Upgrade to Pro — share decks privately, control downloads, hide ads and more …

セキュリティの夕べ20161124_公開用.pdf

 セキュリティの夕べ20161124_公開用.pdf

「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。 https://walti.io #さくらの夕べ

FUJISAKI Masanori

November 24, 2016
Tweet

More Decks by FUJISAKI Masanori

Other Decks in Programming

Transcript

  1. 2016/11/24 © Walti, Inc. ࣗݾ঺հ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ

    ୅දऔక໾ גࣜձࣾ΢ΥϧςΟ ୅දऔక໾ ೔ຊ.41ڠձ ཧࣄ • ೥ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ೥݄ʹגࣜձࣾ΢ΥϧςΟΛઃཱ • ೥݄ʹ೔ຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢Δ๣Βɺ೔ຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛ਎ۙʹ ͢Δ׆ಈʯΛ΢ΥϧςΟͰ࣮ࢪதɻۀքஂମͰ͸ .41ͷೝ஌౓޲্ʹ౒ΊΔɻ
  2. ͸͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.

    ࣗ৴Λ΋ͬͯճ౴͢Δʹ͸ ঢ়گΛ೺Ѳ͍ͯ͠Δ͜ͱ͕େ੾ ʢͰ΋༧ࢉͳ͍͜ͱଟ͍…ʣ
  3. ଛ֐ഛঈͷ൑ྫ΋ʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛ֐ഛঈʹͭͳ͕Δ͜ͱ΋ɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$൑ྫθϛ  ଛ֐ഛঈ੥ٻࣄ݅

    ౦ژ஍ํࡋ൑ॴ൑ܾฏ੒೥ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭड஫ֹ(¥9,788,100)ͷ 2ഒҎ্…
  4. ଛ֐ഛঈͷ൑ྫ΋ʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛ֐ഛঈʹͭͳ͕Δ͜ͱ΋ɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$൑ྫθϛ  ଛ֐ഛঈ੥ٻࣄ݅

    ౦ژ஍ํࡋ൑ॴ൑ܾฏ੒೥ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭड஫ֹ(¥9,788,100)ͷ 10ഒҎ্…
  5. ͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
  6. ϑΝΠΞ΢Υʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ

    wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙ΋ରԠ044εΩϟφΛ௥Ճ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొ࿥ͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹ͸ొ࿥ͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯର৅ʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ࢖͑ ·͢ɻ
  7. ϑΝΠΞ΢Υʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ

    wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙ΋ରԠ044εΩϟφΛ௥Ճ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొ࿥ͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹ͸ొ࿥ͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯର৅ʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ࢖͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
  8. ରԠ͠ͳ͚Ε͹ͳΒͳ͍΋ͷ 2016/11/24 © Walti, Inc. छผ ߲໨ ରԠཁ൱ ରԠྫ nikto

    YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ঑ QIQJOJͰ FYQPTF@QIQΛ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯά๷ࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ঑ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
  9. ରԠ͠ͳ͚Ε͹ͳΒͳ͍΋ͷ 2016/11/24 © Walti, Inc. छผ ߲໨ ରԠཁ൱ ରԠྫ wpscan

    XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ঑ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ঑ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ঑ SFBENFϑΝΠϧΛ ࡟আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT  Λ࢖༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
  10. ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ

    I ࡞ۀલόοΫΞοϓɺ εςʔδϯά؀ڥ࡞ۀͳͲ΋ ͍ΕΔͱ͢΂ͯͰEBZ I
  11. ରԠޙͷײ૝ͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠ౳͸άάΕ͹͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ

    • ߲໨͑͞ग़ͯ͘Ε͹ ΄΅࣌ؒ͸͔͔Βͳ͍ • ࣗ෼ͷ؀ڥͩͬͨΒ ෼΋͔͔Βͳ͍ʂ
  12. վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
  13. վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ௖͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