Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Beginners CTF 2020で学ぶWebセキュリティ(入門編)
Search
Tsubasa
October 18, 2020
11
4.4k
Beginners CTF 2020で学ぶWebセキュリティ(入門編)
2020/10/18 @ SECCON Beginners Live
Tsubasa
October 18, 2020
Tweet
Share
More Decks by Tsubasa
See All by Tsubasa
コンテナとその実行基盤を取り巻くセキュリティの基礎と実践 (セキュリティ・ミニキャンプ オンライン 2021 講義資料) / Fundamentals and Practices of Security around Containers and their Execution Infrastructure
tsubasa_umeuchi
2
2.8k
Featured
See All Featured
BBQ
matthewcrist
85
9.3k
Build The Right Thing And Hit Your Dates
maggiecrowley
32
2.4k
Raft: Consensus for Rubyists
vanstee
136
6.6k
Gamification - CAS2011
davidbonilla
80
5k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
106
49k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
225
22k
Designing on Purpose - Digital PM Summit 2013
jponch
115
6.9k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
25
1.8k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
37
1.8k
It's Worth the Effort
3n
183
27k
The Cost Of JavaScript in 2023
addyosmani
45
6.6k
Transcript
4&$$0/#FHJOOFST 5TVCBTB !4[SOZ #FHJOOFST$5'ͰֶͿ 8FCηΩϡϦςΟ ೖฤ 4&$$0/#FHJOOFST-JWF
#ctf4b കཌྷ 6NFVDIJ5TVCBTB !4[SOZ ॴଐ 4&$$0/#FHJOOFSTӡӦνʔϜ
ઌՊֶٕज़େֶӃେֶઌՊֶٕज़ݚڀՊ 'MBUU4FDVSJUZ*OD ڵຯྖҬ ΫϥΠΞϯταΠυͷ8FCηΩϡϦςΟ N#BB4 ԾԽɾίϯςφٕज़ $MPVE/BUJWF ͡Ίʹ ࣗݾհ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 2 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ͡Ίʹ ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 3 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b Ұൠʹެ։͞Ε͍ͯΔ8FCΞϓϦέʔγϣϯʹରͯ͠ ຊൃදͰઆ໌͢Δ߈ܸख๏Λ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞ ରͱͳΔαʔό8FCΞϓϦέʔγϣϯʹର͢Δ߈ܸ͕ڐՄ͞Ε͍ͯΔ͔Λ ֬ೝ্ͨ͠Ͱࢼ͢Α͏ʹ͍ͯͩ͘͠͞ ిࢠܭࢉػଛյۀࡑ ۀʹ༻͢Δిࢠܭࢉػʹڏِͷใए͘͠ෆਖ਼ͳࢦྩΛ༩͑ ਓͷۀΛͨ͠ऀ
ِܭۀࡑ ِܭΛ༻͍ͯͦͷۀΛͨ͠ऀ ి࣓తهෆਖ਼࡞ग़ٴͼڙ༻ͷࡑ ࣄ࣮ূ໌ʹؔ͢Δి࣓తهΛෆਖ਼ʹ࡞ͬͨऀ ͡Ίʹ ๏తɾྙཧతͳҙࣄ߲ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 4 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ࣭ɾײDUGCʂ ͡Ίʹ ࣭ɾײ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 5 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b "HFOEB ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 6 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 8FC 8PSME8JEF8FC Πϯλʔωοτ্ʹల։͞ΕͨϋΠύʔςΩετࢀরγεςϜ ༷ʑͳϦιʔε͕)551 4 Λ௨ͯ͠ΓऔΓ͞ΕΔ
