Upgrade to Pro — share decks privately, control downloads, hide ads and more …

"Gimme a bit!" - Exploring Attacks in the "Post...

Avatar for Takashi Yoneuchi Takashi Yoneuchi
May 16, 2019
Technology
6.3k
9

"Gimme a bit!" - Exploring Attacks in the "Post-XSS" World

Presented at: https://shibuyaxss.connpass.com/event/128168/

Avatar for Takashi Yoneuchi

Takashi Yoneuchi

May 16, 2019

More Decks by Takashi Yoneuchi

See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
Avatar for Takashi Yoneuchi lmt_swallow
0
960
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
Avatar for Takashi Yoneuchi lmt_swallow
5
3.6k
Eliminating ReDoS with Ruby 3.2
Avatar for Takashi Yoneuchi lmt_swallow
0
400
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
Avatar for Takashi Yoneuchi lmt_swallow
1
370
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
Avatar for Takashi Yoneuchi lmt_swallow
4
2.6k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
Avatar for Takashi Yoneuchi lmt_swallow
0
2.2k
Developer-First Security という考え方 / Introduction to Developer-First Security
Avatar for Takashi Yoneuchi lmt_swallow
6
10k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
Avatar for Takashi Yoneuchi lmt_swallow
18
12k
Go をセキュアに書き進めるための
「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
Avatar for Takashi Yoneuchi lmt_swallow
4
6.1k

Other Decks in Technology

See All in Technology
医療の現場を変革に挑戦した半年間の軌跡 - PythonとAIで現場を変える / From Code to Care
Avatar for soudai sone soudai
PRO
1
620
アクセスキーが漏れた日にやるべきこと- 無効化の先にある本当の対応
Avatar for kazzpapa3 kazzpapa3
0
330
AI駆動開発はどこまで来たのか？ ファインディの最新実態調査で読み解く現在地 Devin Con Tokyo
Avatar for Go-yamada akiratom
1
1.2k
ハッカソンで入賞した話 @ Findy LT
Avatar for asari asari194617
0
1.5k
AIで変わるエンジニアの働き方（仮）
Avatar for naoinaoi naoinaoi
0
550
1000⼈規模のClaude Enterprise運⽤を「Oktaのグループ」と「Slack」に集約する
Avatar for SansanTech sansantech
PRO
0
400
[ホンマでっか SRE] あなたはなぜ SRE に?
Avatar for _awache _awache
0
170
EMの役割で 変わったこと・変わらなかったこと
Avatar for SansanTech sansantech
PRO
0
130
Digitization部 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
2
7.7k
NANDでも描画したい！
Avatar for nichica nichica906
3
730
Eight Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
3
8.3k
作って理解するCoding Agent 〜フレームワークに頼らないピュア Python での実装〜
Avatar for Takanobu Nozawa takapy
4
1.3k

Featured

See All Featured
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
201
75k
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.8k
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
450
How to build a perfect <img>
Avatar for Jono Alderson jonoalderson
1
5.9k
Navigating Team Friction
Avatar for Lara Hogan lara
192
16k
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
Done Done
Avatar for chrislema chrislema
186
16k
10 Git Anti Patterns You Should be Aware of
Avatar for Lemi Orhan Ergin lemiorhan
PRO
659
62k
Bash Introduction
Avatar for André Augusto Costa Santos 62gerente
615
220k
Darren the Foodie - Storyboard
Avatar for Kevinho.art khoart
PRO
3
3.7k
DBのスキルで生き残る技術 - AI時代におけるテーブル設計の勘所
Avatar for soudai sone soudai
PRO
68
57k
What does AI have to do with Human Rights?
Avatar for Per Axbom axbom
PRO
1
2.3k

Transcript

  1. (JNNFBCJU &YQMPSJOH"UUBDLTJOUIF1PTU9448PSME 5BLBTIJ:POFVDIJ !MNU@TXBMMPX  %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP IUUQTTIJGUKTJOGP

  2. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZ

    PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ 4&$$0/#FHJOOFSTDUGC ‣ 4FDVSJUZ$BNQTFDDBNQ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP  

