2018-12-セキュリティ / 2018-12 security

- 情報セキュリティ
- サイボウズで検出している脆弱性とハンズオン
　- クロスサイト・スクリプティング（XSS）
　- SQLインジェクション（SQLi）
　- 情報漏えい
　- クロスサイトリクエストフォージェリ（CSRF）
　- HTTPのセキュリティ機能
- 脆弱性の見つけ方
- 脆弱性の評価
- 演習の説明

Transcript

1. 
   
   
   
   
   

   View Slide

2. 
   XH
   R C
   • P R P XH
   • ()
   •
   • P R P T )
   • XH
   

   View Slide

3. 
   

   View Slide

4. 
   I 7 J I 2 A J S S
   
   
   
   
   AQ
   7 Q
   0
   
   
   
   
   AQ
   C
   A
   
   
   QC 2Q
   ) (
   

   View Slide

5. 
   
   .5%3/"-
   #
   • 5 ') 9875&(3*$2 -,
   1043!
   

   View Slide

6. 
   
   
   
   *.:9?@<6- -&*
   • ;>=785--/
   3+!*+1!2
   • +,01:9?@<6#)$+%+'( 2
   

   View Slide

7. 
   D
   • ( )
   •
   •
   • V
   

   View Slide

8. 
   
   

   View Slide

9. 
   w jo nW kei s ei p
   : ko
   n )( c klhi Cei r yuma r v
   n I nW s rg nTEnM j
   R
   /:: . : /:
   

   View Slide

10. / ) (
    a @ WST I EA V N
    W P C T TJ
    

    View Slide

11. )
    
    
    

    View Slide

12. E 5 ( )98
    n sgOpro Lt S F
    edT Ph
    Ph ( ) X QW QR FW2( - 3
    cI a
    03 39 D6C
    ( ) X Q WS C 0 R
    ( ) F L 0 9 298 97C
    2 97C P SP
    -441 0C 9 i
    ( ) 7
    9
    TWH R
    j
    

    View Slide

13. ((
    E (( UX
    - b S W W e L 9
    
    
    L S
    A 7 L
    
    
    C )
    R S
    
    

    View Slide

14. 
    _ < [] M L a S H aT
    el i JG
    > = < $ ? / $
    < $ ? / $
    

    View Slide

15. a = <1 EE T]d /<
    ]d c c_
    $ < ? 1 1> E 1 E = <1 $ )( E
    = <1 1 2 /< 1 1 1
    2 ) 1 (
    = (
    

    View Slide

16. 
    da OR D
    da B M
    e e S J c e M
    

    View Slide

17. 
    M
    T
    M
    T
    H
    

    View Slide

18. ) ( -9 89 (
    Q Q Q
    -
    A A L
    -
    L A
    Q
    

    View Slide

19. (
    $ * ET CB [ M_LO ]R _DF
    S W$ WH _GBT Q
    * =
    =
    

    View Slide

20. ) (
    b u [{ ] * * N Q teS
    ts RO _i n d
    * *( # 1 C D =A * * HE * H G FG
    G 1
    #
    1
    WMt 0) H $ {T lr a d
    

    View Slide

21. 
    =B0B!),3.B:"$
    
    :?B3;>5'6A:?B8,A2A9?B<@B-&
    ) (
    &136<%7B4) =B0B!)
    ,3
    .B: (#
    
    

    View Slide

22. 
    
    ST P L H H P
    •
    •
    •
    

    View Slide

23. 
    FC U S R
    1 P E PU LR P )
    8 U S C P
    •
    •
    • -S R (
    • )(
    

    View Slide

24. 
    
    ) ( )
    H
    • )
    • )
    

    View Slide

25. 
    
    H PR R H ) (
    S R
    • Q
    • Q
    

    View Slide

26. 
    
    & dcg ./. . UL o R
    ./. . R bdhg TL
    P R
    
    ? bdhg TL
    . . =:
    . : . : . .
    
    ? ./. . o
    . . =:
    . : . : . .
    H
    : . .UL ps
    fs ngrsm
    

    View Slide

27. 2 35 -23 5
    ( )
    me pv sr L os vp jd w h
    SR
    3 : :. 2 : 1/ A . . 1 1 1 0 : 2 . 2 / 1 3
    
    U jy c
    L a j
    
    g yuvi
    Fm aptn
    

    View Slide

28. 
    
    ( T S
    T GU E
    
    GT A )
    G)
    
    U
    (R P
    (O R
    S L
    

    View Slide

29. 
    
    
    G e e
    e O a G
    S e cS
    

    View Slide

30. 
    D PS a P T
    • -
    • - -
    • -
    • - -
    • - -
    • -
    C O OH XT F
    

    View Slide

31. 1 -
    i m e
    1 1 # 1 1 -
    e ; P r dc k d: P
    d k diP d k e b l
    P e = Sd X l
    

    View Slide

32. -
    
    
    

    View Slide

33. 
    +&*"46 )$4
    6&0'
    !%5(1.'4=;9:<>8-/
    &,"3#-&0&2#
    

    View Slide

34. 
    
    I
    I
    I
    

    View Slide

35. 
    
    '*$(" # $
    +&&)!, ,%
    
    
    

    View Slide

36. 
    W
    W I
    I /
    

    View Slide

37. 
    I
    

    View Slide

38. /
    t w g P
    i
    W t w
    i
    l op S P w
    2 t w B e . .
    u
    r b
    

    View Slide

39. 3
    Le i
    L c
    

    View Slide

40. 
    m e I n l
    l R e
    TQ
    l L e S
    n qsVa e O n A
    l m
    l eP TQ e p
    e n
    

    View Slide

41. 
    
    
    

    View Slide

42. 
    V
    v 3
    C
    S
    S
    

    View Slide

43. 
    s / / : ) :
    • rn C h
    • mg w h
    • rn l S p y
    • rn b y
    sh
    a h S ui h o vui ce
    h o v h w h j w t
    s V 3 3 .3 ) : / /
    

    View Slide

44. 
    
    US A )
    )
    i nr vo
    mUS d n o Iak
    US i
    i nr voUS
    n Cg i o
    Iak
    Cg
    i nr voUS
    n Cg i o
    Iak
    t P (
    (
    i nr voUS
    n Cg t P
    o Iak
    ur y
    i nr v iU
    S ln R Vo Iak
    

    View Slide

45. 
    
    A i C i
    A ()
    An bmf gel
    i Ca el
    An d e
    A i C coi
    A )
    An bmf gel
    i Ca cobml
    An d e
    A i Ii
    A
    An bmf gel
    i a Ie
    l An d e
    

    View Slide

46. 
    AE
    (
    C
    )
    W I
    W
    

    View Slide

47. 
    G S g_ d
    . 7 0 A : / 0 9
    g P
    . 7 3 13
    / h m il O P ej l
    / 0 9 : / : 1 :
    cmd md
    . :1 C .
    O P abmd e
    G S / h m il
    

    View Slide