w )5.-ɺ$44ɺ+BWB4DSJQUɺϚϧνϝσΟΞϑΝΠϧɺ 8FCηΩϡϦςΟ 8FCΞϓϦέʔγϣϯ8FCΫϥΠΞϯτʹର͢Δ߈ܸ͔ΒରΛอޢ͢Δ͜ͱ 8FCΛߏ͢ΔΤίγεςϜʹର͢Δ߈ܸख๏ଟذʹΔ w ΞϓϦέʔγϣϯ্Ͱൃੜ͢Δ߈ܸ42-J 04$J %JS5SBW 443' FUD w ΫϥΠΞϯτ্Ͱൃੜ͢Δ߈ܸ944 $43' 944FBSDI 94-FBLT FUD *OUSPEVDUJPO 8FCͱ8FCηΩϡϦςΟ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 7 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b $5'ʹ͓͚Δ8FC ఏࣔ͞ΕΔ8FCΞϓϦέʔγϣϯʹଘࡏ͢Δ੬ऑੑʹରͯ͠߈ܸΛߦ͍ɺ'MBHΛऔಘ͢Δ 'MBH͕ஔ͞Ε͍ͯΔॴ 8FCαʔό্ʹଘࡏ͢ΔຊདྷΞΫηεͰ͖ͳ͍ͣͷϑΝΠϧ ཧऀݖݶΛ࣋ͭΑ͏ͳϢʔβ͔͠ΞΫηεͰ͖ͳ͍ͣͷϖʔδ
σʔλϕʔεͷϨίʔυ αΠτཧऀͷΫϥΠΞϯτΛͨ͠Ϋϩʔϥͷ$PPLJF *OUSPEVDUJPO $5'ʹ͓͚Δ8FC 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 8 ߈ܸ ᠘ϖʔδʹ༠ಋ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 8FCʹର͢ΔΞϓϩʔν ιʔείʔυ͕͞Ε͍ͯΔ͔൱͔ʹΑͬͯେ͖͘ҟͳΔ ιʔείʔυ͕͞Ε͍ͯΔ߹ ιʔείʔυΛಡΜͰ੬ऑͳ࣮͕ߦΘΕ͍ͯΔՕॴΛ୳͢ ൃݟͨ͠੬ऑੑΛΤΫεϓϩΠτͰ͖ΔΑ͏ͳ߈ܸख๏Λߟ͑ͯ ௐͯ
࣮ߦ͢Δ ιʔείʔυ͕͞Ε͍ͯͳ͍߹ ༷ʑͳϦΫΤετΛૹ৴͢Δ͜ͱͰใऩूΛߦ͏ w ͲͷΑ͏ͳαʔόͰΞϓϦέʔγϣϯ͕ಈ࡞͍ͯ͠Δͷ͔ w ϑΥʔϜͷσʔλͲ͜ʹૹ৴͞ΕɺͲͷΑ͏ʹॲཧ͞ΕΔͷ͔ w ߈ܸ༻ͷσʔλ͕ૹ৴Ͱ͖ͦ͏ͳॴͲ͔͜ ੬ऑͳ࣮͕ߦΘΕ͍ͯΔ ͱߟ͑ΒΕΔ ػೳΛΤΫεϓϩΠτͰ͖ΔΑ͏ͳ ߈ܸख๏Λߟ͑ͯ ௐͯʣ࣮ߦ͢Δ *OUSPEVDUJPO 8FCʹର͢ΔΞϓϩʔν 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 9 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b )551 4 )ZQFS5FYU5SBOTGFS1SPUPDPM w ओʹόʔδϣϯ )551
w DG3'$3'$ 8FCʹ͓͚ΔίϯςϯπͷΓऔΓ ΄ͱΜͲ )551্ͰߦΘΕΔ ϦΫΤετϨεϙϯεͷߏɺϔομʔͷछྨͱҙຯʹ͍ͭͯͷ͕ࣝॏཁ ίϯςϯπ )5.- $44 +BWB4DSJQU FUD ఏڙ͞ΕΔίϯςϯπ͕ಡղͰ͖Ε0, w ಛʹ+BWB4DSJQUʹؔͯ͠ɺ࣮·ͰͰ͖Δͱͳ͓ྑ͍Ͱ͢ αʔόɾΞϓϦέʔγϣϯɾΠϯϑϥ ༷ʑͳݴޠ FH1ZUIPO 1)1 (P /PEFKT Ͱ࣮͞ΕͨΞϓϦέʔγϣϯίʔυͷಡղ ո͍࣮͠ʹؾͮ͘ᄿ֮ 42-ʹΑΔΫΤϦͷߏங 8FCαʔό FHOHJOY Πϯϑϥ FH%PDLFS ͷίϯϑΟάϨʔγϣϯͷಡղ πʔϧ ϩʔΧϧϓϩΩγ FH#VSQ4VJUF 3&45ΫϥΠΞϯτɺ%FW5PPMTΛ͍͜ͳͤΔͱศརͰ͢ *OUSPEVDUJPO 8FCΛղͨ͘Ίʹඞཁͳࣝɾٕज़ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 10 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b *OUSPEVDUJPO #FHJOOFST$5'ͷ݁Ռ 8FC 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 11 ໊ ఆқ ಘ
ղ ςʔϚ Spy Beginner 55pts 441solves ೝূ λΠϛϯά߈ܸ Tweetstore Easy 150pts 150solves SQL Injeciton unzip Easy 188pts 118solves Zip Slip DirTrav profiler Medium 301pts 59solves GraphQL Somen Hard 421pts 20solves CSP Bypassing *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b *OUSPEVDUJPO #FHJOOFST$5'ͷ݁Ռ 8FC 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 12 ໊ ఆқ ಘ
ղ શνʔϜ ςʔϚ Spy Beginner 55pts 441solves ೝূ λΠϛϯά߈ܸ Tweetstore Easy 150pts 150solves SQL Injeciton unzip Easy 188pts 118solves Zip Slip DirTrav profiler Medium 301pts 59solves GraphQL Somen Hard 421pts 20solves CSP Bypassing *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ͡Ίʹ ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 13 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ қ#FHJOOFS QUTTPMWFT w 8FMDPNF FNPFNPFODPEFͷ࣍ʹਖ਼ͷଟ͔ͬͨͰͨ͠ ͷ֓ཁ