  3. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF   ‣ 1PTU9448PSME ‣ 2VFTUJPO8IBUDPNFTBGUFS944

     ‣ *OUSPEVDUJPOUP94-FBLTBOE944FBSDI ‣ 0WFSWJFX ‣ &YBNQMFT ‣ 'SBNF$PVOU ‣ 5JNJOH*OGPSNBUJPO ‣ &⒎FDUT.JUJHBUJPO ‣ $PODMVTJPO

  4. 1PTU9448PSME

  5. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC   944 3PBENBQUP1PTU9448PSME .JUJHBUJPO 944FBSDI 94-FBL

    4DSJQUMFTT
 "UUBDL 4DSJQU
 (BEHFUT

  6. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT4JUF4DSJQUJOH
 944 BDPNNPOqBXJO8FCBQQMJDBUJPOT   ‣ .BOZEFWFMPQFSTBOESFTFBSDIFSTIBWFTUSVHHMFEXJUI944

    ‣ .PEFSO8FCGSBNFXPSLTQSPWJEFQSFWFOUJPO ‣ "VUPNBUJDFTDBQJOH ‣ 'PPMQSPPG FHEBOHFSPVTMZ4FU*OOFS)5.-  ‣ 8FCCSPXTFSTBMTPIBWFEFGFOTFMJOFT ‣ $POUFOU4FDVSJUZ1PMJDZ $41  ‣ 944"VEJUPS <?= $_GET['q'] ?>

  7. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC   944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT


    "UUBDL 4DSJQU
 (BEHFUT 3PBENBQUP1PTU9448PSME

  8. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $POUFOU4FDVSJUZ1PMJDZ
 &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ $POUFOU4FDVSJUZ1PMJDZ $41  ‣

    4QFDJpDBUJPOIUUQTXXXXPSH53$41JOUSP ‣ *USFEVDFTUIFIBSNDBVTFECZDPOUFOUJOKFDUJPOBUUBDLT ‣ "QQSPQSJBUFQPMJDJFTSFRVJSFBUUBDLFSTUPNBLFBCVODIPG F⒎PSUTUPFYFDVUF+4TVDDFTTGVMMZ   Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script>

  9. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS
 &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE 944JTGPVOE

    ‣ 5IFSFBSFUXPNPEFT ‣ pMUFS ‣ CMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS  

  10. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC   944 .JUJHBUJPO 944FBSDI 94-FBL 4DSJQUMFTT


    "UUBDL 4DSJQU
 (BEHFUT 3PBENBQUP1PTU9448PSME

  11. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &WPMVUJPOPG944
 4DSJQU(BEHFUT$PEFSFVTJOHTJNJMBSUP301 ‣ &OUIVTJBTUTPG944IBWFUSJFEUPCZQBTT$41 ‣ 0OFPG4PMVUJPOT4DSJQU(BEHFUT -FLJFTFUBM

      ‣ *EFBSFVTFUSVTUFE MFHJUJNBUF TPVSDFDPEFTUPFYFDVUF BSCJUSBSZTDSJQUT DGSFUVSOPSJFOUFEQSPHSBNNJOH 301   <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')>

  12. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4DSJQUMFTT"UUBDLT
 /PUPOMZ+4 CVUBMTP$44IFMQTBUUBDLFST ‣ 3FTFBSDI2VFTUJPO
 *G+4FYFDVUJPOJTSFTUSJDUFE XIBUDBOBUUBDLFSTEP

     ‣ 0OFPG"OTXFST4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM   ‣ #BDLJOIJTUPSZ UIJTDMBTTPGBUUBDLTIBTCFFOJOWFTUJHBUFECZ SFTFBSDIFST BOEXBTPGUFOSFEJTDPWFSFE ‣ 8FMMLOPXO"UUSJCVUFSFBEJOH 'POUMJHBUVSFUFDIOJRVF GPOU SBOHFUFDIOJRVF FUD ‣ /FXSFTFBSDIMJOFJNQPSUSFDVSTJPOUFDIOJRVFT 1FQF7JMB   IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG  

