Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの夕べ20161124_公開用.pdf
Search
FUJISAKI Masanori
November 24, 2016
Programming
0
140
セキュリティの夕べ20161124_公開用.pdf
「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。
https://walti.io
#さくらの夕べ
FUJISAKI Masanori
November 24, 2016
Tweet
Share
More Decks by FUJISAKI Masanori
See All by FUJISAKI Masanori
プロポーザル・アンチパターン
fujisaki_hb
12
3.9k
Site Reliability Engineeringとは。
fujisaki_hb
2
450
Other Decks in Programming
See All in Programming
iOSエンジニア向けの英語学習アプリを作る!
yukawashouhei
0
180
2025年版 サーバーレス Web アプリケーションの作り方
hayatow
23
25k
階層構造を表現するデータ構造とリファクタリング 〜1年で10倍成長したプロダクトの変化と課題〜
yuhisatoxxx
3
920
Web技術を最大限活用してRAW画像を現像する / Developing RAW Images on the Web
ssssota
2
1.2k
Back to the Future: Let me tell you about the ACP protocol
terhechte
0
130
ABEMAモバイルアプリが Kotlin Multiplatformと歩んだ5年 ─ 導入と運用、成功と課題 / iOSDC 2025
akkyie
0
330
Breaking Up with Big ViewModels — Without Breaking Your Architecture (droidcon Berlin 2025)
steliosf
PRO
1
330
エンジニアとして高みを目指す、 利益を生み出す設計の考え方 / design-for-profit
minodriven
23
12k
大規模アプリのDIフレームワーク刷新戦略 ~過去最大規模の並行開発を止めずにアプリ全体に導入するまで~
mot_techtalk
0
380
高度なUI/UXこそHotwireで作ろう Kaigi on Rails 2025
naofumi
4
3.5k
iOS 17で追加されたSubscriptionStoreView を利用して5分でサブスク実装チャレンジ
natmark
0
590
どの様にAIエージェントと 協業すべきだったのか?
takefumiyoshii
2
610
Featured
See All Featured
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
35
3.2k
How STYLIGHT went responsive
nonsquared
100
5.8k
Code Review Best Practice
trishagee
72
19k
Building Applications with DynamoDB
mza
96
6.6k
StorybookのUI Testing Handbookを読んだ
zakiyama
31
6.2k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Designing for humans not robots
tammielis
254
25k
It's Worth the Effort
3n
187
28k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
19
1.2k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
252
21k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.5k
Measuring & Analyzing Core Web Vitals
bluesmoon
9
610
Transcript
8BMUJJPΛͬͯ ̋̋ͷηΩϡϦςΟஅ ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ
2016/11/24 © Walti, Inc. ࣗݾհ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ
දऔక גࣜձࣾΥϧςΟ දऔక ຊ.41ڠձ ཧࣄ • ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ݄ʹגࣜձࣾΥϧςΟΛઃཱ • ݄ʹຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢ΔΒɺຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛۙʹ ͢Δ׆ಈʯΛΥϧςΟͰ࣮ࢪதɻۀքஂମͰ .41ͷೝ্ʹΊΔɻ
2016/11/24 © Walti, Inc. ͯ͞
2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό ਖ਼ղ˒
ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ 8BMUJJPΛͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟஅ ͬͨͬͨʔʂ
2016/11/24 © Walti, Inc. ͡Ίʹ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ ʢͰ༧ࢉͳ͍͜ͱଟ͍…ʣ
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭडֹ(¥9,788,100)ͷ 2ഒҎ্…
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭडֹ(¥9,788,100)ͷ 10ഒҎ্…
ʮใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ใॲཧਪਐػߏ ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM
ࣄۀΛܧଓʹ αʔόʔॏཁɻ
2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊͰ͢
2016/11/24 © Walti, Inc. ΈΜͳେ͖ ͘͞ΒͷφϨοδʂ
͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
؆୯ͳߏ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͪ͜Β ͘͞Β͞Μʹ ͓·͔ͤ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
2016/11/24 © Walti, Inc. ·ͣ εΩϟϯ͠·͢
IUUQTXBMUJJPΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧϯτ࡞
ΞΧϯτొ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕
৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گѲ͢Δ͜ͱ͕ ରԠͷ༏ઌΛܾΊΔ্Ͱେ
࣍ʹ8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc.
8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ
λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ'SFFεΩϟϯ શແྉͰ͢ʂ
2016/11/24 © Walti, Inc. εΩϟϯத…
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚ͲɺޡݕɾରԠෆཁ ͋ΔͷͰ൵؍ෆཁ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ nikto
YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ QIQJOJͰ FYQPTF@QIQΛ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯάࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ wpscan
XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ SFBENFϑΝΠϧΛ আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT Λ༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
2016/11/24 © Walti, Inc. ରԠத… by
2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ࠶εΩϟϯத…
࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ
ରԠ࣌ؒ 2016/11/24 © Walti, Inc.
ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ
I ࡞ۀલόοΫΞοϓɺ εςʔδϯάڥ࡞ۀͳͲ ͍ΕΔͱͯ͢ͰEBZ I
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc.
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠάάΕ͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ
• ߲͑͞ग़ͯ͘Ε ΄΅͔͔࣌ؒΒͳ͍ • ࣗͷڥͩͬͨΒ ͔͔Βͳ͍ʂ
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ8BMUJJPͰɺ ରࡦαΫοͱάάͬͯͬͯ͠·͏ • εςʔδϯάڥΛৗʹ4ZOD͓ͯ͠
͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝
͞Βʹ 2016/11/24 © Walti, Inc.
8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ
2016/11/24 © Walti, Inc. কདྷʹ͚ͨ४උ
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTTແྉͳͷͰɺ ि̍ͷνΣοΫΛొͯ͠ ແྉʂ
2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ
·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛѲ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟཧΛߦ͍ͬͯ͜͏ʂ
ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ8BMUJJP͕͑ΔΑʂ 2016/11/24 © Walti, Inc.
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.