ΞϓϦέʔγϣϯͷιʔείʔυͱैۀһͷ໊લ͕ॻ͔ΕͨςΩετϑΝΠϧ͕͞ΕΔ ΞϓϦέʔγϣϯϩάΠϯϖʔδͱճϖʔδ͔Βߏ͞ΕΔ ճϖʔδ͔ΒΞϓϦέʔγϣϯʹొ͞Ε͍ͯΔैۀһΛྻڍͰ͖ΕΫϦΞ ࡞ͷഎܠ 8FCΞϓϦέʔγϣϯʹ͓͚Δ҆શͳೝূใͷอͷͨΊͷख๏Λཧղ͍ͯ͠Δ͔ ॲཧͷ࣌ؒࠩʹىҼ͢Δ੬ऑੑΛൃݟ͢Δ͜ͱ͕Ͱ͖Δ͔ ϩάΠϯܥͷͨ͘͞Μ͋ΔͷͰɺ͋͑ͯϩάΠϯͰ͖ͳͯ͘ղ͚ΔΛ 4QZ ͷ֓ཁ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 14 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 15 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 16 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ ͷιʔείʔυ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 17 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ೝূใ 8FCΞϓϦέʔγϣϯԟʑʹͯ͠ೝূ ͢ͳΘͪϩάΠϯ Λඞཁͱ͢Δ *%ٴͼύεϫʔυʹΑΔೝূ͕ओྲྀ ͠ύεϫʔυΛฏจͰσʔλϕʔεʹอଘ͍ͯ͠Δͱ
ύεϫʔυ࿙Ӯͷࡍʹෆਖ਼ͳϩάΠϯ͕ߦΘΕΔةݥੑ ଞαʔϏεʹύεϫʔυΛ͍·Θ͍ͯ͠Δ߹ɺ ύεϫʔυϦετ߈ܸ͕ޭͯ͠͠·͏ ରࡦ ύεϫʔυอଘ࣌ʹϋογϡؔʹΑΔϋογϡԽΛߦ͏ ϋογϡԽͷࡍʹɺύεϫʔυʹϥϯμϜͳ 4BMU ΛՃ͑Δ w ಉ͡ύεϫʔυͰϋογϡ͕ҟͳΔΑ͏ʹ͢ΔͨΊ ϋογϡԽΛෳճߦ͏ 4USFUDIJOH w ϒϧʔτϑΥʔε߈ܸͷੑΛ࣋ͨͤΔͨΊ 4QZ 8FCΞϓϦέʔγϣϯʹ͓͚Δೝূใͷཧ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 18 ID Password Alice p455w0rd Bob qwerty ... QXSE :JS)% ύεϫʔυ 4BMU ϋογϡؔ FH4)" CFGDCGCDC ࣮ࡍʹ֨ೲ͢Δ ˞ෳճ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ 4USFUDIJOHͱλΠϛϯά߈ܸ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 19 4USFUDIJOHͱॲཧ࣌ؒ ϋογϡؔΛෳճ࣮ߦ͢ΔͷͰ͋Δఔ͕͔͔࣌ؒΔ
FH4)"ͷ߹ w ճTFD w ճTFD w ճTFD w ճTFD λΠϛϯά߈ܸ αΠυνϟωϧ߈ܸͷҰछ ͋Δॲཧͷಈ࡞͔࣌ؒΒຊདྷղੳͰ͖ͳ͍ͣͷใΛղੳ͢Δ w ༨ஊ944FBSDI94-FBLT͜ΕͷҰछ DGIUUQTHJUIVCDPNYTMFBLTYTMFBLT *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ ͷιʔείʔυ ࠶ܝ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 20 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ ͷιʔείʔυͱ͖͢ϙΠϯτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 21 ΞΧϯτ͕ ଘࡏ͢Δʁ 4BMU
4USFUIJOH ݁Ռ͕Ұக ͍ͯ͠Ε ϩάΠϯޭ ଘࡏ͠ͳ͚Ε ऴྃ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ ͷιʔείʔυ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 22 auth.calc_password_hash ͕ؔॏΊͷॲཧΛߦ͍ͬͯΔ ͨͩ͠ɺ͜ͷ͕࣮ؔߦ͞ΕΔͷif
exists ͷ࣌ͷΈ w ͢ͳΘͪɺ8FCΞϓϦέʔγϣϯʹΞΧϯτ͕ଘࡏ͢Δ࣌ͷΈ ͜ͷ࣌ͷॲཧͷ࣌ؒࠩΛར༻ͯ͠ଘࡏ͢ΔΞΧϯτΛྻڍՄೳ w શһͷ໊લͱదͳύεϫʔυͰϩάΠϯΛࢼߦͯ͠ɺ૬ରతʹ͕͔͔࣌ؒΔ͔Ͳ͏͔ΛௐΕྑ͍ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4QZ ͓ΘΓʹ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 23 ͷ·ͱΊ ΞϓϦέʔγϣϯϩάΠϯ࣌ʹ4BMU 4USFUDIJOHΛߦ͍ͬͯͨ
