投稿時間:2022-11-19 13:06:33 RSSフィード2022-11-19 13:00 分まとめ(8件)

カテゴリー等	サイト名等	記事タイトル・トレンドワード等	リンクURL	頻出ワード・要約等/検索ボリューム	登録日
IT	ITmedia 総合記事一覧	[ITmedia Mobile] 2014年に生まれたY!mobile　それまではどんな会社？	https://www.itmedia.co.jp/mobile/articles/2211/19/news032.html	itmediamobile	2022-11-19 12:30:00
AWS	AWS Big Data Blog	Introducing ACK controller for Amazon EMR on EKS	https://aws.amazon.com/blogs/big-data/introducing-ack-controller-for-amazon-emr-on-eks/	Introducing ACK controller for Amazon EMR on EKSAWS Controllers for Kubernetes ACK was announced in August and now supports AWS service controllers as generally available with an additional in preview The vision behind this initiative was simple allow Kubernetes users to use the Kubernetes API to manage the lifecycle of AWS resources such as Amazon Simple Storage Service Amazon …	2022-11-19 03:19:16
js	JavaScriptタグが付けられた新着投稿 - Qiita	JavaScriptを始めてみます	https://qiita.com/monouge/items/b1a71acecdf6cf4536dd	javascript	2022-11-19 12:39:11
AWS	AWSタグが付けられた新着投稿 - Qiita	【AWS】マイクロサービスを支える２つのサービス(AWS Cloud Map編)	https://qiita.com/kaburagi_/items/c97c16a0ad842436667b	awscloudmap	2022-11-19 12:59:31
海外TECH	DEV Community	Portswigger’s lab write up: Clickjacking with a frame buster script	https://dev.to/christianpaez/portswiggers-lab-write-up-clickjacking-with-a-frame-buster-script-3eap	Portswigger s lab write up Clickjacking with a frame buster scriptIn this apprentice level lab we will exploit the change email flow from a website vulnerable to clickjacking via URL parameters even though there is a frame buster script enabled Upon logging in with the given credentials we notice that after going to the account page all that is needed to change a user s email is click on the Update Email button and that the email can be prefilled via URL parameters Let s use the writing material s clickjacking template to craft our exploit lt head gt lt style gt iframe position relative width px height px opacity z index div position absolute z index lt style gt lt head gt lt body gt lt div gt CLICK HERE lt div gt lt iframe src LAB ACCOUNT ROUTE URL email attacker email com gt lt iframe gt lt body gt This is how the template looks on our exploit server We can read the message This page cannot be framed this happens because the website enabled a frame buster script so we cannot render an iframe on this site A workaround we can try is to add the sandbox attribute to our exploit s iframe and set it to allow forms this will skip the frame buster script and render the iframe This is how the exploit looks now We need to modify the location of the CLICK ME div tag so that it is on top of the Update Email button on the vulnerable website Note that we are setting the iframe s opacity to to be able to check the exploit appearance and then modifying the div s top and left CSS properties so that when a logged in user clicks on the CLICK ME div on our website they are actually clicking on the vulnerable website s button to update their email to whatever we previously set in the URL parameters After setting the top property to px and the left property to px it looks like the buttons are aligned to perform a successful attack At this point our exploit looks like this lt head gt lt style gt iframe position relative width px height px opacity z index div position absolute z index top px left px lt style gt lt head gt lt body gt lt div gt CLICK HERE lt div gt lt iframe sandbox allow forms src LAB ACCOUNT ROUTE URL email attacker email com gt lt iframe gt lt body gt All we need to do is set the iframe s opacity to or something similar so that it is almost invisible and send the exploit to our victim Check out this write up on the Art Of Code Github	2022-11-19 03:40:24
ニュース	BBC News - Home	Lima airport: Two firefighters dead as plane crashes during take-off	https://www.bbc.co.uk/news/world-latin-america-63685564?at_medium=RSS&at_campaign=KARANGA	firefighters	2022-11-19 03:35:34
ニュース	BBC News - Home	Can we trust economic forecasts?	https://www.bbc.co.uk/news/63588631?at_medium=RSS&at_campaign=KARANGA	budget	2022-11-19 03:09:49
ビジネス	プレジデントオンライン	｢日本を産油国にする｣と宣言して顰蹙を買った藻類バイオマスエネルギーが､再び注目される3つの理由【2022編集部セレクション】 - 下水を浄化したうえに燃料になる	https://president.jp/articles/-/63568	顰蹙	2022-11-19 13:00:00