  13. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 94-FBLT944FBSDI
 "UUBDLTBJNJOHUIFQPTU944XPSME ‣ 3FTFBSDI2VFTUJPO
 *TUIFSFZFUBOPUIFSBUUBDLJOHUFDIOJRVFXIFOBEWFSTBSJFT IBWFOPDPOUFOUJOKFDUJPOWVMOFSBCJMJUJFTJOUBSHFUT 

    ‣ "OTXFS:FT ‣ *EFBEBUBUPXIJDIDSPTTPSJHJOBDDFTTJTHSBOUFEIFMQTPOF FTUJNBUFUIFGFBUVSFT DIBSBDUFSJTUJDT PGB)551SFTQPOTF ‣ &YBNQMF FYQMBJOFEMBUFS  ‣ $SPTTTJUF-FBLT 94-FBLT  ‣ $SPTTTJUF4FBSDI 944FBSDI  

  14. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC #"%/0/$&
 54($5' "EEJUJPOBM/PUFT   <?php session_start();

    $nonce = md5(session_id()); $_SESSION['count'] = isset($_SESSION['count']) ? $_SESSION['count'] + 1 : 0; if ($_SESSION['count'] > 3){ setcookie('flag', null, -1, '/'); } ?> <head><meta http-equiv="Content-Security-Policy" content="script-src 'nonce-<?= $nonce ?>';"></head> <body><script nonce=<?= $nonce ?>>/* ... */</script> <?= $_GET['q'] ?> </body> UIFOPODFJTpYFE :PVIBWFUPMFBLDPPLJFT XJUIPOMZUXPSFR

  15. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT
 1PTU9448PSME ‣ *O .JDIBFM;BMFXTLJ !MDBNUVG OPUFEUIBUUIF

    DPMMFDUJPOPGBUUBDLTBMUFSOBUJWFUP944IFQSPWJEFEIBWF BMNPTUTBNFDBQBCJMJUJFTBT944
 1PTUDBSETGSPNUIFQPTU944XPSMEIUUQMDBNUVGDPSFEVNQDYQPTUYTT  ‣ FH3FSPVUJOHPGFYJTUJOHGPSNT ‣ FHIJKBDLSFMBUJWF63-TXJUICBTF ‣ DG3FMBUJWF1BUI0WFSXSJUF ‣ 4FF"STIBE GPSUIFSFBMBOBMZTJT-BSHFTDBMFBOBMZTJTPG TUZMFJOKFDUJPOCZSFMBUJWFQBUIPWFSXSJUF
 IUUQTEMBDNPSHDJUBUJPODGN JE  

  16. *OUSPEVDUJPOUP
 94-FBLTBOE944FBSDI

  17. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF-FBLT
 BLB94-FBLT ‣ $SPTTTJUFMFBLT 94-FBL BSFBGBNJMZPGCSPXTFSTJEF DIBOOFMUFDIOJRVFT

    ‣ 94-FBLBUUBDLTBJNUPDJSDVNWFOUTFDVSJUZDPOUSPMTJO8FC CSPXTFSTCZUXPTUFQT ‣ 3FRVFTUJOH ‣ FHFNCFEEJOHBDSPTTTJUFDPOUFOU FHJGSBNF  ‣ 0CTFSWJOHCSPXTFSTJEFDIBOOFMT ‣ FHBCVTJOHGFBUVSFTPG8FCCSPXTFST FH944"VEJUPS  ‣ 0OFPGUIFVTBHFT$SPTTTJUF4FBSDI 944FBSDI   

  18. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF4FBSDI
 BLB944FBSDI   ‣ $SPTTTJUFTFBSDI 944FBSDI

    BUUBDLJTBLJOEPGBUUBDLT XIJDIBTLTTPNFRVFTUJPOTWJDUJNGSPNBVTFSTCSPXTFSUP B8FCFOEQPJOU ‣ FH*TUIFSFBFNBJMXIJDIDPOUBJOTUIFXPSEBQQMFJOUIF CPEZ GPSBOFNBJMTFSWJDF ‣ FH*OUIFSFBQMBOUPHPTPNFXIFSFUIJTXFFLFOE GPSB DBMFOEBSTFSWJDF ‣ 5IFBOTXFSPGUIFTFSWFSXJMMCFPCUBJOFECZVTJOH94 -FBLT FHSFTQPOTFTJ[FFTUJNBUJPO FUD

