBOE4DIOFJEFS ‣ #SPXTFSTDBDIFIBTF⒎FDUTPOUIFMPBEJOHUJNFPGSFTPVSDFT ‣ $BDIFTBSFPGUFOBWBJMBCMFGPSSFTPVSDFTBDDFTTFESFDFOUMZ ‣ )FODF UIFMPBEJOHUJNFSFqFDUTCSPXTJOHIJTUPSZ ‣ 5IFSFBSFUXPWJFXQPJOUT ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC %JSFDU5JNJOH"UUBDL #PSU[BOE#POFI $SPTCZFUBM ‣
$POEJUJPOT*OGPSNBUJPOUIBUBUUBDLFSTXBOUUPMFBLB⒎FDUTUP TJUFXJEFCFIBWJPS ‣ "UUBDLT ‣ )JEEFOCPPMFBOWBMVFTEBUBTJ[FDBOCFFTUJNBUFEXJUI NFBTVSJOHQSPDFTTJOHUJNF #PSU[BOE#POFI ‣ 5PUIFCFTUPGNZLOPXMFEHF UIFZBSFUIFpSTUXIPEFTDSJCFEUIF DPODFQUPGEJSFDUUJNJOHBUUBDL ‣ &WFOSFNPUFUJNJOHBUUBDLT BQQSPQSJBUFTUBUJTUJDBMNFUIPET HJWFBUUBDLFSTBDDVSBUFBOBMZTJT $SPTCZFUBM ‣ 5IFCPYUFTUUIFZQSFTFOUFEBSFPGUFOVTFEJOPUIFSSFTFBSDI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF5JNJOH"UUBDL #PSU[BOE#POFI ‣ "UUBDLT
‣ 8JUITFSWFSTJEFUJNJOH ‣ *OJUJBMDPODFQUPG944FBSDIJTCBTFEPOTFSWFSTJEFUJNJOH ‣ &WBOT NFOUJPOFECFGPSF ‣ (FMFSOUFSFUBM NFOUJPOFECFGPSF ‣ 8JUIDMJFOUTJEFUJNJOH ‣ BMTPLOPXOBTCSPXTFSCBTFEUJNJOHBUUBDLT ‣ &YBNQMFT ‣ $BDIF'FMUFOBOE4DIOFJEFS 7BO(PFUIFNFUBM ‣ $444UPOF ,PUDIFSFUBM 4NJUIFUBM FUD
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣
*EFB ‣ $BDIFTIBWFF⒎FDUTPOQSPDFTTJOHUJNF ‣ "UUBDLT ‣ 5IFpSTUDPODFQUPGUJNJOHBUUBDLJOUIF8FCEFSJWFTGSPN DBDIFCBTFEBUUBDLT 'FMUFOBOE4DIOFJEFS ‣ 'FBUVSFTJOUSPEVDFEPONPEFSOCSPXTFSTDBOCFOFXTJEF DIBOOFMTUIBUMFUBEWFSTBSJFTNFBTVSFNPSFBDDVSBUFUJNJOH 7BO(PFUIFNFUBM ‣ FH$BDIF"1* PG4FSWJDF8PSLFS ‣ FH"QQMJDBUJPO$BDIF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣
*EFB ‣ 3FOEFSJOHIBTBUJHIUSFMBUJPOXJUIBDPOUFOUUPCFSFOEFSFE ‣ &WFOEBUBXIJDIDBOOPUCFUPVDIFEGSPN+4DBOCFSFOEFSFE ‣ "UUBDLT ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .PSF4PQIJTUJDBUFE0OFT 1PTTJCMFBUUBDLTXBUDIJOHZPVSFOWJSPONFOUT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMTJEFDIBOOFMBUUBDLT FYQMPJUUJNJOHBOECFIBWJPSEJ⒎FSFODFTUIBUBSF
QBSUJBMMZ DBVTFEUISPVHINJDSPBSDIJUFDUVSBM PQUJNJ[BUJPOT JF EJ⒎FSFODFTUIBUBSFOPUBSDIJUFDUVSBMMZ EPDVNFOUFE 4PGUXBSFCBTFE.JDSPBSDIJUFDUVSBM"UUBDLTIUUQTBSYJWPSHBCT ‣ 3FTFBSDI2VFTUJPOT+BWB4DSJQU XIJDIJTFYFDVUFEJOUIF TBOECPY JTFOPVHIUPCFVTFEGPSNJDSPBSDIJUFDUVSBM BUUBDLT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SPN+44BOECPY 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 3FTVMUT ‣ 5JNFSTBWBJMBCMFJO+BWB4DSJQUJTFOPVHIGPSBUUBDLFSTUP QFSGPSNNJDSPBSDIJUFDUVSBMBUUBDLT
