Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
ブラウザのUIのバグを探す / Secusoba PopUnder
Search
Masato Kinugawa
November 26, 2017
Technology
2
2k
ブラウザのUIのバグを探す / Secusoba PopUnder
第40回セキュそば勉強会(
http://secusoba.info/?%E7%AC%AC40%E5%9B%9E%2811%E6%9C%8825%E6%97%A5%29
) で発表した資料です。
Masato Kinugawa
November 26, 2017
Tweet
Share
More Decks by Masato Kinugawa
See All by Masato Kinugawa
注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3
masatokinugawa
8
2.9k
バグハンティングのすゝめ / P3NFEST
masatokinugawa
5
1.8k
Pwn2OwnでMicrosoft Teamsをハッキングして2000万円を獲得した方法/ Shibuya.XSS techtalk #12
masatokinugawa
13
17k
How I Hacked Microsoft Teams and got $150,000 in Pwn2Own
masatokinugawa
0
19k
JSでDoSる/ Shibuya.XSS techtalk #11
masatokinugawa
21
6.6k
Electron: Abusing the lack of context isolation - CureCon(en)
masatokinugawa
5
95k
Electron: Context Isolationの欠如を利用した任意コード実行 / Electron: Abusing the lack of context isolation - CureCon(ja)
masatokinugawa
9
24k
バグハンターが見てきたBug Bountyの7年 / LINE Developer Meetup #34 Security Bug Bounty
masatokinugawa
18
12k
5文字で書くJavaScript/ Shibuya.XSS techtalk #10
masatokinugawa
35
20k
Other Decks in Technology
See All in Technology
Our Journey from in-House CD System to Open Source
ffjlabo
0
100
GraphQLとスキーマファーストで切り開く ライドシェアの未来
ku0522a
0
490
疎通2024
sadnessojisan
4
490
AWS IAM Identity Center議論会 〜 認証認可結合モデルと認証認可分離モデル / 20240827-jawsug-arch-iam_identity_center
opelab
3
320
プロデザ! BY リクルートvol.22_様々なプロダクト経験の中で活きたPdMのスキル
recruitengineers
PRO
3
170
ことばをそろえる / Bridging the Terminology Gap
amaotone
5
1k
バックログを導入し やっぱやめた話
ota42y
0
170
OCI コスト管理
ocise
1
110
Dify - LINE Bot連携 考え方と実用テクニック
uezo
5
1.1k
実践的なバグバウンティ入門
scgajge12
4
2.1k
Dive Deep in Cloud Run: Automatic Base Image update
aoto
PRO
0
900
New Relicで実践する外形監視
aeonpeople
1
120
Featured
See All Featured
In The Pink: A Labor of Love
frogandcode
139
22k
WebSockets: Embracing the real-time Web
robhawkes
59
7.3k
What's in a price? How to price your products and services
michaelherold
241
11k
Designing for Performance
lara
604
68k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
190
16k
Into the Great Unknown - MozCon
thekraken
28
1.4k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
41
6.4k
Building Better People: How to give real-time feedback that sticks.
wjessup
359
18k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
662
120k
Testing 201, or: Great Expectations
jmmastey
35
6.9k
The Pragmatic Product Professional
lauravandoore
30
6.2k
Optimizing for Happiness
mojombo
375
69k
Transcript
None
None
None
• • •
•
• •
None
• • newWin = window.open('//example.com/','w','a'); newWin.blur();//新しいウインドウのフォーカスを離す window.focus();//親にフォーカスを移す
• •
• https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
None
None
None
None
None
confirm(1);
prompt(1);
print();
//Basic認証
//外部アプリを開くプロトコルへナビゲーション location = "mms:";
onbeforeunload=function(e){return 1;} //どこかへ移動しようとするとダイアログ出現
new PresentationRequest("").start();
new PaymentRequest([{ supportedMethods: ['basic-card'] }], { total: { label: 1,
amount: { currency: 'USD', value: 0 } } }).show();
navigator.usb.requestDevice({filters:[]});
<form> <input type="email" value="a"> <button id="button"> </form> <script> button.click(); </script>
• • • • • •
<script> function popUnder() { new PresentationRequest("").start(); window.open("https://example.com/", "_blank","a"); setTimeout(function(){ location.reload();//リロードでダイアログを消す
},1000); } </script> <button onclick="popUnder()">Create PopUnder</button>
None
• • • • • • •
• • • • •
• •
• • •
None