  19. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT

  20. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT "OBUUBDLFSMVSFTBVTFSUPB QBHFUIBUJOJUJBUFTSFRVFTUT UPBTFSWJDF

  21. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT /FYU "OBEWFSTBSZJOJUJBUFT EVNNZSFRVFTUTXIPTF SFTQPOTFTBSFLOPXOJOBEWBODF &YBNQMFBSFRVFTUXJUIBTFBSDI RVFSZXIPTFSFTVMUDBOOPUFYJTU

  22. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT "GUFSSFRVFTUJOHEVNNJFT  BOBEWFSTBSZTUBSUTUP JOJUJBUFSFRVFTUTXJUI BDUVBMTFBSDIRVFSJFT %J⒎CFUXFFOEBUB FYQPTFECZ94-FBLGPS EVNNJFTBOEPOFGPS DIBMMFOHFTDPSSFTQPOETUIF EJ⒎CFUXFFOSFTQPOTFT

  23. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT "OBEWFSTBSZSFQFBUTUIF QSPDFTTBOE

  24. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 0VUMJOF944FBSDI /05&)FSFJTTBNFOPUBUJPOBT(FMFSOUFS VTFE   %VNNZ3FRVFTU 3FTQPOTF

    $IBMMFOHF3FRVFTU 3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU
 3FTVMUT "OBEWFSTBSZTFOETUIF DPMMFDUFESFTVMUTGSPN WJDUJNTCSPXTFSTUPJUT PXOTFSWFS

  25. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 6NN JTJUSFBMJTUJD 
 8IBU94-FBLT944FBSDIHJWFTVT   ‣

    6OMJLF944 94-FBLT944FBSDI ‣ EPFTOPUQSPWJEFBDUVBMDPOUFOUTPGEBUB ‣ EVFUP4BNF0SJHJO1PMJDZ ‣ EPQSPWJEFGFBUVSFT DIBSBDUFSJTUJDT PGEBUB ‣ FH8IFUIFSUIFEBUBDPOUBJOTBTQFDJpDWBMVFPSOPU ‣ 3FTQPOTFTXJUITFBSDISFTVMUTIBWFMPOHFSMFOHUIUIBOPOFXJUI OPSFTVMUT ‣ FH8IFUIFSUIFEBUBIBTDPNQMFYJUZPSOPU ‣ $PNQMFYJUZPGUFOSFTVMUTJOMPOHFSQSPDFTTJOHUJNF

  26. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC )JTUPSZ94-FBLT   /PXBEBZT BCVODIPG1P$TBSFCFDPNJOHBWBJMBCMFJOPOMJOF )551$BDIF$SPTT4JUF-FBLT
 IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM

    $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF
 IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB &WBOTQSFTFOUFEUIFQSJNJUJWFGPSNPG944FBSDIXJUI JNHMPBEUJNJOH &WBOT  
 $SPTTEPNBJOTFBSDIUJNJOH
 IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBMHBWFUIFTPQIJTUJDBUFEBUUBDLTGPSTJUFTXJUI TFBSDIFOHJOFTOBNFE944FBSDI (FMFSOUFSFUBM 

  27. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC /PUFT 94-FBLT944FBSDI ‣ 94-FBLTIBWFBUUSBDUFEBUUFOUJPO CVUOPUFOPVHI ‣ #PUIBDDVSBDZBOEF⒎FDUJWFOFTTIBWFCFFOJNQSPWFE

    ‣ 3FGFSFODFT ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF
 IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFS JOGPSNBUJPOCZ1PSU4XJHHFS
 IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO  ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF
 IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT  

  28. &YBNQMF
 'SBNF$PVOU

  29. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC XJOEPXMFOHUI
 "VTFGVMQSPQFSUZGPSDSPTTPSJHJOBUUBDLFST ‣ XJOEPXMFOHUI XJOEPXGSBNFTMFOHUI SFUVSOTUIF OVNCFSPGGSBNFTJOUIFXJOEPX