ΞΧϯτ͕ଘࡏ͢Δͱ͖ʹͷΈ֘ॲཧΛ࣮ߦ͍ͯͨͨ͠Ί ΞΧϯτ͕ଘࡏ͢Δ͔൱͔Ͱॲཧ࣌ؒʹࠩҟ͕ൃੜ͍ͯͨ͠ ॲཧ࣌ؒͷࠩҟΛ؍ଌ͢Δ͜ͱͰɺଘࡏ͢ΔΞΧϯτΛྻڍͰ͖ͨ ڭ܇ ηΩϡΞʹ͢ΔͭΓͰߦ͍࣮͕ͬͯͨͱ͖ʹ੬ऑੑΛੜΉ͜ͱ͕͋Δ ߈ܸऀʹରͯ͠ɺؒతʹώϯτΛ༩͑ΔΑ͏ͳ࣮ΛߦΘͳ͍ ࢀߟࢿྉ 0ODFVQPOBUJNFBOBDDPVOUFOVNFSBUJPO w IUUQTTJEFDIBOOFMUFNQFTUTJDPNPODFVQPOBUJNFUIFSFXBTBOBDDPVOUFOVNFSBUJPODGDBDED 94-FBLT w IUUQTHJUIVCDPNYTMFBLTYTMFBLT *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b "HFOEB ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 24 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS қNFEJVN QUTTPMWFT ͷ֓ཁ ΞϓϦέʔγϣϯͷ63-͕ఏࣔ͞ΕΔ ιʔείʔυͳ͠
ΞϓϦέʔγϣϯҎԼͷϖʔδ͔Βߏ͞ΕΔ w ΞΧϯτొɾϩάΠϯϖʔδ w ϓϩϑΝΠϧߋ৽ϖʔδ ϢʔβΞΧϯτొ࣌ʹ͞ΕΔϢʔβݻ༗ͷτʔΫϯΛ༻͍ͯϓϩϑΝΠϧΛߋ৽Ͱ͖Δ ࡞ͷഎܠ (SBQI2-"1*ʹର͢Δ߈ܸख๏Λ͍ͬͯΔ͔ɺ·ͨɺΫΤϦΛ͍͜ͳͤΔ͔ ͋·Γ(SBQI2-ͷΛݟ͔͚ͨ͜ͱ͕ͳ͍ͷͰ QSPpMFS ͷ֓ཁ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 25 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 26 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 27 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 28 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 29 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 30 ͷղ๏ 'MBHΛऔಘ͢ΔͨΊʹBENJOͷUPLFO͕ࣗΞΧϯτʹઃఆ͞Ε͍ͯΔඞཁ͕͋Δ
ͦͷͨΊʹ w BENJOͷUPLFOΛΔඞཁ͕͋Δ w औಘͨ͠BENJOͷUPLFOΛࣗΞΧϯτͷUPLFOʹઃఆ͢Δඞཁ͕͋Δ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b %FW5PPMTͰΞϓϦέʔγϣϯͷ௨৴Λ؍ଌͯ͠ΈΔͱ "1*ʹ+40/ܗࣜͷϦΫΤετΛසൟʹૹ৴͍ͯ͠Δ ಛతͳΩʔϫʔυ͕ϦΫΤετͷϖΠϩʔυʹ༻͍ΒΕ͍ͯΔ w RVFSZ NVUBUJPO ʮRVFSZNVUBUJPOBQJʯͰݕࡧͯ͠ΈΔͱ
(SBQI2- QSPpMFS ͷ͖͔͚ͬͷݟ͚ͭํ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 31 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b (SBQI2- 'BDFCPPL͕։ൃͨ͠"1*ͷن֨ͷҰछ ैདྷͷ8FC"1* ͢ͳΘͪ3&45"1* ͱҟͳΓɺ ୯ҰͷΤϯυϙΠϯτʹରͯ͠ΫΤϦΛૹ৴͢Δ͜ͱͰσʔλΛૢ࡞͢Δ QSPpMFS
(SBQI2-ͷ֓ཁ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 32 VTFST OPUFT (&5 1045 3&45 ૢ࡞ରͷϦιʔε63-Ͱࣝผ͢Δ ૢ࡞ͷํ๏)551ϝιουͰࣔ͢ (SBQI2- ΤϯυϙΠϯτҰ͚ͭͩ ૢ࡞ରͦͷํ๏ΫΤϦͰදݱ͢Δ query { user { ... } } mutation { note { ... } } *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b (SBQI2- 'BDFCPPL͕։ൃͨ͠"1*ͷاըͷҰछ ैདྷͷ8FC"1* ͢ͳΘͪ3&45"1* ͱҟͳΓɺ ୯ҰͷΤϯυϙΠϯτʹରͯ͠ΫΤϦΛૹ৴͢Δ͜ͱͰσʔλΛૢ࡞͢Δ "1*ͷ࣮
"1*͕ѻ͏σʔλͷܕΫΤϦͷεΩʔϚΛࣄલʹఆ͓ٛͯ͘͠ ֤ΫΤϦ͝ͱʹ࣮ࡍͷॲཧΛߦ͏3FTPMWFSΛ࣮͢Δ (SBQI2-ͷΫΤϦ RVFSZσʔλΛऔಘ͢ΔͨΊͷΦϖϨʔγϣϯ w JOUSPTQFDUJPO"1*ͷεΩʔϚใΛऔಘ͢ΔRVFSZ NVUBUJPOσʔλΛॻ͖ࠐΉࡍʹ༻͍ΒΕΔΦϖϨʔγϣϯ TVCTDSJQUJPOσʔλΛϦΞϧλΠϜʹ؍ଌ͢ΔͨΊʹ༻͍ΒΕΔΦϖϨʔγϣϯ w ෦తʹ8FC4PDLFUʹΑΔ௨৴͕༻͍ΒΕΔ QSPpMFS (SBQI2-ͷ֓ཁ ߋʹৄ͘͠ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 33 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS εΩʔϚఆٛͷྫ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 34 εΩʔϚఆٛ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS 3FTPMWFS࣮ͷྫ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 35 RVFSZͷ࣮ NVUBUJPOͷ࣮ DG"SJBEOFu1ZUIPO(SBQI2-4DIFNBpSTU
