{"categories":["Web Security Academy","Prototype pollution"],"published":"2025-09-17 06:42:53","url":"https://cysec148.hatenablog.com/entry/2025/09/17/064253","image_url":null,"author_url":"https://blog.hatena.ne.jp/ThisIsOne/","blog_title":"Shikata Ga Nai","height":"190","blog_url":"https://cysec148.hatenablog.com/","provider_url":"https://hatena.blog","version":"1.0","author_name":"ThisIsOne","width":"100%","provider_name":"Hatena Blog","type":"rich","description":"Hello there, ('\u03c9')\u30ce 1. \u6982\u8981\uff1a\u30ac\u30b8\u30a7\u30c3\u30c8\u3068\u306f\u4f55\u304b\uff08\u5fa9\u7fd2\uff09 \u30d7\u30ed\u30c8\u30bf\u30a4\u30d7\u6c5a\u67d3\u305d\u306e\u3082\u306e\u306f\u300cObject.prototype \u306b\u30d7\u30ed\u30d1\u30c6\u30a3\u3092\u8ffd\u52a0\u3067\u304d\u308b\u72b6\u614b\u300d\u3002 \u3067\u3082\u5b9f\u5bb3\u306b\u3059\u308b\u306b\u306f \u30ac\u30b8\u30a7\u30c3\u30c8\uff08gadget\uff09 \u304c\u5fc5\u8981\uff1a\u30a2\u30d7\u30ea\u304c\u305d\u306e\u30d7\u30ed\u30d1\u30c6\u30a3\u3092\u691c\u8a3c\u7121\u3057\u3067\u8aad\u307f\u53d6\u308a\u3001\u5371\u967a\u306a\u4f7f\u3044\u65b9\uff08\u4f8b\u3048\u3070 innerHTML \u306b\u653e\u308a\u8fbc\u3080\u3001script.src \u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u3001eval \u306b\u6e21\u3059\u7b49\uff09\u3092\u3059\u308b\u7b87\u6240\u3067\u3059\u3002 \u30ac\u30b8\u30a7\u30c3\u30c8\u3092\u898b\u3064\u3051\u308b\u3053\u3068\uff1d\u8106\u5f31\u6027\u3092\u201c\u5b9f\u5bb3\u201d\u306b\u5909\u3048\u308b\u9375\u3001\u3067\u3059\u3002 2. \u624b\u52d5\u3067\u30ac\u30b8\u30a7\u30c3\u30c8\u3092\u898b\u3064\u3051\u308b\u30b9\u30c6\u30c3\u30d7\uff08\u8a73\u7d30\u30fb\u5b9f\u8df5\u5411\u3051\uff09 \u6e96\u5099\uff08Burp \u306e\u30d6\u30e9\u30a6\u30b6\u3092\u4f7f\u3046\u60f3\u5b9a\uff09 Burp \u3092\u4f7f\u3048\u308b\u3053\u3068\uff08Prox\u2026","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fcysec148.hatenablog.com%2Fentry%2F2025%2F09%2F17%2F064253\" title=\"\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5074 Prototype Pollution \u306e\u898b\u3064\u3051\u65b9\u3068\u30ac\u30b8\u30a7\u30c3\u30c8\u767a\u898b\uff08DOM Invader \u3068\u624b\u52d5\uff09 - Shikata Ga Nai\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","title":"\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5074 Prototype Pollution \u306e\u898b\u3064\u3051\u65b9\u3068\u30ac\u30b8\u30a7\u30c3\u30c8\u767a\u898b\uff08DOM Invader \u3068\u624b\u52d5\uff09"}