Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの夕べ20161124_公開用.pdf
Search
FUJISAKI Masanori
November 24, 2016
Programming
0
140
セキュリティの夕べ20161124_公開用.pdf
「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。
https://walti.io
#さくらの夕べ
FUJISAKI Masanori
November 24, 2016
Tweet
Share
More Decks by FUJISAKI Masanori
See All by FUJISAKI Masanori
プロポーザル・アンチパターン
fujisaki_hb
12
3.9k
Site Reliability Engineeringとは。
fujisaki_hb
2
440
Other Decks in Programming
See All in Programming
RDoc meets YARD
okuramasafumi
4
160
AIを活用し、今後に備えるための技術知識 / Basic Knowledge to Utilize AI
kishida
19
4.5k
プロポーザル駆動学習 / Proposal-Driven Learning
mackey0225
2
380
Claude Codeで挑むOSSコントリビュート
eycjur
0
190
FindyにおけるTakumi活用と脆弱性管理のこれから
rvirus0817
0
390
Design Foundational Data Engineering Observability
sucitw
2
140
フロントエンドのmonorepo化と責務分離のリアーキテクト
kajitack
2
160
JSONataを使ってみよう Step Functionsが楽しくなる実践テクニック #devio2025
dafujii
0
260
Langfuseと歩む生成AI活用推進
licux
3
320
複雑なドメインに挑む.pdf
yukisakai1225
5
950
TanStack DB ~状態管理の新しい考え方~
bmthd
2
440
実用的なGOCACHEPROG実装をするために / golang.tokyo #40
mazrean
1
140
Featured
See All Featured
Practical Orchestrator
shlominoach
190
11k
KATA
mclloyd
32
14k
Building a Modern Day E-commerce SEO Strategy
aleyda
43
7.5k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
185
54k
Fireside Chat
paigeccino
39
3.6k
Music & Morning Musume
bryan
46
6.8k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
Docker and Python
trallard
45
3.5k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.8k
Building Flexible Design Systems
yeseniaperezcruz
328
39k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
30
9.6k
StorybookのUI Testing Handbookを読んだ
zakiyama
30
6.1k
Transcript
8BMUJJPΛͬͯ ̋̋ͷηΩϡϦςΟஅ ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ
2016/11/24 © Walti, Inc. ࣗݾհ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ
දऔక גࣜձࣾΥϧςΟ දऔక ຊ.41ڠձ ཧࣄ • ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ݄ʹגࣜձࣾΥϧςΟΛઃཱ • ݄ʹຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢ΔΒɺຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛۙʹ ͢Δ׆ಈʯΛΥϧςΟͰ࣮ࢪதɻۀքஂମͰ .41ͷೝ্ʹΊΔɻ
2016/11/24 © Walti, Inc. ͯ͞
2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό ਖ਼ղ˒
ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ 8BMUJJPΛͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟஅ ͬͨͬͨʔʂ
2016/11/24 © Walti, Inc. ͡Ίʹ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ ʢͰ༧ࢉͳ͍͜ͱଟ͍…ʣ
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭडֹ(¥9,788,100)ͷ 2ഒҎ্…
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭडֹ(¥9,788,100)ͷ 10ഒҎ্…
ʮใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ใॲཧਪਐػߏ ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM
ࣄۀΛܧଓʹ αʔόʔॏཁɻ
2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊͰ͢
2016/11/24 © Walti, Inc. ΈΜͳେ͖ ͘͞ΒͷφϨοδʂ
͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
؆୯ͳߏ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͪ͜Β ͘͞Β͞Μʹ ͓·͔ͤ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
2016/11/24 © Walti, Inc. ·ͣ εΩϟϯ͠·͢
IUUQTXBMUJJPΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧϯτ࡞
ΞΧϯτొ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕
৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گѲ͢Δ͜ͱ͕ ରԠͷ༏ઌΛܾΊΔ্Ͱେ
࣍ʹ8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc.
8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ
λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ'SFFεΩϟϯ શແྉͰ͢ʂ
2016/11/24 © Walti, Inc. εΩϟϯத…
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚ͲɺޡݕɾରԠෆཁ ͋ΔͷͰ൵؍ෆཁ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ nikto
YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ QIQJOJͰ FYQPTF@QIQΛ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯάࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ wpscan
XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ SFBENFϑΝΠϧΛ আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT Λ༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
2016/11/24 © Walti, Inc. ରԠத… by
2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ࠶εΩϟϯத…
࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ
ରԠ࣌ؒ 2016/11/24 © Walti, Inc.
ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ
I ࡞ۀલόοΫΞοϓɺ εςʔδϯάڥ࡞ۀͳͲ ͍ΕΔͱͯ͢ͰEBZ I
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc.
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠάάΕ͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ
• ߲͑͞ग़ͯ͘Ε ΄΅͔͔࣌ؒΒͳ͍ • ࣗͷڥͩͬͨΒ ͔͔Βͳ͍ʂ
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ8BMUJJPͰɺ ରࡦαΫοͱάάͬͯͬͯ͠·͏ • εςʔδϯάڥΛৗʹ4ZOD͓ͯ͠
͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝
͞Βʹ 2016/11/24 © Walti, Inc.
8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ
2016/11/24 © Walti, Inc. কདྷʹ͚ͨ४උ
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTTແྉͳͷͰɺ ि̍ͷνΣοΫΛొͯ͠ ແྉʂ
2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ
·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛѲ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟཧΛߦ͍ͬͯ͜͏ʂ
ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ8BMUJJP͕͑ΔΑʂ 2016/11/24 © Walti, Inc.
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.