IUUQTBSJBEOFHSBQIRMPSH *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b *OUSPTQFDUJPO2VFSZʹΑΔεΩʔϚใͷऔಘ ຊདྷศརͳ༷ w ΫϥΠΞϯταΠυ͔Βݺͼग़ͤΔΫΤϦऔಘՄೳͳσʔλͷܕΛϦΞϧλΠϜʹ֬ೝͰ͖Δ ҎԼͷΑ͏ͳ߹ʹɺεΩʔϚใΛऔಘ͞ΕΔͱ߈ܸʹ׆༻͞ΕΔڪΕ͕͋Δ w σʔλܕͷఆٛʹෆཁͳϑΟʔϧυؚ͕·Ε͍ͯΔ
FHϢʔβͷύεϫʔυ w ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦ͕ެ։͞Ε͍ͯΔ *%03 *OTFDVSF%JSFDU0CKFDU3FGFSFODF FHΫΤϦͷҾʹෆਖ਼ͳΛࢦఆ͢Δ͜ͱͰɺຊདྷऔಘͰ͖ͳ͍ͣͷσʔλ͕औಘͰ͖Δ %P4 ॲཧྔ͕ലେʹͳΔΑ͏ͳΫΤϦΛૹ৴͠ɺ"1*ଆͷϦιʔεΛރׇͤ͞Δ /P 42-*OKFDUJPO എޙʹσʔλϕʔε͕ଘࡏ͍ͯ͠Δ߹ɺೖྗ͕దʹॲཧ͞Ε͍ͯͳ͍ͱ ΫΤϦʹಛघจࣈΛૠೖ͢Δ͜ͱͰ /P 42-*OKFDUJPO͕Մೳͳ߹͕͋Δ QSPpMFS (SBQI2-ʹର͢Δ߈ܸख๏ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 36 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b *OUSPTQFDUJPO2VFSZͷྫ DG(SBQI2-$PNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFN w IUUQTNFEJVNDPN!UIFCJMBMSJ[XBOHSBQIRMDPNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJU UIFNGGEDF "1*ʹ͓͍ͯ*OUSPTQFDUJPO2VFSZͷ࣮ߦ͕ڋ൱͞Ε͍ͯͳ͍߹ɺ εΩʔϚใ͕֨ೲ͞Εͨ+40/͕Ϩεϙϯε͞ΕΔ
͜ͷ+40/ɺHSBQIRMWPZBHFSͰՄࢹԽ͢Δ͜ͱ͕Ͱ͖Δ w DGIUUQTHJUIVCDPN"1*THVSVHSBQIRMWPZBHFS QSPpMFS *OUSPTQFDUJPO2VFSZ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 37 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b εΩʔϚใͷՄࢹԽ HSBQIRMWPZBHFSͷ݁Ռ 2VFSZ εΩʔϚใͷղੳ ҎԼͷΑ͏ͳRVFSZͱNVUBUJPO͕ఆٛ͞Ε͍ͯΔ͜ͱ͕͔Δ QSPpMFS
εΩʔϚใͷՄࢹԽͱղੳ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 38 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ͷղ๏ ࠶ܝ 'MBHΛऔಘ͢ΔͨΊʹBENJOͷUPLFO͕ࣗΞΧϯτʹઃఆ͞Ε͍ͯΔඞཁ͕͋Δ ͦͷͨΊʹ w BENJOͷUPLFOΛΔඞཁ͕͋Δ
w औಘͨ͠BENJOͷUPLFOΛࣗΞΧϯτͷUPLFOʹઃఆ͢Δඞཁ͕͋Δ ΞϓϦέʔγϣϯ্͔ΒͦͷΑ͏ͳػೳ؍ଌͰ͖ͳ͍ TPNFPOF VJE*% 6TFS VJEΛҾͱͯ͠6TFSͷσʔλΛऔಘ͢ΔΫΤϦ 6TFSͷεΩʔϚʹUPLFOؚ͕·Ε͍ͯΔ BENJOͷVJEBENJOͰ͋Δ͜ͱ͕(FU'MBHͷϖʔδʹࣔ͞Ε͍ͯΔ VQEBUF5PLFO UPLFO4USJOH #PPMFBO ࣗΞΧϯτͷUPLFOΛߋ৽͢Δϛϡʔςʔγϣϯ BENJOͷUPLFO͕͔͍ͬͯΕɺࣗΞΧϯτͷUPLFOΛBENJOͷUPLFOͰ্ॻ͖Ͱ͖Δ QSPpMFS ͷΞϓϩʔν 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 39 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b someoneΫΤϦͰBENJOͷUPLFOΛऔಘ͢Δ updateTokenϛϡʔςʔγϣϯͰࣗΞΧϯτͷUPLFOΛ্ॻ͖
qBHΫΤϦͰ'MBHΛऔಘ QSPpMFS ղ๏ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 40 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b QSPpMFS ͓ΘΓʹ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 41 ͷ·ͱΊ ΞϓϦέʔγϣϯʹ(SBQI2-"1*͕࣮͞Ε͍ͯͨ
