[B! <>] Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Itisango id:Itisango

<>ã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Java 8ã‚’å¯èƒ½ã«ã—ãŸJava 7ã®æ©Ÿèƒ½
ã‚ãªãŸã«ã¨ã£ã¦é‡è¦ãªãƒˆãƒ”ãƒƒã‚¯ã‚„åŒåƒšã®æœ€æ–°æƒ…å ±ã‚’å…¥æ‰‹ã—ã¾ã—ã‚‡ã†æœ€æ–°ã®æ´žå¯Ÿã¨ãƒˆãƒ¬ãƒ³ãƒ‰ã«é–¢ã™ã‚‹æœ€æ–°æƒ…å ±ã‚’å³åº§ã«å—ã‘å–ã‚Šã¾ã—ã‚‡ã†ã€‚ ç¶™ç¶šçš„ãªå¦ç¿’ã®ãŸã‚ã«ã€ç„¡æ–™ã®ãƒªã‚½ãƒ¼ã‚¹ã«æ‰‹è»½ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¾ã—ã‚‡ã†ãƒŸãƒ‹ãƒ–ãƒƒã‚¯ã€ãƒˆãƒ©ãƒ³ã‚¹ã‚¯ãƒªãƒ—ãƒˆä»˜ãå‹•ç”»ã€ãŠã‚ˆã³ãƒˆãƒ¬ãƒ¼ãƒ‹ãƒ³ã‚°æ•™æã€‚ è¨˜äº‹ã‚’ä¿å˜ã—ã¦ã€ã„ã¤ã§ã‚‚èªã‚€ã“ã¨ãŒã§ãã¾ã™è¨˜äº‹ã‚’ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã—ã¦ã€æº–å‚™ãŒã§ããŸã‚‰ã„ã¤ã§ã‚‚èªã‚ã¾ã™ã€‚
Itisango 2013/11/13
â€œãƒ¡ã‚½ãƒƒãƒ‰ãƒãƒ³ãƒ‰ãƒ«ã¯ãƒ¡ã‚½ãƒƒãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ãŸã‚ã®ï¼Œåž‹æŒ‡å®šã‚’æŒã£ãŸãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã§ã™ã€‚ (C/C++ã«è©³ã—ã„é–‹ç™ºè€…ãªã‚‰ã°) "ã‚¿ã‚¤ãƒ—ã‚»ãƒ¼ãƒ•ãªé–¢æ•°ãƒã‚¤ãƒ³ã‚¿"ï¼Œã‚ã‚‹ã„ã¯ãƒ¢ãƒ€ãƒ³ãªJavaé–‹ç™ºè€…ãªã‚‰ã° "æ–°åž‹ã®Core Reflection" ã¨è§£é‡ˆã—ã¦ã‚‚ã‚ˆã„

java

<>

Oracle

Java SE 7

Java SE 8

2013å¹´

InfoQ

discussion

programming

language
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: Referreræ–‡å—åˆ—ã«ã‚ˆã‚‹XSS
ãƒªãƒ•ã‚¡ãƒ©ã‚’ä½¿ã£ãŸXSSã®å°ãƒã‚¿ã§ã™ã€‚ ä»Šå›žå–ã‚Šä¸Šã’ã‚‹ã®ã¯ã€ã‚¿ãƒ¼ã‚²ãƒƒãƒˆè‡ªèº«ãŒã€ç´°å·¥ã—ãŸãƒšãƒ¼ã‚¸ã‚’çµŒç”±ã™ã‚‹ã“ã¨ã§ã¤ã‘ã‚‰ã‚ŒãŸãƒªãƒ•ã‚¡ãƒ©ã«ã‚ˆã£ã¦æ”»æ’ƒã‚’å—ã‘ã‚‹ã‚±ãƒ¼ã‚¹ã§ã™ã€‚ã“ã®ã‚ˆã†ãªæ”»æ’ƒã®å ´åˆã¯ã€ç¾å®Ÿã«çµŒç”±å¯èƒ½ãªãƒšãƒ¼ã‚¸ã‹ã‚‰ã§ã—ã‹æ”»æ’ƒæ–‡å—åˆ—ã‚’é€ã‚Šã“ã‚€ã“ã¨ãŒã§ãã¾ã›ã‚“ã€‚ ä¾‹ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ã«ã€document.referrerã‚’ãã®ã¾ã¾document.write()ã—ã¦ã„ã‚‹ãƒšãƒ¼ã‚¸ãŒã‚ã‚‹ã¨ã—ã¾ã™ã€‚ http://vulnerabledoma.in/location/ ãƒªãƒ•ã‚¡ãƒ©ã‚’æ›¸ãå‡ºã—ã¦ã„ã‚‹éƒ¨åˆ†ã§XSSã§ãã‚‹ã§ã—ã‚‡ã†ã‹ã€‚ IEã§ã¯å˜ç´”ã§ã™ã€‚ IEã¯URLã®ã‚¯ã‚¨ãƒªã«ã€ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã›ãšã«ã€Œ"<>ã€ãªã©ã‚’å«ã‚ã‚‹ã“ã¨ãŒã§ãã‚‹ã®ã§ã€ã“ã‚Œã‚‰ã‚’å«ã‚€URLã‹ã‚‰ã€ãƒªãƒ•ã‚¡ãƒ©ã‚’æ›¸ãå‡ºã—ã¦ã„ã‚‹ãƒšãƒ¼ã‚¸ã¸é·ç§»ã•ã›ã‚Œã°ã€XSSãŒèµ·ãã¾ã™ã€‚ http://l0.cm/xss_referrer.html?<script>alert(1)</sc
Itisango 2013/10/29
â€œChromeã‚„Safari(6.1ã§ç¢ºèª)ã§ã‚‚æ”»æ’ƒãŒå¯èƒ½ã ã¨ã„ã†ã“ã¨ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ä»Šæ—¥è¨€ã„ãŸã„ã®ã¯ã“ã“ã§ã™ã€‚ãŸã¶ã‚“ã€ã¾ã èª°ã‚‚å…¬é–‹ã—ã¦ã„ãªã„æ‰‹æ³•ã ã¨æ€ã„ã¾ã™ã€‚â€