    2VPUFEIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC"1* 8JOEPXMFOHUI ‣ $SPTTPSJHJOBDDFTTUP XJOEPXMFOHUIJTBMMPXFEVOEFS TBNFPSJHJOQPMJDZ 401 
 4FFIUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNF PSJHJO@QPMJDZ  ‣ $BOUIJTQSPQFSUZCFVUJMJ[FEGPS TPNFLJOETPGBUUBDLT  

  30. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS
 "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO

    3FqFDUFE 944JTGPVOE ‣ 5IFSFBSFUXPNPEFT
 pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS  

  31. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 944"VEJUPS XJOEPXMFOHUI ‣ 8IFOUIFSFJTTQFDJpDDPOUFOUUIBUDBOXBLF944"VEJUPSJO BQBHFBOEUIFQBHFIBT BUMFBTUPOF JGSBNF

     ‣ 8IFO944"VEJUPSCMPDLT XJOEPXMFOHUI ‣ 8IFOOPU XJOEPXMFOHUI ‣ 8FDBOHFUBCJUXIFUIFSUIFTQFDJpDDPOUFOUJT JODMVEFEPSOPUCZUIFQBHFBTMPOHBTUIFDPOUFOUDBO XBLF944"VEJUPS:BZ   <iframe src="..."></iframe> <script>let secret_flag = true;</script>

  32. %&.054($5'
 3&$0/ /05&.PSFTJNQMZ XFDBOEFUFDUUIFXBLFPG944"VEJUPSCZPCTFSWJOHIPX NBOZUJNFTJGSBNFTPOMPBEFWFOUPDDVST
 &YBNQMFD$5'pMFNBOBHFS
 IUUQTHJTUHJUIVCDPNMXJPBFBBFBBDEBDEDBE

  33. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4JEF&⒎FDUTPG#MPDLJOH
 8IBU944"VEJUPSDBVTFT ‣ *G944"VEJUPSCMPDLT  ‣ TPNFQSPQFSUJFTNBZTFFNTUPCFEJ⒎FSFOUGSPNUIFWBMVFT

    XIFOUIFQBHFJTTIPXOVTVBMMZ ‣ *G944"VEJUPSpMUFST  ‣ 1BHFTUSVDUVSFT FTQFDJBMMZUIFqPXPGBQQSPQSJBUF+4 FYFDVUJPOqPX DBOCFCSPLFO  ‣ &YBNQMF9944/JHIUNBSFNPEFBUUBDL944"UUBDLT &YQMPJUJOH944'JMUFS !NBTBUPLJOVHBXB 
 IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS
 IUUQTXXXNCTEKQCMPHIUNM  

  34. &YBNQMF
 5JNJOH*OGPSNBUJPO

  35. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 5JNJOH"UUBDL 8FC 
 "LJOEPGTJEFDIBOOFMBUUBDLT   ‣

    3FTFBSDI2VFTUJPO
 8IBUBUUBDLFSTDBOEPXJUIUJNJOHJOGPSNBUJPO  ‣ 'JSTU*EFB 'FMUFOBOE4DIOFJEFS   ‣ #SPXTFSTDBDIFIBTF⒎FDUTPOUIFMPBEJOHUJNFPGSFTPVSDFT ‣ $BDIFTBSFPGUFOBWBJMBCMFGPSSFTPVSDFTBDDFTTFESFDFOUMZ ‣ )FODF UIFMPBEJOHUJNFSFqFDUTCSPXTJOHIJTUPSZ ‣ 5IFSFBSFUXPWJFXQPJOUT ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH

  36. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC %JSFDU5JNJOH"UUBDL
 #PSU[BOE#POFI $SPTCZFUBM    ‣