"1**OUSPTQFDUJPO2VFSZΛڋ൱͍ͯ͠ͳ͔ͬͨ "1*ػඍͳσʔλ͕֨ೲ͞ΕͨϑΟʔϧυ JFUPLFO ΛσʔλܕʹؚΊ͍ͯͨ "1*ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦ JFVQEBUF5PLFO Λެ։͍ͯͨ͠ *OUSPTQFDUJPO2VFSZΛૹ৴͢Δ͜ͱͰ͜ΕΒͷใ͕ಘΒΕɺ߈ܸ͕Մೳͩͬͨ ڭ܇ ػඍͳσʔλ͕֨ೲ͞ΕͨϑΟʔϧυΛσʔλܕʹؚΊͯެ։͠ͳ͍ ݺͼग़ͤΔ͖Ͱͳ͍ΫΤϦΛެ։͠ͳ͍ ΫϥΠΞϯταΠυʹ"1*ͷεΩʔϚΛެද͢Δҙਤ͕ͳ͍ͱ͖*OUSPTQFDUJPO2VFSZΛڋ൱͢Δ ࢀߟࢿྉ (SBQI2-c"RVFSZMBOHVBHFGPSZPVS"1* w IUUQTHSBQIRMPSH (SBQI2-$PNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFN w IUUQTNFEJVNDPN!UIFCJMBMSJ[XBOHSBQIRMDPNNPOWVMOFSBCJMJUJFTIPXUPFYQMPJUUIFNGGEDF *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b "HFOEB ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 42 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4PNFO қ)BSE QUTTPMWFT ͷ֓ཁ ΞϓϦέʔγϣϯ 1)1
ͱ8PSLFS Ϋϩʔϥ ͷ࣮͕͞ΕΔ ໊લΛೖྗ͢Δཝͱɺೖྗͨ͠ϖʔδΛ"ENJOͷΫϩʔϥʹ։͔ͤΔػೳ͕ଘࡏ͢Δ "ENJOͷΫϩʔϥͷ$PPLJFʹ'MBH͕֨ೲ͞Ε͍ͯΔ w 944ͷ༧ײ ճʹඞཁͳࣝ 944 3FqFDUFE944%0.CBTFE944 $41ͷجૅ w TDSJQUTSD TUSJDUEZOBNJD CBTFVSJ $41#ZQBTTJOH 4PNFO ͷ֓ཁ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 43 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4PNFO εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 44 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 4PNFO εΫϦʔϯγϣοτ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 45 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ΞϓϦέʔγϣϯͷ࣮ ॏཁͳͱ͜Ζ͚ͩநग़ 4PNFO ࣮ΛݟͯΈΔ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 46 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ
8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ΞϓϦέʔγϣϯͷ࣮ ॏཁͳͱ͜Ζ͚ͩநग़ 4PNFO ࣮ΛݟͯΈΔ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 47 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ
8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b $41 $POUFOU4FDVSJUZ1PMJDZ 944σʔλΠϯδΣΫγϣϯ߈ܸͷϦεΫΛܰݮͤ͞ΔηΩϡϦςΟϨΠϠʔ ಛఆͷ8FCϖʔδʹ͓͍ͯɺಡΈࠐΈ࣮ߦΛڐՄ͢ΔϦιʔεΛ໌ࣔతʹࢦఆͰ͖Δ w ద༻͍ͨ͠ϙϦγʔͷछผΛࣔ͢σΟϨΫςΟϒͱͦΕʹଓ͘Ͱࢦఆ͢Δ
Content-Security-PolicyϔομʔͰ৴͢Δ 4PNFO $41ͷ֓ཁ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 48 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b σΟϨΫςΟϒ ద༻͍ͨ͠ϙϦγʔͷछผΛࣔ͢ ۩ମతͳσΟϨΫςΟϒ໊ʹଓ͍ͯࢦఆ͢Δ 4PNFO $41ͷσΟϨΫςΟϒ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 49
σΟϨΫςΟϒछผ ֓ཁ ྫ Fetch Directives ϦιʔεͷಡΈࠐΈʹؔ͢Δ੍ݶ JavaScript (script-src) Document Directives υΩϡϝϯτͷঢ়ଶʹؔ͢Δ੍ݶ ૬ରURIͷى (base-uri) Navigation Directives φϏήʔγϣϯίϯςΩετʹؔ͢Δ੍ݶ ຒΊࠐΈϑϨʔϜͷ (frame-ancestors) Reporting Directives ϨϙʔτػೳΛఏڙ Ϩϙʔτૹ৴ઌ (report-to) *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b FHscript-srcσΟϨΫςΟϒʹઃఆՄೳͳ 4PNFO $41ͷσΟϨΫςΟϒ TDSJQUTSD 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 50 ҙຯ