4DIXBS[FM 'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQU IUUQTHSVTTDDpMFTGBOUBTUJDUJNFSTQEG ‣ 5IFZEFNPOTUSBUFEBOFX%3".CBTFEDPWFSUDIBOOFMXJUI+4 ‣ ,FZTUSPLFUJNJOHBUUBDLTJOTBOECPYFE+4 -JQQFUBM 1SBDUJDBM,FZTUSPLF5JNJOH"UUBDLTJO4BOECPYFE+BWB4DSJQUIUUQTMJOLTQSJOHFSDPNDIBQUFS @ ‣ +45FNQMBUF"UUBDLT 4DIXBS[FUBM +BWB4DSJQU5FNQMBUF"UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE&YQMPJUTIUUQT XXXOETTTZNQPTJVNPSHXQDPOUFOUVQMPBETOETT@#@4DIXBS[@QBQFSQEG ‣ /05&4JUF*TPMBUJPOBOEEJTBCMJOH4IBSFE"SSBZ#V⒎FS DVSSFOUMZ NJUJHBUFUIPTFBUUBDLT
&⒎FDUT.JUJHBUJPO
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &⒎FDUTPG94-FBLT 94MFBLTQSPWJEFBQBSUPGJOGPSNBUJPO OPUUIFXIPMF ‣ &WFOTFDVSF8FCTJUFTIBWFBQPUFOUJBMUPCFUBSHFUFE
‣ &WFOJG)551IFBEFSTBSFTFUTFDVSFMZ ‣ FH3FRVFTUBOE$PORVFS&YQPTJOH$SPTT0SJHJO3FTPVSDF4J[F IUUQTUPNWHQBQFSTSFRVFTU@BOE@DPORVFS@VTFOJYQEG ‣ DG6944 ‣ *UOFFETBMPUPGF⒎PSUTUPNJUJHBUFDPNQMFUFMZ ‣ )BWFZPVFWFSCFFOUIPVHIUBCPVUEBUBMFBLBHFGSPNUJNJOH JOGPSNBUJPO ‣ /FXQPMJDJFTUPNJUJHBUFUIFNIBWFCFFOEJTDVTTFE CVU
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .JUJHBUJPO 8IBUDBOXFEPGPSUIPTFBUUBDLT ‣ "MPUPGTFDVSJUZIFBEFSTBUUSJCVUFT ‣ 4BNFTJUF$PPLJF ‣
9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ $SPTT0SJHJO0QFOFS1PMJDZ $001 ‣ $SPTT0SJHJO3FTPVSDF1PMJDZ $031 ‣ $SPTT0SJHJO3FTPVSDF#MPDLJOH $03# ‣ 'FUDI.FUBEBUB ‣ 4PNFPGUIFNIBWFCFFOTUJMMEJTDVTTFE ‣ ,FFQXBUDIJOHXDXFCBQQTFD JO(JU)VC
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4BNFTJUF$PPLJF 3FTUSJDUJPOPGDPPLJFTVTBHFBUDSPTTTJUFSFRVFTUJOH ‣ 1SPCMFN$SPTTPSJHJOSFRVFTUTXJUIDPPLJFTPGUFODBVTFUIF TFDVSJUZJTTVFTTVDIBT$43' ‣ 4PMVUJPO4BNFTJUF$PPLJF
‣ #Z4BNF4JUFBUUSJCVUFTPGDPPLJF TJUFPXOFSTDBOQSPIJCJUT CSPXTFSTGSPNTFOEJOHDSPTTTJUFSFRVFTUTXJUIDPPLJFT ‣ 4BNF4JUF -BY0OMZUPQMFWFMOBWJHBUJPOTJTBMMPXFE ‣ 4BNF4JUF 4USJDU/PDSPTTTJUFSFRVFTUXJUIDPPLJFTJTBMMPXFE ‣ 4FF4BNF4JUFDPPLJFTFYQMBJOFE IUUQTXFCEFWTBNFTJUFDPPLJFTFYQMBJOFE