    $POEJUJPOT*OGPSNBUJPOUIBUBUUBDLFSTXBOUUPMFBLB⒎FDUTUP TJUFXJEFCFIBWJPS ‣ "UUBDLT ‣ )JEEFOCPPMFBOWBMVFTEBUBTJ[FDBOCFFTUJNBUFEXJUI NFBTVSJOHQSPDFTTJOHUJNF #PSU[BOE#POFI   ‣ 5PUIFCFTUPGNZLOPXMFEHF UIFZBSFUIFpSTUXIPEFTDSJCFEUIF DPODFQUPGEJSFDUUJNJOHBUUBDL ‣ &WFOSFNPUFUJNJOHBUUBDLT BQQSPQSJBUFTUBUJTUJDBMNFUIPET HJWFBUUBDLFSTBDDVSBUFBOBMZTJT $SPTCZFUBM   ‣ 5IFCPYUFTUUIFZQSFTFOUFEBSFPGUFOVTFEJOPUIFSSFTFBSDI

  37. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTTTJUF5JNJOH"UUBDL
 #PSU[BOE#POFI    ‣ "UUBDLT

    ‣ 8JUITFSWFSTJEFUJNJOH ‣ *OJUJBMDPODFQUPG944FBSDIJTCBTFEPOTFSWFSTJEFUJNJOH ‣ &WBOT  NFOUJPOFECFGPSF  ‣ (FMFSOUFSFUBM  NFOUJPOFECFGPSF  ‣ 8JUIDMJFOUTJEFUJNJOH ‣ BMTPLOPXOBTCSPXTFSCBTFEUJNJOHBUUBDLT ‣ &YBNQMFT ‣ $BDIF'FMUFOBOE4DIOFJEFS 7BO(PFUIFNFUBM  ‣ $444UPOF ,PUDIFSFUBM 4NJUIFUBM FUD

  38. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL   ‣

    *EFB ‣ $BDIFTIBWFF⒎FDUTPOQSPDFTTJOHUJNF ‣ "UUBDLT ‣ 5IFpSTUDPODFQUPGUJNJOHBUUBDLJOUIF8FCEFSJWFTGSPN DBDIFCBTFEBUUBDLT 'FMUFOBOE4DIOFJEFS   ‣ 'FBUVSFTJOUSPEVDFEPONPEFSOCSPXTFSTDBOCFOFXTJEF DIBOOFMTUIBUMFUBEWFSTBSJFTNFBTVSFNPSFBDDVSBUFUJNJOH 7BO(PFUIFNFUBM   ‣ FH$BDIF"1* PG4FSWJDF8PSLFS  ‣ FH"QQMJDBUJPO$BDIF

  39. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $MJFOUTJEF5JNJOH  
 BLB#SPXTFSCBTFE5JNJOH"UUBDL   ‣

    *EFB ‣ 3FOEFSJOHIBTBUJHIUSFMBUJPOXJUIBDPOUFOUUPCFSFOEFSFE ‣ &WFOEBUBXIJDIDBOOPUCFUPVDIFEGSPN+4DBOCFSFOEFSFE ‣ "UUBDLT ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF  
 IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG  ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM  
 IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM   
 IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI

  40. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .PSF4PQIJTUJDBUFE0OFT
 1PTTJCMFBUUBDLTXBUDIJOHZPVSFOWJSPONFOUT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMTJEFDIBOOFMBUUBDLT FYQMPJUUJNJOHBOECFIBWJPSEJ⒎FSFODFTUIBUBSF

    QBSUJBMMZ DBVTFEUISPVHINJDSPBSDIJUFDUVSBM PQUJNJ[BUJPOT JF EJ⒎FSFODFTUIBUBSFOPUBSDIJUFDUVSBMMZ EPDVNFOUFE
 4PGUXBSFCBTFE.JDSPBSDIJUFDUVSBM"UUBDLTIUUQTBSYJWPSHBCT  ‣ 3FTFBSDI2VFTUJPOT+BWB4DSJQU XIJDIJTFYFDVUFEJOUIF TBOECPY JTFOPVHIUPCFVTFEGPSNJDSPBSDIJUFDUVSBM BUUBDLT  

  41. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SPN+44BOECPY
 4PGUXBSFCBTFENJDSPBSDIJUFDUVSBMBUUBDLT ‣ 3FTVMUT ‣ 5JNFSTBWBJMBCMFJO+BWB4DSJQUJTFOPVHIGPSBUUBDLFSTUP QFSGPSNNJDSPBSDIJUFDUVSBMBUUBDLT

