UTF-7 を使ってスクリプトを記述 +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-+AC8-SCRIPT+AD4- IE は、文字エンコーディングが不明で UTF-7 っぽい文字列があれば、自動判別で UTF-7 となる。
タグ
- すべて
- .emacs (27)
- .zshrc (8)
- 1.6 (5)
- 3 (32)
- 4 (170)
- 4u (4)
- 5 (132)
- ECMAScript (4)
- Ext.js (6)
- Function (4)
- HTC (7)
- JSDeferred (4)
- KeyRemap4MacBook (8)
- TemplateToolkit (6)
- Trapezoid (4)
- actionscript (29)
- agt (5)
- air (7)
- ajax (25)
- akimoto (7)
- algorithm (19)
- amachang (33)
- amazon (7)
- analysis (27)
- animation (7)
- antipop (6)
- anything (16)
- aoki (5)
- apache (21)
- api (18)
- app-engine-patch (4)
- apple (4)
- applescript (20)
- apt (4)
- aptana (9)
- arc (4)
- au (8)
- auth (4)
- autoPagerize (43)
- autohotkey (34)
- backup (12)
- badknowhow (27)
- batch (4)
- benchmark (12)
- blog (21)
- book (42)
- bookmark (12)
- bookmarklet (50)
- brazil (105)
- browser (6)
- bug (26)
- build (4)
- business (5)
- button (4)
- c (26)
- c++ (5)
- cache (10)
- cake (20)
- calendar (8)
- callee (5)
- canvas (4)
- capture (11)
- carbonemacs (14)
- catalyst (133)
- catalystReference (4)
- catalystTutorial (6)
- centos (15)
- charsbar (4)
- charset (8)
- cheatsheet (41)
- chm (13)
- cho45 (33)
- chrome (12)
- class (7)
- clearsilver (5)
- clipboad (11)
- clisp (4)
- closure (7)
- code (16)
- codeRepos (15)
- codingRule (10)
- colinux (39)
- coliss (9)
- color (47)
- command (22)
- comment (10)
- commonlisp (36)
- community (6)
- compare (26)
- compile (4)
- completion (16)
- config (41)
- console (10)
- contextmenu (5)
- cookbook (11)
- cookie (6)
- copyurl (4)
- cpan (130)
- craftworks (5)
- crossBrowser (34)
- crossDomain (4)
- csrf (7)
- css (140)
- cygwin (11)
- daemontool (6)
- dan (26)
- dann (19)
- data (6)
- database (18)
- date (6)
- dbic (32)
- dbix (9)
- debian (57)
- debug (50)
- deffered (13)
- delicious (9)
- demo (8)
- deploy (5)
- design (125)
- development (13)
- developmentenvironment (6)
- dictionary (13)
- diff (10)
- django (18)
- dmaki (8)
- docomo (9)
- document (90)
- dom (10)
- dontEnums (8)
- dotfile (30)
- download (29)
- dreamhost (10)
- eclipse (10)
- editor (11)
- eijiro (7)
- elisp (308)
- emacs (448)
- emacsTips (4)
- emoji (10)
- encode (31)
- english (25)
- environment (30)
- escape (11)
- eto (5)
- eval (9)
- event (33)
- excel (4)
- extension (93)
- extensionDev (32)
- faq (13)
- fastcgi (10)
- fastladder (8)
- fbis (5)
- fedora (5)
- ffmpeg (5)
- filter (5)
- firebug (39)
- firefox (248)
- firefox3 (24)
- flash (50)
- flex3 (5)
- flickr (5)
- flymake (7)
- font (30)
- form (22)
- formValidation (10)
- framework (42)
- free (11)
- functional (5)
- gallery (7)
- game (10)
- gauche (11)
- gdb (6)
- generator (16)
- gigazine (4)
- gist (4)
- git (55)
- github (11)
- gmail (13)
- gnu (5)
- google (29)
- googleAppEngine (16)