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SBNJOH3FTUSJDUJPO 9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ (FOFSBM1SPCMFN 3FBM8PSME&YBNQMFTPGUFOSFMJFTPOXJOEPXMFOHUI
IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ3FBM8PSME&YBNQMFT ‣ $BTFXIFOBQBHFJTGSBNFE CPUIPGUIFQBHF DIJME BOE JUTQBSFOUIBWFSFGFSFODFTUPAXJOEPXAUPFBDIPUIFS ‣ GSPNDIJMEUPQBSFOUXJOEPXQBSFOUPSXJOEPXUPQ ‣ GSPNQBSFOUUPDIJME GSBNF@FMNFOU DPOUFOU8JOEPX ‣ 4PMVUJPOT9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ 3FTUSJDUJOHDSPTTTJUFGSBNJOHSFEVDFTBUUBDLTVSGBDFT
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO0QFOFS1PMJDZ 3FTUSJDUJPOPGVTJOHAXJOEPXASFGFSFODFGSPNPQFOFST ‣ $BTFXIFOXJOEPXPQFOJTFYFDVUFE UIFPQFOFEXJOEPX DBOBDDFTTUPAXJOEPXAPGJUTPQFOFS ‣
XJOEPXPQFOFSMPDBUJPO IUUQFWJMDPN ‣ 4PMVUJPO$SPTT0SJHJO0QFOFS1PMJDZ $001 ‣ $SPTT0SJHJO0QFOFS1PMJDZIFBEFSEFpOFTXIFO AXJOEPXPQFOFSAJTBWBJMBCMF ‣ 4FFBOOFWLDPPQNE BTFNJGPSNBMEFpOJUPOPG$001 IUUQTHJTUHJUIVCDPNBOOFWLGEEDDGGCEBDGF
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO3FTPVSDF1PMJDZ 3FTUSJDUJPOPGUIFBWBJMBCMFPSJHJOPGSFTPVSDFT ‣ 1SPCMFN$SPTTPSJHJOOPDPSTSFRVFTUTDBVTFTFDVSJUZ JTTVFTTVDIBTTJEFDIBOOFMBUUBDLT ‣ DG4FSWJDF8PSLFSBCVTF
7BO(PFUIFNFUBM ‣ 4PMVUJPO$SPTT0SJHJO3FTPVSDF1PMJDZ $031 ‣ 5IJTIFBEFSQSFWFOUCSPXTFSTGSPNMPBEJOHSFTPVSDFTGFUDIFE CZDSPTT TJUFcPSJHJO OPDPSTSFRVFTUT ‣ /05&GPSNFSMZ UIJTJTDBMMFE'SPN0SJHJO Cross-Origin-Resource-Policy: same-site | same-origin
TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'FUDI.FUBEBUB *OGPUIBUIFMQTTFSWFSEFUFDUVOVTVBMSFRVFTUTGPSSFTPVSDFT ‣ 1SPCMFN ‣ 4FSWFSTDBOOPULOPXIPXUIFJSSFTPVSDFTXJMMCFVTFE ‣
4PMVUJPO'FUDI.FUBEBUB ‣ *UXPVMECFIFMQGVMJGTFSWFSTDPVMENBLFNPSFJOUFMMJHFOU EFDJTJPOTBCPVUXIFUIFSPSOPUUPSFTQPOEUPBHJWFO SFRVFTUCBTFEPOUIFXBZUIBUJU`TNBEF IUUQT NJLFXFTUHJUIVCJPTFDNFUBEBUB ‣ 1SPWJEFEXJUI4FD'FUDI IFBEFST
5IBOLZPVGPS-JTUFOJOH !MNU@TXBMMPX !ZOVDIZ IUUQTTIJGUKTJOGP
lmt_swallow
sansantech
kniino
koichiotomo
eijikominami
takumiogawa
smt7174
blueb
shumei_ito
ysknsid25
kakehashi
.jpeg){kind=avatar}
arthur1
shujisado
eileencodes
rasmusluckow
holman
lara
mza
swwweet
tammyeverts
sferik
62gerente
