Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの夕べ20161124_公開用.pdf
Search
FUJISAKI Masanori
November 24, 2016
Programming
0
140
セキュリティの夕べ20161124_公開用.pdf
「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。
https://walti.io
#さくらの夕べ
FUJISAKI Masanori
November 24, 2016
Tweet
Share
More Decks by FUJISAKI Masanori
See All by FUJISAKI Masanori
プロポーザル・アンチパターン
fujisaki_hb
12
4k
Site Reliability Engineeringとは。
fujisaki_hb
2
450
Other Decks in Programming
See All in Programming
20251016_Rails News ~Rails 8.1の足音を聴く~
morimorihoge
3
730
EMこそClaude Codeでコード調査しよう
shibayu36
0
420
Android16 Migration Stories ~Building a Pattern for Android OS upgrades~
reoandroider
0
140
O Que É e Como Funciona o PHP-FPM?
marcelgsantos
0
200
AI 駆動開発におけるコミュニティと AWS CDK の価値
konokenj
5
250
Claude Agent SDK を使ってみよう
hyshu
0
1.4k
Go言語の特性を活かした公式MCP SDKの設計
hond0413
2
520
テーブル定義書の構造化抽出して、生成AIでDWH分析を試してみた / devio2025tokyo
kasacchiful
0
300
品質ワークショップをやってみた
nealle
0
640
Domain-centric? Why Hexagonal, Onion, and Clean Architecture Are Answers to the Wrong Question
olivergierke
3
970
Developer Joy - The New Paradigm
hollycummins
1
370
バッチ処理を「状態の記録」から「事実の記録」へ
panda728
PRO
0
190
Featured
See All Featured
Designing for humans not robots
tammielis
254
26k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.6k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
230
22k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
37
2.6k
Git: the NoSQL Database
bkeepers
PRO
431
66k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
Visualization
eitanlees
149
16k
Optimising Largest Contentful Paint
csswizardry
37
3.5k
Fireside Chat
paigeccino
41
3.7k
Scaling GitHub
holman
463
140k
Code Review Best Practice
trishagee
72
19k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
31
9.7k
Transcript
8BMUJJPΛͬͯ ̋̋ͷηΩϡϦςΟஅ ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ
2016/11/24 © Walti, Inc. ࣗݾհ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ
දऔక גࣜձࣾΥϧςΟ දऔక ຊ.41ڠձ ཧࣄ • ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ݄ʹגࣜձࣾΥϧςΟΛઃཱ • ݄ʹຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢ΔΒɺຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛۙʹ ͢Δ׆ಈʯΛΥϧςΟͰ࣮ࢪதɻۀքஂମͰ .41ͷೝ্ʹΊΔɻ
2016/11/24 © Walti, Inc. ͯ͞
2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό ਖ਼ղ˒
ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ 8BMUJJPΛͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟஅ ͬͨͬͨʔʂ
2016/11/24 © Walti, Inc. ͡Ίʹ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ ʢͰ༧ࢉͳ͍͜ͱଟ͍…ʣ
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭडֹ(¥9,788,100)ͷ 2ഒҎ্…
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭडֹ(¥9,788,100)ͷ 10ഒҎ্…
ʮใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ใॲཧਪਐػߏ ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM
ࣄۀΛܧଓʹ αʔόʔॏཁɻ
2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊͰ͢
2016/11/24 © Walti, Inc. ΈΜͳେ͖ ͘͞ΒͷφϨοδʂ
͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
؆୯ͳߏ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͪ͜Β ͘͞Β͞Μʹ ͓·͔ͤ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
2016/11/24 © Walti, Inc. ·ͣ εΩϟϯ͠·͢
IUUQTXBMUJJPΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧϯτ࡞
ΞΧϯτొ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕
৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گѲ͢Δ͜ͱ͕ ରԠͷ༏ઌΛܾΊΔ্Ͱେ
࣍ʹ8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc.
8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ
λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ'SFFεΩϟϯ શແྉͰ͢ʂ
2016/11/24 © Walti, Inc. εΩϟϯத…
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚ͲɺޡݕɾରԠෆཁ ͋ΔͷͰ൵؍ෆཁ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ nikto
YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ QIQJOJͰ FYQPTF@QIQΛ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯάࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ wpscan
XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ SFBENFϑΝΠϧΛ আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT Λ༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
2016/11/24 © Walti, Inc. ରԠத… by
2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ࠶εΩϟϯத…
࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ
ରԠ࣌ؒ 2016/11/24 © Walti, Inc.
ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ
I ࡞ۀલόοΫΞοϓɺ εςʔδϯάڥ࡞ۀͳͲ ͍ΕΔͱͯ͢ͰEBZ I
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc.
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠάάΕ͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ
• ߲͑͞ग़ͯ͘Ε ΄΅͔͔࣌ؒΒͳ͍ • ࣗͷڥͩͬͨΒ ͔͔Βͳ͍ʂ
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ8BMUJJPͰɺ ରࡦαΫοͱάάͬͯͬͯ͠·͏ • εςʔδϯάڥΛৗʹ4ZOD͓ͯ͠
͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝
͞Βʹ 2016/11/24 © Walti, Inc.
8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ
2016/11/24 © Walti, Inc. কདྷʹ͚ͨ४උ
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTTແྉͳͷͰɺ ि̍ͷνΣοΫΛొͯ͠ ແྉʂ
2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ
·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛѲ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟཧΛߦ͍ͬͯ͜͏ʂ
ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ8BMUJJP͕͑ΔΑʂ 2016/11/24 © Walti, Inc.
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.