第4回 WordBench三鷹＠ミタカフェ LT 〜WordPressのセキュリティはじめの一歩〜

Transcript

1. ୈ4ճ WordBenchࡾୋˏϛλΧϑΣ LT
   ʙWordPressͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   

   View Slide

2. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   ᜊ໦߂थ
   IUUQTXXXGBDFCPPLDPNISLTBJLJ
   

   View Slide

3. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   גࣜձࣾNHO
   IUUQTXXXNHONF
   

   View Slide

4. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   ࣭໰Ͱ͢ɻ
   

   View Slide

5. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   8PSE1SFTTͬͯ
   ةݥͬͯݴΘΕ·͚͢Ͳɺ
   ࣮ࡍͦ͏ࢥ͍·͔͢ʁ
   

   View Slide

6. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   શੈքͷ8FCαΠτͷ͸
   8PSE1SFTTͰͰ͖͍ͯ·͢ɻ
   

   View Slide

7. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   ͦΜͳʹ࢖ΘΕͯΔͳΒ
   ผʹةݥͯ͜ͱ
   ͳ͘ͳ͍ʁ
   

   View Slide

8. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   Ͱ͢ΑͶ
   ʉʔʉ
   
   

   View Slide

9. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
   ΋ͻͱ࣭ͭ໰Ͱ͢ɻ
   ͦ͜Ͱ
   

   View Slide

10. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͍·࢖͍ͬͯΔ
    8PSE1SFTTͷ
    όʔδϣϯ͸͍ͭ͘ʁ
    

    View Slide

11. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ξοϓσʔτ͠ͳ͍ͷɺ
    μϝઈରɻ
    

    View Slide

12. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷৽൛͸
    
    ʢݱࡏʣ
    

    View Slide

13. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    
    Ұൠతͳιϑτ΢ΣΞͷόʔδϣχϯά
    ϝδϟʔϦϦʔεόʔδϣϯ
    ϚΠφʔϦϦʔεόʔδϣϯ
    ϝϯςφϯεϦϦʔεόʔδϣϯ
    

    View Slide

14. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    
    8PSE1SFTTͷόʔδϣχϯά
    ϝδϟʔϦϦʔεόʔδϣϯ
    ϝϯςφϯεηΩϡϦςΟϦϦʔεόʔδϣϯ
    

    View Slide

15. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ұ൪҆શͳόʔδϣϯ͸
    ͍ͭͰ΋࠷৽൛Ͱ͢ɻ
    

    View Slide

16. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ՄೳͳݶΓ࠷৽൛ͷ
    8PSE1SFTTΛ
    ࢖͍·͠ΐ͏ɻ
    

    View Slide

17. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͪͳΈʹɺ8PSE1SFTTҎ߱͸
    ࣗಈͰηΩϡϦςΟΞοϓσʔτ͕
    ൓ө͞ΕΔ࢓༷ʹͳ͍ͬͯ·͢ɻ
    

    View Slide

18. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ಛʹ͓࢓ࣄͷ৔߹ɺӡ༻্ͷ໰୊Ͱ͙͢ʹ
    ϝδϟʔόʔδϣϯΞοϓͰ͖ͳ͍έʔε΋
    ͋Δ͔΋͠Ε·ͤΜ͕ɺͦͷ৔߹Ͱ΋
    ηΩϡϦςΟϦϦʔε͸ඞͣ൓өͤ͞·͠ΐ͏ɻ
    

    View Slide

19. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͞Βʹ࣭໰Ͱ͢ɻ
    

    View Slide

20. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ύεϫʔυɺ
    Ͳ͏ͯ͠·͢ʁ
    

    View Slide

21. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ճ͠ɺμϝઈରɻ
    

    View Slide

22. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷ॳʹ8PSE1SFTTΛ
    Πϯετʔϧͨ͠ͱ͖ɺ
    ࣗಈͰύεϫʔυ͕
    ೖΓ·͢ΑͶʁ
    

    View Slide

23. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͜ΕΛ࢖͍·͠ΐ͏ɻ
    

    View Slide

24. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͖֮͑Εͳ͍ͷͰɺ
    πʔϧͷซ༻͕Φεεϝʂ
    

    View Slide

25. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·࣭ͩ໰Ͱ͢ɻ
    

    View Slide

26. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    αʔόʔɺ
    Ͳ͏ͯ͠·͢ʁ
    

    View Slide

27. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϩϯλϧαʔόʔ
    ʢɾ㱼ɾʣ
    

    View Slide

28. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ͱ͢ΑͶ
    ʉʔʉ
    
    

    View Slide

29. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͪΐͬͱઃఆΛ
    ɹ֬ೝͯ͠Έ·͠ΐ͏ɻ
    

    View Slide

30. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ʮ8"'ʯ
    

    View Slide

31. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͳʹͦΕ͓͍͍͠ͷ
    ɾТɾʆ
    
    

