Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
脆弱性を作ってみた
Search
Sota Sugiura
December 22, 2016
Technology
1
560
脆弱性を作ってみた
雑兵MeetUp #8@21cafe
Sota Sugiura
December 22, 2016
Tweet
Share
More Decks by Sota Sugiura
See All by Sota Sugiura
内製したSlack Appで頑張るIncident Response@Waroom Meetup #1 / Incident Response with Slack App in 10X
sota1235
0
1.6k
20220926_セキュリティチームの今_for_Drs._Prime_公開用.pdf
sota1235
0
130
再発防止策を考える技術 / #phpconsen
sota1235
10
3.9k
How to choose the best npm module for your team?
sota1235
9
600
Realtime Database for high traffic production application
sota1235
7
4k
Road to migrate JP Web as a microservice
sota1235
4
1.6k
インターフェース再入門 / Think Interface again
sota1235
6
11k
再発防止策を考える技術 #phpconfuk_rej
sota1235
1
1.2k
Update around Firebase #io18
sota1235
3
4.3k
Other Decks in Technology
See All in Technology
Yamla: Rustでつくるリアルタイム性を追求した機械学習基盤 / Yamla: A Rust-Based Machine Learning Platform Pursuing Real-Time Capabilities
lycorptech_jp
PRO
4
190
KiCadでPad on Viaの基板作ってみた
iotengineer22
0
210
2025-06-26_Lightning_Talk_for_Lightning_Talks
_hashimo2
2
120
あなたの声を届けよう! 女性エンジニア登壇の意義とアウトプット実践ガイド #wttjp / Call for Your Voice
kondoyuko
4
520
低レイヤを知りたいPHPerのためのCコンパイラ作成入門 完全版 / Building a C Compiler for PHPers Who Want to Dive into Low-Level Programming - Expanded
tomzoh
4
3.4k
ビギナーであり続ける/beginning
ikuodanaka
3
510
ネットワーク保護はどう変わるのか?re:Inforce 2025最新アップデート解説
tokushun
0
160
WordPressから ヘッドレスCMSへ! Storyblokへの移行プロセス
nyata
0
350
AWS Summit Japan 2025 Community Stage - App workflow automation by AWS Step Functions
matsuihidetoshi
1
310
ドメイン特化なCLIPモデルとデータセットの紹介
tattaka
2
540
Witchcraft for Memory
pocke
1
680
無意味な開発生産性の議論から抜け出すための予兆検知とお金とAI
i35_267
2
4.7k
Featured
See All Featured
Faster Mobile Websites
deanohume
307
31k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
130
19k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.8k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
229
22k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
194
16k
Building Applications with DynamoDB
mza
95
6.5k
The Cost Of JavaScript in 2023
addyosmani
51
8.5k
Mobile First: as difficult as doing things right
swwweet
223
9.7k
Fireside Chat
paigeccino