    4DIXBS[FM  
 'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQU IUUQTHSVTTDDpMFTGBOUBTUJDUJNFSTQEG  ‣ 5IFZEFNPOTUSBUFEBOFX%3".CBTFEDPWFSUDIBOOFMXJUI+4 ‣ ,FZTUSPLFUJNJOHBUUBDLTJOTBOECPYFE+4 -JQQFUBM  
 1SBDUJDBM,FZTUSPLF5JNJOH"UUBDLTJO4BOECPYFE+BWB4DSJQUIUUQTMJOLTQSJOHFSDPNDIBQUFS @  ‣ +45FNQMBUF"UUBDLT 4DIXBS[FUBM  
 +BWB4DSJQU5FNQMBUF"UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE&YQMPJUTIUUQT XXXOETTTZNQPTJVNPSHXQDPOUFOUVQMPBETOETT@#@4DIXBS[@QBQFSQEG ‣ /05&4JUF*TPMBUJPOBOEEJTBCMJOH4IBSFE"SSBZ#V⒎FS DVSSFOUMZ NJUJHBUFUIPTFBUUBDLT  

  42. &⒎FDUT.JUJHBUJPO

  43. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC &⒎FDUTPG94-FBLT
 94MFBLTQSPWJEFBQBSUPGJOGPSNBUJPO OPUUIFXIPMF   ‣ &WFOTFDVSF8FCTJUFTIBWFBQPUFOUJBMUPCFUBSHFUFE

    ‣ &WFOJG)551IFBEFSTBSFTFUTFDVSFMZ ‣ FH3FRVFTUBOE$PORVFS&YQPTJOH$SPTT0SJHJO3FTPVSDF4J[F
 IUUQTUPNWHQBQFSTSFRVFTU@BOE@DPORVFS@VTFOJYQEG ‣ DG6944 ‣ *UOFFETBMPUPGF⒎PSUTUPNJUJHBUFDPNQMFUFMZ  ‣ )BWFZPVFWFSCFFOUIPVHIUBCPVUEBUBMFBLBHFGSPNUJNJOH JOGPSNBUJPO  ‣ /FXQPMJDJFTUPNJUJHBUFUIFNIBWFCFFOEJTDVTTFE CVU

  44. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC .JUJHBUJPO
 8IBUDBOXFEPGPSUIPTFBUUBDLT ‣ "MPUPGTFDVSJUZIFBEFSTBUUSJCVUFT ‣ 4BNFTJUF$PPLJF ‣

    9'SBNF0QUJPOT GSBNFBODFTUPST PG$41  ‣ $SPTT0SJHJO0QFOFS1PMJDZ $001  ‣ $SPTT0SJHJO3FTPVSDF1PMJDZ $031  ‣ $SPTT0SJHJO3FTPVSDF#MPDLJOH $03#  ‣ 'FUDI.FUBEBUB ‣ 4PNFPGUIFNIBWFCFFOTUJMMEJTDVTTFE ‣ ,FFQXBUDIJOHXDXFCBQQTFD JO(JU)VC  

  45. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 4BNFTJUF$PPLJF
 3FTUSJDUJPOPGDPPLJFTVTBHFBUDSPTTTJUFSFRVFTUJOH ‣ 1SPCMFN$SPTTPSJHJOSFRVFTUTXJUIDPPLJFTPGUFODBVTFUIF TFDVSJUZJTTVFTTVDIBT$43' ‣ 4PMVUJPO4BNFTJUF$PPLJF

    ‣ #Z4BNF4JUFBUUSJCVUFTPGDPPLJF TJUFPXOFSTDBOQSPIJCJUT CSPXTFSTGSPNTFOEJOHDSPTTTJUFSFRVFTUTXJUIDPPLJFT ‣ 4BNF4JUF-BY0OMZUPQMFWFMOBWJHBUJPOTJTBMMPXFE ‣ 4BNF4JUF4USJDU/PDSPTTTJUFSFRVFTUXJUIDPPLJFTJTBMMPXFE ‣ 4FF4BNF4JUFDPPLJFTFYQMBJOFE
 IUUQTXFCEFWTBNFTJUFDPPLJFTFYQMBJOFE  