- graph (10)
- graphviz (4)
- greasemonkey (195)
- gtd (6)
- h.264 (5)
- hack (14)
- hakobe (6)
- hamachi (5)
- hamachiya2 (4)
- hash (5)
- haskel (4)
- haskell (9)
- hatebu (32)
- hatena (49)
- hide-k (5)
- higepon (10)
- hirose31 (9)
- history (5)
- holidays-l (5)
- home (12)
- hook (4)
- hover (5)
- htaccess (6)
- html (49)
- http (10)
- ibm (6)
- icicles (5)
- icon (6)
- idea (90)
- idiom (4)
- ie (85)
- ie7 (4)
- ie8 (6)
- iframe (6)
- iknow (4)
- image (41)
- imakado (5)
- incremental (5)
- input (8)
- install (156)
- iphone (50)
- irb (10)
- irc (13)
- itunes (11)
- japanese (58)
- java (12)
- javascript (656)
- javascriptBenchmark (4)
- javascriptDebug (7)
- javascriptLibrary (15)
- javascriptMatome (6)
- javascriptReference (16)
- javascriptSample (17)
- javascriptSnippets (17)
- javascriptTool (6)
- javascriptTutorial (18)
- john (18)
- jottit (4)
- jquery (197)
- jqueryMatone (5)
- jqueryPlugin (33)
- jqueryReference (6)
- jquerySample (16)
- jqueryTips (5)
- jqueryTutorial (13)
- jscript (7)
- json (43)
- jsonp (19)
- kawasaki (6)
- kayac (5)
- kazu-yamamoto (8)
- kazuhooku (21)
- keyboad (9)
- keyconfig (11)
- kiwanami (11)
- ku (24)
- kurobox (16)
- language (30)
- launchd (5)
- layout (4)
- ldr (64)
- ldrize (17)
- leopard (19)
- library (95)
- lifehacks (82)
- lightbox (5)
- lighttpd (12)
- linux (76)
- lisp (29)
- list (4)
- load (15)
- locale (5)
- log (14)
- login (4)
- logo (9)
- loop (7)
- macbook (6)
- macports (10)
- mail (17)
- mala (29)
- map (5)
- masuda (4)
- material (16)
- matome (311)
- meadow (24)
- mecab (5)
- mechanize (7)
- memcached (22)
- memory (7)
- merge (4)
- method (4)
- microformats (6)
- microsoft (8)
- migemo (5)
- minibuffer (13)
- mixi (16)
- miyagawa (25)
- mizzy (5)
- mmm-mode (5)
- mobile (88)
- mochikit (20)
- model (6)
- modperl (11)
- module (8)
- money (4)
- moongift (6)
- moose (19)
- movie (25)
- mozilla (23)
- mozrepl (11)
- music (15)
- must (42)
- mvc (9)
- mysql (59)
- nagios (4)
- nanto_vi (18)
- naoya (10)
- nazoking (4)
- neta (27)
- network (9)
- newssite (58)
- niconico (45)
- nishio (5)
- nitoyon (10)
- notice_bukuma (4)
- notice_comment (18)
- official (10)
- onozaty (4)
- oop (12)
- openid (4)
- opera (22)
- opml (7)
- oreilly (5)
- org-mode (10)
- os0x (11)
- osx (131)
- otsune (21)
- package (9)
- parser (13)
- patch (11)
- paulgraham (5)
- pdf (6)
- pear (4)
- performance (107)
- perl (438)
- perlDebug (7)
- perlLibrary (5)
- photo (37)
- photoshop (26)
- php (133)
- php-completion.el (4)
- pixiv (9)
- plagger (91)
- player (6)
- plugin (76)
- podcast (4)
- point (26)
- post (5)
- presentation (44)
- programmer (7)
- programming (25)
- prototype (52)
- proxy (13)
- putty (13)
- python (24)
- quicksilver (10)
- quiz (5)
- rails (26)
- reading (12)
- reblog (4)