'none' JavaScript ͷ࣮ߦΛશͯېࢭ 'self' ࢀরதͷWebϖʔδͱಉҰ Origin Ͱ৴͞Ε͍ͯΔ JavaScript ͷ࣮ߦΛڐՄ 'example.com' example.com ͔Β৴͞Ε͍ͯΔ JavaScript ͷ࣮ߦΛڐՄ 'nonce-<base64 value>' Nonce (͍ࣺͯͷ) ͕Ұக͢Δ JavaScript ͷ࣮ߦΛڐՄ '<hash algo>-<base64 value>' ϋογϡ͕Ұக͢Δ JavaScript ͷ࣮ߦΛڐՄ 'strict-dynamic' Nonce ϋογϡͰ৴པ͞Εͨ JavaScript ͔Βಈతʹ non-"parser-insrted" ͳํ๏ͰಡΈࠐ·Ε͍ͯΔͷΛڐՄ 'unsafe-inline' ΠϯϥΠϯεΫϦϓτͷ࣮ߦΛڐՄ (࣮࣭తʹ XSS ͷରࡦʹͳΒͳ͍ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b TUSJDUEZOBNJD /PODFϋογϡͰ৴པ͞Εͨ+BWB4DSJQU͔Βಈతʹ OPOQBSTFSJOTFSUFEͳํ๏ͰಡΈࠐ·Ε͍ͯΔͷΛڐՄ 4PNFO TUSJDUEZOBNJD 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 51
*OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b 3FqFDUFE944 ߈ܸऀ͕తͱ͢Δ+BWB4DSJQU͕Ϩεϙϯε͞ΕΔΑ͏ͳϦΫΤετΛૹͬͨࡍʹɺ ͦΕ͕ࣹͯ͠λʔήοτͷϒϥβ্Ͱ࣮ߦ͞ΕΔΑ͏ͳ944 ࠓճͷ߹ <title>ʹ$_GET["username"]ͷ༰Λͦͷ··μϯϓ͍ͯ͠Δ FH
username='</title><script>alert(1)</script>' ࠓճͷ߹$41ʹΑΔ੍ݶ͕͋ΔͨΊɺ্هͷ߈ܸϖΠϩʔυͰൃՐ͠ͳ͍ w script-src: 'unsafe-inline' ͕ࢦఆ͞Ε͍ͯͳ͍ͨΊɺΠϯϥΠϯεΫϦϓτͷ࣮ߦڐՄ͞Εͳ͍ 4PNFO 3FqFDUFE944 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 52 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b %0.CBTFE944 +BWB4DSJQU͔Βಈతʹ)5.-Λߏங͍ͯ͠Δ߹ʹൃੜ͢Δ944 ಛఆͷཁૉʹର͢ΔinnerHTMLͷೖΛىͱͯ͠ൃੜ͢Δ ࠓճͷ߹ <p id="message"></p>ͷJOOFS)5.-ʹର͢Δೖ͕ଘࡏ͢Δ
JFೖʹϢʔβ͕ೖྗ͕ͨͦ͠ͷ··ө͞ΕΔ߹ɺ944͕Մೳ w FHusername = '</p><script>alert(1)</script><p>' ࠓճͷ߹$41ʹΑΔ੍ݶ͕͋ΔͨΊɺ্هͷ߈ܸϖΠϩʔυͰൃՐ͠ͳ͍ w script-src: 'unsafe-inline' ͕ࢦఆ͞Ε͍ͯͳ͍ͨΊɺΠϯϥΠϯεΫϦϓτͷ࣮ߦڐՄ͞Εͳ͍ w <script>ϒϩοΫͷ࡞͕parser-insertedͰ͋ΔͨΊɺ'strict-dynamic' ͷ݅ʹҾ͔͔ͬΔ 4PNFO %0.CBTFE944 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 53 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b TFDVSJUZKT <head>ϒϩοΫͷ಄ͰಡΈࠐ·Ε͍ͯΔ+BWB4DSJQU usernameΫΤϦʹඇৗʹݫ͍݅͠ ^[a-zA-Z0-9]*$ Λ՝͠ɺ ҧͨ͠߹error.phpʹڧ੍తʹϦμΠϨΫτͤ͞Δ 4PNFO
TFDVSJUZKT 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 54 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b TFDVSJUZKT͕͋Δͱ͏·͍͔͘ͳ͍ ͋·Γʹೖྗͷ͕݅ݫ͗͢͠ΔͨΊ ͜Ε͕͏·࣮͘ߦ͞Εͳ͍Α͏ʹ͍ͨ͠ ΠϯϥΠϯεΫϦϓτͷ࣮ߦ͕ڐՄ͞Εͳ͍ script-src: 'unsafe-inline'
