Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
セキュリティの夕べ20161124_公開用.pdf
FUJISAKI Masanori
November 24, 2016
Programming
0
110
セキュリティの夕べ20161124_公開用.pdf
「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。
https://walti.io
#さくらの夕べ
FUJISAKI Masanori
November 24, 2016
Tweet
Share
More Decks by FUJISAKI Masanori
See All by FUJISAKI Masanori
プロポーザル・アンチパターン
fujisaki_hb
12
2.8k
Site Reliability Engineeringとは。
fujisaki_hb
1
230
Other Decks in Programming
See All in Programming
OIDC仕様に準拠した Makuake ID連携基盤構築の裏側
ymtdzzz
0
580
Gradle build: The time is now
nonews
1
500
Excelの助けを借りて楽にシナリオを作ろう
rpa_niiyama
0
330
(新米)エンジニアリングマネージャーのしごと #RSGT2023
murabayashi
9
5.9k
フロントエンドで 良いコードを書くために
t_keshi
3
1.7k
TSX First な Zero-Runtime SSG potato4d/dodai とその仕組み / owned static site generator #kyotojs
potato4d
0
410
What's new in Shopware 6.5
shyim
0
110
社会人 20 年目エンジニア、発信で技術学びなおしてる話
e99h2121
1
140
The State of Kotlin | FOSDEM 2023
prof18
1
100
ポケモンで学ぶiOS 16弾丸ツアー 🚅
giginet
PRO
1
620
Functional Fun in Kotlin
nomisrev
1
120
Swift Expression Macros: a practical introduction
kishikawakatsumi
2
740
Featured
See All Featured
The Cult of Friendly URLs
andyhume
69
5.1k
Art Directing for the Web. Five minutes with CSS Template Areas
malarkey
197
10k
Learning to Love Humans: Emotional Interface Design
aarron
263
38k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
270
12k
Designing Experiences People Love
moore
130
22k
Scaling GitHub
holman
453
140k
Build your cross-platform service in a week with App Engine
jlugia
221
17k
Documentation Writing (for coders)
carmenintech
51
2.9k
The Illustrated Children's Guide to Kubernetes
chrisshort
22
43k
Fontdeck: Realign not Redesign
paulrobertlloyd
74
4.3k
10 Git Anti Patterns You Should be Aware of
lemiorhan
643
54k
Fashionably flexible responsive web design (full day workshop)
malarkey
396
63k
Transcript
8BMUJJPΛͬͯ ̋̋ͷηΩϡϦςΟஅ ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ
2016/11/24 © Walti, Inc. ࣗݾհ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ
දऔక גࣜձࣾΥϧςΟ දऔక ຊ.41ڠձ ཧࣄ • ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ݄ʹגࣜձࣾΥϧςΟΛઃཱ • ݄ʹຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢ΔΒɺຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛۙʹ ͢Δ׆ಈʯΛΥϧςΟͰ࣮ࢪதɻۀքஂମͰ .41ͷೝ্ʹΊΔɻ
2016/11/24 © Walti, Inc. ͯ͞
2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό ਖ਼ղ˒
ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ 8BMUJJPΛͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟஅ ͬͨͬͨʔʂ
2016/11/24 © Walti, Inc. ͡Ίʹ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ ʢͰ༧ࢉͳ͍͜ͱଟ͍…ʣ
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭडֹ(¥9,788,100)ͷ 2ഒҎ্…
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭडֹ(¥9,788,100)ͷ 10ഒҎ্…
ʮใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ใॲཧਪਐػߏ ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM
ࣄۀΛܧଓʹ αʔόʔॏཁɻ
2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊͰ͢
2016/11/24 © Walti, Inc. ΈΜͳେ͖ ͘͞ΒͷφϨοδʂ
͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
؆୯ͳߏ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͪ͜Β ͘͞Β͞Μʹ ͓·͔ͤ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
2016/11/24 © Walti, Inc. ·ͣ εΩϟϯ͠·͢
IUUQTXBMUJJPΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧϯτ࡞
ΞΧϯτొ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕
৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گѲ͢Δ͜ͱ͕ ରԠͷ༏ઌΛܾΊΔ্Ͱେ
࣍ʹ8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc.
8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ
λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ'SFFεΩϟϯ શແྉͰ͢ʂ
2016/11/24 © Walti, Inc. εΩϟϯத…
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚ͲɺޡݕɾରԠෆཁ ͋ΔͷͰ൵؍ෆཁ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ nikto
YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ QIQJOJͰ
[email protected]
Λ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯάࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ wpscan
XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ SFBENFϑΝΠϧΛ আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT Λ༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
2016/11/24 © Walti, Inc. ରԠத… by
2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ࠶εΩϟϯத…
࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ
ରԠ࣌ؒ 2016/11/24 © Walti, Inc.
ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ
I ࡞ۀલόοΫΞοϓɺ εςʔδϯάڥ࡞ۀͳͲ ͍ΕΔͱͯ͢ͰEBZ I
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc.
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠάάΕ͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ
• ߲͑͞ग़ͯ͘Ε ΄΅͔͔࣌ؒΒͳ͍ • ࣗͷڥͩͬͨΒ ͔͔Βͳ͍ʂ
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ8BMUJJPͰɺ ରࡦαΫοͱάάͬͯͬͯ͠·͏ • εςʔδϯάڥΛৗʹ4ZOD͓ͯ͠
͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝
͞Βʹ 2016/11/24 © Walti, Inc.
8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ
2016/11/24 © Walti, Inc. কདྷʹ͚ͨ४උ
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTTແྉͳͷͰɺ ि̍ͷνΣοΫΛొͯ͠ ແྉʂ
2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ
·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛѲ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟཧΛߦ͍ͬͯ͜͏ʂ
ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ8BMUJJP͕͑ΔΑʂ 2016/11/24 © Walti, Inc.
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.