37
3.5k
Become a Pro
speakerdeck
PRO
28
5.4k
The Art of Programming - Codeland 2020
erikaheidi
54
13k
Music & Morning Musume
bryan
46
6.6k
Transcript
੬ऑੑΛ࡞ͬͯΈͨ !TPUB͖ΓΜ ࡶฌ.FFU6Q
ࣗݾհ w ͖ΓΜͰ͢ w !TPUB w ໌͔Βࢮͷ͕ؒ࢝·Γ· ͕͢Έͳ͞ΜਐḿͲ͏Ͱ͔͢
੬ऑੑΛ࡞ͬͪΌͬͨͰͳ͘ ࡞ͬͯΈͨͰ͢ ̃䯡ՙ☭岩ՙՊլՖ㈕ՙՊլ
߈ܸຊೳͷ w ਓਐԽ͢ΔલԐͩͬͨ w ՐΛ͍ɺಓ۩Λ͍ɺङΓΛߦ͏͜ͱͰੜ͖ Ԇͼ͖ͯͨ w ߈ܸ͢Δ͜ͱͱੜ͖Δ͜ͱͦͷͷ
ਓੜJT ԐͷγϦʔζΑΓ
ϓϩάϥϚʹ͓͚Δ߈ܸຊೳ w ϓϩάϥϚਓؒ w વɺ߈ܸຊೳΛඋ͍͑ͯΔ w ࣮ϓϩάϥϚͱ߈ܸੑີʹؔͯ͠Δͱ ݴΘΕ͍ͯΔ
·͊ӕͳΜͰ͚͢Ͳ IUUQKJHPLVOPDPNFJE@IUNM
·͊ӕͳΜͰ͚͢Ͳ Ͱ૽ͳਓ͕ଟ͍ؾ͠·͢ΑͶ IUUQKJHPLVOPDPNFJE@IUNM
ݱ࣮ݫ͍͠ IUUQTUXJUUFSDPNIULC@TUBUVT
ݱ࣮ݫ͍͠ IUUQTUXJUUFSDPNIULC@TUBUVT
ఘΊΔ͔͠ແ͍ͷ͔ w ߹๏తʹ߈ܸຊೳΛຬͨ͢ํ๏͕ʜ w ͋Γ·͊ SZ
$BQUVSF 5IF 'MBH
$BQUVSF5IF'MBH w ضऔΓ߹ઓ w αʔόʹ৵ೖͨ͠ΓηΩϡϦςΟʹ·ͭΘΔ Λղ͍ͯضΛऔΔ w 4&$$0/ͱ͔༗໊Ͱ͢ΑͶ
ຊ w ઌɺ͚ʹ$5'Λͬͨ w ඍົʹܦݧ͕͋ͬͨͷͰ࡞Γͱ͔ͬͨ
༷ࢠ
༷ࢠ
ग़δϟϯϧΛܾΊΔ w $5'ͷकඋൣғΊͪΌͪ͘Όେ w ҉߸ ϑΝΠϧղੳ ωοτϫʔΫ 8FC 'PSFOTJDT
QXO FUD w ࠓճ8FCͷਓ͕ଟ͔ͬͨͷͰ8FCଟΊʹͨ͠
Λߟ͑Δ w ͱ͍ͬͯࢲॳ৺ऀͳͷͰաڈͱ͔੬ऑੑ Λௐͳ͕Βߟ͑Δ w ͓͠Ζ͔ͬͨΓֶͼʹͳΓͦ͏ͳͷ͕͋Ε ࠾༻͍ͯ͘͠
Λߟ͑Δ
γφϦΦΛҙࣝ͢Δ w ͜Μͳ੬ऑੑ͕͋ͬͨΒ͜Μͳ͜ͱ͕Ͱ͖ͪΌ ͏ΑͶɺΈ͍ͨͳͷΛߟ͑Δ
Կݸ͔հ
ྫ͑ψϧόΠτ߈ܸ w /6--จࣈΛจࣈྻͷऴจࣈͱͯ͠ೝࣝ͢Δ ͜ͱΛར༻ͨ͠߈ܸ w ࠓճ1)1Ͱ࣮ͨ͠
ψϧόΠτ߈ܸ <?php $filename = $_GET['filename'].'png'; echo file_get_contents($filename);
ψϧόΠτ߈ܸ <?php $filename = $_GET['filename'].'png'; echo file_get_contents($filename); // /index.php?filename=/etc/passwd //
Ͱ.png͕अຐͦ͏…
ψϧόΠτ߈ܸ w ͓ΉΖʹJOEFYQIQ pMFOBNFUD QBTTXEʹΞΫηε͢Δ w ͢ΔͱpMF@HFU@DPOUFOUTΛऴจࣈͱ ͯ͠ೝࣝ͢ΔͷͰQOH͕ࣺͯΒΕΔ
ψϧόΠτ߈ܸ <?php $filename = $_GET['filename'].'png'; echo file_get_contents($filename); // /index.php?filename=/etc/passwd%00 //
ϢʔβҰཡൈ͚Δͧʂ
ྫ͑/P42-*OKFDUJPO w υΩϡϝϯτ%#Ͱى͖͏Δ੬ऑੑ w 1)1 NPOHP%#Ͱ࣮Ͱ͖Δ
/P42-ΠϯδΣΫγϣϯ <?php $name = $_GET['name']; return $db->find(['name' => $name]); //
/index.php?name=kirin
/P42-ΠϯδΣΫγϣϯ <?php $name = $_GET['name']; return $db->find(['name' => $name]); //
/index.php?name[$ne]=xͬͯΔͱ…
ྫ͑/P42-*OKFDUJPO w 1)1Ͱ(&5ΫΤϦετϦϯάΛ࿈ྻͰड ͚औΕΔ w OBNF<OF>YͬͯΔͱҎԼͷΑ͏ͳ͕ ͬͯ͘Δ
ྫ͑/P42-*OKFDUJPO w ͜ͷΫΤϦ͕ͦͷ··NPOHPʹΔͱ42-Ͱ ݴ͏ͱ͜Ζͷ8)&3&OBNFbY`ͱ͍͏݅ ཱ͕ͯ͠͠·͏
ͳΜͰ1)1͔ͬΓ͔ͬͯʁ w ؾ͍ͯ͠·ͬͨਓফ͞ΕΔͷͰؾ͔ͮͳ͍ ϑϦΛ͠·͠ΐ͏Ͷ ?Т? w 1)1Yd͓͏ɺܑ͓͞Μͱͷଋͩ ?Т?
ଞʹʜ w ύεϫʔυ͖ͭ;*1ղੳ w %JHFTU#BTJDBVUIFOUJDBUJPO w 944 w ҉߸ղੳ 305ͱ͔୯Ұࣈࣜͱ͔
ਅ໘ͳ w ࡞͢Δʹͭͷࢹ͕ඞཁ w ߈ܸऀࢹ w ։ൃऀࢹ w ʮప໌͚ʹ։ൃͯͨ͠ΒΪϦΪϦ͋Γ͏ΔʯΈ ͍ͨͳͭΛ࡞Δͷָ͍͠͠ษڧʹͳΔΑ
·ͱΊɿ$5'͠Α͏ w ߹๏తʹ߈ܸຊೳΛຬͨͤΔͷͰΦεεϝ w 8FCʹݶΒͣ෯͍ࣝΛٻΊΒΕΔͷͰษڧ ʹͳΔ w ৗறܕ$5'͋ΔͷͰڵຯ͕͋Δํͥͻ