͕ࢦఆ͞Ε͍ͯͳ͍ͨΊ /PODFͰ৴པ͞Εͨ<script>ϒϩοΫ͔Β͏·͘+BWB4DSJQUΛྲྀ͠ࠐΜͰΔඞཁ͕͋Δ %0.CBTFE944ΛൃՐ͍ͤͨ͞ id="message"ͳཁૉͷinnerHTMLͷೖΛ͏·͘׆༻͍ͨ͠ parser-insertedͳํ๏Ͱ<script>ϒϩοΫΛ࡞࣮ͯ͠ߦ͞Εͳ͍ w id="message" ͳཁૉ͕ͱͱ <script> ϒϩοΫͳΒɺnon-"parser-inserted" ͳͷͰ OK 4PNFO ํ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 55 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b CBTFUBHJOKFDUJPO CBTFλάΛૠೖ͢Δ͜ͱͰ૬ର63*ͷىΛແཧΓ্ॻ͖͢Δ͜ͱ͕Ͱ͖Δɻ w FH <base href="http://hoge.example"> Λૠೖ͢Δͱ http://hoge.example/security.js
͕࣮ߦ͞ΕΔ w ࠓճͷ߹ɺଘࡏ͠ͳ͍υϝΠϯΛదʹࢦఆͯ͠Εɺsecurity.js ͷ࣮ߦΛ્͢Δ͜ͱ͕Ͱ͖Δ ղ๏ ࠓճUJUMFλάͳͷͰɺ͜ΕΛҰ୴ดͯ͡Δඞཁ͕͋Δ JF</title><base href="http://hoge.example"> 4PNFO TFDVSJUZKTΛ࣮ߦͤ͞ͳ͍Α͏ʹ͢Δ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 56 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b %0.$MPCCFSJOHͷ׆༻ id="message"ͳཁૉͷinnerHTMLͷೖΛ͏·͘׆༻͍ͨ͠ w ͏·͘׆༻Ͱ͖ΕɺOPOQBSTFSJOTFSUFEͷ݅ΛΫϦΞͰ͖Δ <script id="message"></script> Λ<p
id="message"></p>ΑΓઌʹ͖࣋ͬͯͯΕ document.getElementById("message")͕<script>Λ͘Α͏ʹͳΔ ղ๏ <script id="message"></script>Λૠೖ͢Δ 4PNFO %0.CBTFE944Λ࣮ݱͤ͞Δ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 57 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ղʹඞཁͳཁૉ CBTFUBHJOKFDUJPOʹΑΔTFDVSJUZKT࣮ߦͷ્ %0.$MPCCFSJOHʹΑΔ%0.CBTFE944ͷൃՐ w 944ʹΑͬͯɺ"ENJOͷΫϩʔϥͷ$PPLJFΛऔ͢Δ ͷ·ͱΊͱڭ܇
$41ʹཔΓ͗͢ͳ͍ w ͋͘·ͰՃతͳηΩϡϦςΟϨΠϠʔͰ͋ΓɺదͳΤεέʔϓॲཧෆՄܽͰ͋Δ ସࡦͰͳ͍ $41ΛͪΌΜͱ͏ w script-src͚ͩͰͳ͘ɺbase-uriconnect-srcదʹΈ߹Θͤͯ͏ඞཁ͕͋Δ w DG$41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN 4PNFO ղ๏ͷ·ͱΊ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 58 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ࠓճͷϖʔδΛ$41&WBMVBUPSͰݟͯΈΔͱ 4PNFO $41&WBMVBUPS 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 59 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ
4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b "HFOEB ൃද༰ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 60 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ8FCʹؔ͢Δ֓ཁ 4QZ 8FCαʔϏεʹ͓͚Δೝূͱύεϫʔυͷ҆શͳཧํ๏ٴͼλΠϛϯά߈ܸʹ͍ͭͯ
QSPpMFS (SBQI2-"1*&YQMPJUBUJPO 4PNFO $POUFOU4FDVSJUZ1PMJDZͱͦͷ#ZQBTTJOHख๏ $PODMVTJPO ຊൃදͷ·ͱΊ *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ
#ctf4b ຊ͓ͨ͠༰ 8FCηΩϡϦςΟͱ$5'ʹ͓͚Δ8FCͷ֓ཁ #FHJOOFST$5'8FCδϟϯϧͷ݁Ռ ֤ͷղઆ w 4QZೝূใͷཧͱλΠϛϯά߈ܸ
w QSPpMFS(SBQI2-&YQMPJUBUJPO w 4PNFO$41#ZQBTTJOH 8FCָ͍͠ ࠓճհͨ͠߈ܸͷςΫχοΫʹର͢ΔΞϓϩʔνͷํ΄ΜͷҰ෦ 8FCʹߋʹ໘നͯ͘ߴͳ߈ܸख๏ٕज़͕ͨ͘͞Μଘࡏ͠·͢ ΄΅ ຖि։࠵͞ΕΔ$5'ʹࢀઓɺόάόϯςΟͰΛຏ͘ɺಓͨ͘͞Μ͋Γ·͢ 5SZ)BSEFS $PODMVTJPO ຊൃදͷ·ͱΊ 4&$$0/#FHJOOFST-JWFc5TVCBTB !4[SOZ 61 *OUSPEVDUJPO 8FCηΩϡϦςΟͱ 8FCͷ֓ཁ 4QZ ೝূใͷཧͱ λΠϛϯά߈ܸ QSPpMFS (SBQI2-"1* &YQMPJUBUJPO 4PNFO $41#ZQBTTJOH $PODMVTJPO ຊൃදͷ·ͱΊ