{"provider_url":"https://hatena.blog","width":"100%","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fcysec148.hatenablog.com%2Fentry%2F2021%2F02%2F23%2F231153\" title=\"Reflected XSS into a JavaScript string with angle brackets HTML encoded\u3092\u3084\u3063\u3066\u307f\u305f - Shikata Ga Nai\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","title":"Reflected XSS into a JavaScript string with angle brackets HTML encoded\u3092\u3084\u3063\u3066\u307f\u305f","categories":["PortSwigger"],"blog_title":"Shikata Ga Nai","provider_name":"Hatena Blog","published":"2021-02-23 23:11:53","url":"https://cysec148.hatenablog.com/entry/2021/02/23/231153","author_name":"ThisIsOne","version":"1.0","author_url":"https://blog.hatena.ne.jp/ThisIsOne/","height":"190","image_url":"https://cdn-ak.f.st-hatena.com/images/fotolife/T/ThisIsOne/20210223/20210223221425.png","type":"rich","blog_url":"https://cysec148.hatenablog.com/","description":"Hello there, ('\u03c9')\u30ce HTML\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u533a\u5207\u308a\u7b26\u53f7\u306eJavaScript\u6587\u5b57\u5217\u3067\u53cd\u5c04XSS\u3092\u3002 \u307e\u305a\u306f\u3001\u52d5\u4f5c\u78ba\u8a8d\u304b\u3089\u3002 \u3061\u306a\u307f\u306b\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u898b\u308b\u3068encodeURIComponent() \u95a2\u6570\u304c\u4f7f\u308f\u308c\u3066\u3044\u3066\u3002 \u3053\u306e\u95a2\u6570\u3067\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u306a\u3044\u3082\u306e\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3002 A-Z a-z 0-9 - _ . ! ~ * ' ( ) XSS\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u304c\u5f15\u7528\u7b26\u3067\u56f2\u307e\u308c\u305f\u6587\u5b57\u5217\u30ea\u30c6\u30e9\u30eb\u5185\u306b\u3042\u308b\u5834\u5408\u3060\u3068\u3002 \u6587\u5b57\u5217\u304b\u3089\u629c\u3051\u51fa\u3057\u3066JavaScript\u3092\u76f4\u63a5\u5b9f\u884c\u3067\u304d\u308b\u3053\u3068\u304c\u3088\u304f\u3042\u308b\u306e\u3067\u3002 \u6587\u5b57\u5217\u30ea\u30c6\u30e9\u30eb\u304b\u3089\u629c\u3051\u51fa\u3059\u305f\u3081\u306b\u4e0b\u8a18\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u5165\u529b\u3059\u308b\u3068\u3002 '-alert(1)-' \u30af\u30ea\u30a2\u3067\u304d\u305f\u3002\u2026"}