    View Slide

32. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    IUUQTKBXJLJQFEJBPSHXJLJ8FC@"QQMJDBUJPO@'JSFXBMM
    8FC"QQMJDBUJPO'JSFXBMM
    Web Application Firewallʢུশ:WAFɺϫϑʣͱ
    ͸ɺ΢ΣϒΞϓϦέʔγϣϯͷ੬ऑੑΛѱ༻ͨ͠߈
    ܸ͔Β΢ΣϒΞϓϦέʔγϣϯΛอޢ͢ΔηΩϡϦ
    ςΟରࡦͷҰͭ
    [1]
    

    View Slide

33. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    8"'ͷઃఆ0''ɺ
    μϝઈରɻ
    

    View Slide

34. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ϩϦϙοϓ8"'ͷઃఆ
    ୅දతͳϨϯλϧαʔόʔ֤ࣾͷ8"'ઃఆํ๏
    ɾ
    9αʔόʔ8PSE1SFTTηΩϡϦςΟઃఆ
    ɾ
    ͘͞ΒΠϯλʔωοτ8FCΞϓϦέʔγϣϯϑΝΠΞ΢Υʔϧ
    8"'
    ͷઃఆ
    ɾ
    ϑΝʔεταʔόʔ8"' 8ΞϓϦέʔγϣϯϑΝΠΞ΢Υʔϧ
    
    ɾ
    ໊͓લDPNίϯτϩʔϧύωϧ8"'ઃఆ
    ɾ
    ϔςϜϧ8"'ͷઃఆํ๏
    ɾ
    ͳͲ
    $1*ڞ༻Ϩϯλϧαʔόʔ8"'ʢ8FCΞϓϦέʔγϣϯϑΝΠΞ
    ΢Υʔϧʣ
    ɾ
    

    View Slide

35. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ՄೳͳݶΓ
    ࠷৽൛ͷ1)1΋
    ࢖͍·͠ΐ͏ɻ
    ซͤͯ
    

    View Slide

36. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ݹ͍όʔδϣϯͷ1)1ɺ
    μϝઈରɻ
    

    View Slide

37. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·ͩ·࣭ͩ໰Ͱ͢ɻ
    

    View Slide

38. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ޻ΤŚΣŐʢшʆʣŐΣŚΤ޻޻
    

    View Slide

39. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ϓϥάΠϯɺ
    Ͳ͏બΜͰ·͢ʁ
    

    View Slide

40. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ
    

    View Slide

41. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ
    

    View Slide

42. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖ͬͯΔਓ͕͍ͳ͍
    ɾТɾʆ
    
    

    View Slide

43. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    બͿج४ ໨҆
    ͸ʁ
    

    View Slide

44. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϣʔβʔ਺͕ଟ͍
    

    View Slide

45. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    

    View Slide

46. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϣʔβʔ਺͕ଟ͍
    ׆ൃʹϝϯςφϯε͞Ε͍ͯΔ
    

    View Slide

47. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    

    View Slide

48. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷ޙͷ࣭໰Ͱ͢ɻ
    

    View Slide

49. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ςʔϚɺ
    Ͳ͏ͯ͠·͢ʁ
    

    View Slide

50. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ
    

    View Slide

51. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ
    

    View Slide

52. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࣗ࡞ ɾТɾʆ
    
    

    View Slide

53. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ʮެࣜσΟϨΫτϦʯ
    

    View Slide

54. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ςʔϚσΟϨΫτϦ
    

    View Slide

55. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͳͥʮެࣜσΟϨΫτϦʯʁ
    

    View Slide

56. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ୈࡾऀʹΑΔνΣοΫ͕ೖΔ͜ͱͰ࠷
    ௿ݶͷ඼࣭͕อূ͞ΕΔ
    ϑΥʔϥϜΛ௨ͯ͡੬ऑੑ΍όάΛ࡞
    ऀʹ௚઀ใࠂͰ͖ɺൺֱతૣ͘मਖ਼͞
    ΕΔՄೳੑ͕ߴ͍
    ɾ
    ɾ
    

    View Slide

57. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·ͱΊ
    ɾ·ͣ͸࠷৽൛ͷ8PSE1SFTTͰ
    ɾύεϫʔυ͸೉͘͠
    ɾαʔόʔͷ8"'ઃఆ͸ඞͣ༗ޮԽ
    ɾซͤͯ1)1ͷόʔδϣϯ΋࠷৽ʹ
    ɾϓϥάΠϯ͸Ϣʔβʔ਺ͱߋ৽Λ֬ೝ
    ɾςʔϚ͸ެࣜσΟϨΫτϦͰ
    

    View Slide

58. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    4QFDJBM5IBOLT
    ͋ͳͨͷ8PSE1SFTTΛ҆શʹอͭํ๏
    ٶ಺ོߦ
    

    View Slide

59. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ
    

    View Slide