<>

2013å¹´

Web

browser

security

XSS

referer

DOM

JavaScript

script
ãƒªãƒ³ã‚¯
ã‚ãªãŸã®çŸ¥ã‚‰ãªã„>|ã¨<>ã®ä½¿ã„æ–¹
>ã‚„>>ã€>&ã¨ã„ã£ãŸã²ã‚“ã±ã‚“ã«ä½¿ã‚ã‚Œã‚‹ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã«å¯¾ã—ã€ã»ã¨ã‚“ã©ä½¿ã‚ã‚Œã‚‹ã“ã¨ã®ãªã„ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆãŒ>|ã¨<>ã ã€‚å®Ÿéš›ã«ã¯èˆˆå‘³æ·±ã„æ©Ÿèƒ½ã§ã‚ã‚‹ã€ã“ã‚Œã‚‰ã€ŒçŸ¥ã‚‰ã‚Œã–ã‚‹ã€ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã«ã¤ã„ã¦èª¬æ˜Žã—ã‚ˆã†ã€‚ï¼ˆç·¨é›†éƒ¨ï¼‰ ã‚ãªãŸã®çŸ¥ã‚‰ãªã„ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã€>|ã¨<> ã‚·ã‚§ãƒ«ãŒæä¾›ã™ã‚‹æ©Ÿèƒ½ã¯ã‚«ãƒ¼ãƒãƒ«ãŒæä¾›ã—ã¦ã„ã‚‹æ©Ÿèƒ½ã‚’ãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã«åˆ©ç”¨ã™ã‚‹ã‚‚ã®ãŒå¤šã„ã€‚ã¤ã¾ã‚Šã€ã‚·ã‚§ãƒ«ã®è¨˜è¿°ãŒãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã«ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã«çµã³ä»˜ãã‚ˆã†ãªæ©Ÿèƒ½ãŒå¤šã„ã¨ã„ã†ã“ã¨ã ã€‚ã‚³ãƒžãƒ³ãƒ‰ã®å®Ÿè¡Œã€ãƒ‘ã‚¤ãƒ—ã€ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆãªã©ã¯ã€ãã£ãã‚Šãã®ã¾ã¾ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã«ç½®ãæ›ã‚ã‚‹ã€‚ ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã§ã‚ã‚Œã°ã€ã»ã¨ã‚“ã©ã®ã‚±ãƒ¼ã‚¹ã§>ãªã„ã—ã¯>>ã§äº‹è¶³ã‚Šã‚‹ã¯ãšã ã€‚2>&1ã¨ã„ã†è¨˜è¿°ã¯ã“ã‚Œã§1ã¤ã®æ©Ÿèƒ½ã«æ€ãˆã‚‹ãŒã€ã“ã‚Œã¯>&ã¨ã„ã†ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã®å…¸åž‹çš„ãªä½¿ã„æ–¹ã®1ã¤ã§ã‚ã‚Šã€ã¤ã¾ã‚Šã¯ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã ã€‚ >ã€>>ã€>&ã¯ã‚ˆãä½¿ã‚ã‚Œã‚‹ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã¨ã„ãˆã‚‹ã€‚ã—ã‹ã—ã€sh(1)ã®ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã«ã¯æ¬¡ã®
Itisango 2012/07/13
shell

ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆ

>

<>

2012å¹´
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (21)

<>ã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (21)

<>ã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

Java 8ã‚’å¯èƒ½ã«ã—ãŸJava 7ã®æ©Ÿèƒ½

Masato Kinugawa Security Blog: Referreræ–‡å­—åˆ—ã«ã‚ˆã‚‹XSS

ã‚ãªãŸã®çŸ¥ã‚‰ãªã„>|ã¨<>ã®ä½¿ã„æ–¹

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (21)

<>ã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

Java 8ã‚’å¯èƒ½ã«ã—ãŸJava 7ã®æ©Ÿèƒ½

Masato Kinugawa Security Blog: Referreræ–‡å—åˆ—ã«ã‚ˆã‚‹XSS

ã‚ãªãŸã®çŸ¥ã‚‰ãªã„>|ã¨<>ã®ä½¿ã„æ–¹

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