  46. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'SBNJOH3FTUSJDUJPO
 9'SBNF0QUJPOT GSBNFBODFTUPST PG$41 ‣ (FOFSBM1SPCMFN
 3FBM8PSME&YBNQMFTPGUFOSFMJFTPOXJOEPXMFOHUI


    IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ3FBM8PSME&YBNQMFT ‣ $BTFXIFOBQBHFJTGSBNFE CPUIPGUIFQBHF DIJME BOE JUTQBSFOUIBWFSFGFSFODFTUPAXJOEPXAUPFBDIPUIFS ‣ GSPNDIJMEUPQBSFOUXJOEPXQBSFOUPSXJOEPXUPQ ‣ GSPNQBSFOUUPDIJME GSBNF@FMNFOU DPOUFOU8JOEPX ‣ 4PMVUJPOT9'SBNF0QUJPOT GSBNFBODFTUPST PG$41  ‣ 3FTUSJDUJOHDSPTTTJUFGSBNJOHSFEVDFTBUUBDLTVSGBDFT  

  47. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO0QFOFS1PMJDZ
 3FTUSJDUJPOPGVTJOHAXJOEPXASFGFSFODFGSPNPQFOFST ‣ $BTFXIFOXJOEPXPQFOJTFYFDVUFE UIFPQFOFEXJOEPX DBOBDDFTTUPAXJOEPXAPGJUTPQFOFS ‣

    XJOEPXPQFOFSMPDBUJPOIUUQFWJMDPN  ‣ 4PMVUJPO$SPTT0SJHJO0QFOFS1PMJDZ $001  ‣ $SPTT0SJHJO0QFOFS1PMJDZIFBEFSEFpOFTXIFO AXJOEPXPQFOFSAJTBWBJMBCMF ‣ 4FFBOOFWLDPPQNE BTFNJGPSNBMEFpOJUPOPG$001 
 IUUQTHJTUHJUIVCDPNBOOFWLGEEDDGGCEBDGF  

  48. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC $SPTT0SJHJO3FTPVSDF1PMJDZ
 3FTUSJDUJPOPGUIFBWBJMBCMFPSJHJOPGSFTPVSDFT ‣ 1SPCMFN$SPTTPSJHJOOPDPSTSFRVFTUTDBVTFTFDVSJUZ JTTVFTTVDIBTTJEFDIBOOFMBUUBDLT ‣ DG4FSWJDF8PSLFSBCVTF

    7BO(PFUIFNFUBM   ‣ 4PMVUJPO$SPTT0SJHJO3FTPVSDF1PMJDZ $031  ‣ 5IJTIFBEFSQSFWFOUCSPXTFSTGSPNMPBEJOHSFTPVSDFTGFUDIFE CZDSPTT TJUFcPSJHJO OPDPSTSFRVFTUT ‣ /05&GPSNFSMZ UIJTJTDBMMFE'SPN0SJHJO   Cross-Origin-Resource-Policy: same-site | same-origin

  49. ˜TIJGUKTJOGP (JNNFCJU BUMFBTU&YQMPSJOH5FDIOJRVFTPOCJU-FBLBHFJOUIF8FC 'FUDI.FUBEBUB
 *OGPUIBUIFMQTTFSWFSEFUFDUVOVTVBMSFRVFTUTGPSSFTPVSDFT ‣ 1SPCMFN ‣ 4FSWFSTDBOOPULOPXIPXUIFJSSFTPVSDFTXJMMCFVTFE ‣

    4PMVUJPO'FUDI.FUBEBUB ‣ *UXPVMECFIFMQGVMJGTFSWFSTDPVMENBLFNPSFJOUFMMJHFOU EFDJTJPOTBCPVUXIFUIFSPSOPUUPSFTQPOEUPBHJWFO SFRVFTUCBTFEPOUIFXBZUIBUJU`TNBEF IUUQT NJLFXFTUHJUIVCJPTFDNFUBEBUB  ‣ 1SPWJEFEXJUI4FD'FUDI IFBEFST  

  50. 5IBOLZPVGPS-JTUFOJOH  !MNU@TXBMMPX !ZOVDIZ IUUQTTIJGUKTJOGP