- reference (128)
- regexp (44)
- reload (7)
- remedie (8)
- repo (5)
- review (5)
- rexml (8)
- rpm (7)
- rss (18)
- rubikitch (20)
- ruby (97)
- safari (20)
- sakura (6)
- samba (6)
- sample (136)
- save (46)
- scheme (32)
- schwartz (10)
- scraping (9)
- screen (51)
- screencast (15)
- screenshot (9)
- script.aculo.us (5)
- sdic (5)
- search (38)
- searchengine (5)
- secondlife (26)
- security (89)
- selenium (9)
- seo (14)
- server (37)
- setTimeout (5)
- sfujiwara (5)
- shell (36)
- shortcuts (17)
- simple (6)
- siteinfo (8)
- skype (9)
- sleipnir (11)
- slime (8)
- smarty (15)
- snippet (101)
- snippet.el (6)
- sort (11)
- sound (10)
- source (14)
- sql (17)
- sqlite (17)
- ssh (26)
- study (17)
- subversion (53)
- svk (20)
- svn (9)
- symfony (24)
- table (10)
- taguchi (5)
- tako3 (6)
- template (27)
- tenjinweb (5)
- teramako (6)
- terminal (6)
- test (48)
- text (8)
- textarea (6)
- textmate (6)
- tip (13)
- tips (384)
- tksk (5)
- tmp (22)
- tokuhirom (22)
- tombloo (27)
- tomita (7)
- tool (87)
- tools (115)
- trac (23)
- tramp (7)
- translation (29)
- trouble (5)
- tumblr (40)
- tutorial (103)
- twitter (64)
- typester (9)
- ubuntu (29)
- ui (57)
- unicode (37)
- unix (8)
- upload (6)
- uri (10)
- user.js (12)
- userdata (5)
- userscript (6)
- userstyle (9)
- ustream (6)
- utf-8 (7)
- validate (11)
- version (7)
- via (84)
- view (13)
- vim (28)
- vimperator (35)
- vmware (6)
- vnc (9)
- w3c (6)
- web (7)
- webService (92)
- webkit (5)
- webscraper (22)
- wedata (7)
- wiki (47)
- wikipedia (7)
- win32 (5)
- window (17)
- windows (36)
- windowsMatome (6)
- windowsPerformance (6)
- windowsSoftware (17)
- wsh (11)
- xhr (12)
- xming (10)
- xml (20)
- xpath (37)
- xpcom (12)
- xs (7)
- xss (19)
- xul (7)
- xwindow (7)
- xyzzy (5)
- yahoo (10)
- yaml (11)
- yapc (6)
- yappo (28)
- yasnippet (7)
- yomimono (95)
- youtube (7)
- yui (13)
- yum (6)
- zend (37)
- zigorou (19)
- zsh (53)
- 形態素解析 (9)
- javascript (656)
- emacs (448)
- perl (438)
- tips (384)
- matome (311)
- elisp (308)
- firefox (248)
- jquery (197)
- greasemonkey (195)
- 4 (170)
unicodeとxssに関するIMAKADOのブックマーク (2)
-
IMAKADO 2007/11/16
- security
- unicode
- xss
- javascript
リンク -
セキュアプログラミング・テクニック
本ページは、このようなセキュリティ上の問題が存在する事を衆知徹底させる事を目的とする。 衆知徹底する事で、すべてのコンピュータ・ソフトウェアからこのセキュリティ問題を駆逐し、コンピュータ・ソフトウェア環境をより安全なものとなる事を期待する。 Link IPA ISEC セキュア・プログラミング講座 IPA ISEC セキュア・プログラミング講座2 書籍「セキュアWebプログラミング Tips集」 JPCERT/CC クリックジャッキング対策 ～X-FRAME-OPTIONSについて～ WizardBible 45 (SSL の負荷試験記事あり)、[seasurfers:0843] も併せて読むとよい 脆弱性体質の改善 - C/C++セキュアコーディング入門 (1) 脆弱性体質の改善 - C/C++セキュアコーディング入門 (2) 脆弱性体質の改善 - C/C++セキュアコーディング入門 (
-
1
公式Twitter
- @HatenaBookmark
リリース、障害情報などのサービスのお知らせ
- @hatebu
最新の人気エントリーの配信
処理を実行中です
キーボードショートカット一覧
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
設定を変更しましたx