Upgrade to Pro — share decks privately, control downloads, hide ads and more …

第4回 WordBench三鷹@ミタカフェ LT 〜WordPressのセキュリティはじめの一歩〜

第4回 WordBench三鷹@ミタカフェ LT 〜WordPressのセキュリティはじめの一歩〜

Hiroki Saiki

April 14, 2018
Tweet

More Decks by Hiroki Saiki

Other Decks in Technology

Transcript

  1. ୈ4ճ WordBenchࡾୋˏϛλΧϑΣ LT
    ʙWordPressͷηΩϡϦςΟ͸͡ΊͷҰาʙ

    View Slide

  2. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ᜊ໦߂थ
    IUUQTXXXGBDFCPPLDPNISLTBJLJ

    View Slide

  3. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    גࣜձࣾNHO
    IUUQTXXXNHONF

    View Slide

  4. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࣭໰Ͱ͢ɻ

    View Slide

  5. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    8PSE1SFTTͬͯ
    ةݥͬͯݴΘΕ·͚͢Ͳɺ
    ࣮ࡍͦ͏ࢥ͍·͔͢ʁ

    View Slide

  6. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    શੈքͷ8FCαΠτͷ͸
    8PSE1SFTTͰͰ͖͍ͯ·͢ɻ

    View Slide

  7. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͦΜͳʹ࢖ΘΕͯΔͳΒ
    ผʹةݥͯ͜ͱ
    ͳ͘ͳ͍ʁ

    View Slide

  8. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ͱ͢ΑͶ
    ʉʔʉ

    View Slide

  9. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ΋ͻͱ࣭ͭ໰Ͱ͢ɻ
    ͦ͜Ͱ

    View Slide

  10. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͍·࢖͍ͬͯΔ
    8PSE1SFTTͷ
    όʔδϣϯ͸͍ͭ͘ʁ

    View Slide

  11. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ξοϓσʔτ͠ͳ͍ͷɺ
    μϝઈରɻ

    View Slide

  12. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷৽൛͸

    ʢݱࡏʣ

    View Slide

  13. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ

    Ұൠతͳιϑτ΢ΣΞͷόʔδϣχϯά
    ϝδϟʔϦϦʔεόʔδϣϯ
    ϚΠφʔϦϦʔεόʔδϣϯ
    ϝϯςφϯεϦϦʔεόʔδϣϯ

    View Slide

  14. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ

    8PSE1SFTTͷόʔδϣχϯά
    ϝδϟʔϦϦʔεόʔδϣϯ
    ϝϯςφϯεηΩϡϦςΟϦϦʔεόʔδϣϯ

    View Slide

  15. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ұ൪҆શͳόʔδϣϯ͸
    ͍ͭͰ΋࠷৽൛Ͱ͢ɻ

    View Slide

  16. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ՄೳͳݶΓ࠷৽൛ͷ
    8PSE1SFTTΛ
    ࢖͍·͠ΐ͏ɻ

    View Slide

  17. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͪͳΈʹɺ8PSE1SFTTҎ߱͸
    ࣗಈͰηΩϡϦςΟΞοϓσʔτ͕
    ൓ө͞ΕΔ࢓༷ʹͳ͍ͬͯ·͢ɻ

    View Slide

  18. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ಛʹ͓࢓ࣄͷ৔߹ɺӡ༻্ͷ໰୊Ͱ͙͢ʹ
    ϝδϟʔόʔδϣϯΞοϓͰ͖ͳ͍έʔε΋
    ͋Δ͔΋͠Ε·ͤΜ͕ɺͦͷ৔߹Ͱ΋
    ηΩϡϦςΟϦϦʔε͸ඞͣ൓өͤ͞·͠ΐ͏ɻ

    View Slide

  19. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͞Βʹ࣭໰Ͱ͢ɻ

    View Slide

  20. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ύεϫʔυɺ
    Ͳ͏ͯ͠·͢ʁ

    View Slide

  21. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ճ͠ɺμϝઈରɻ

    View Slide

  22. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷ॳʹ8PSE1SFTTΛ
    Πϯετʔϧͨ͠ͱ͖ɺ
    ࣗಈͰύεϫʔυ͕
    ೖΓ·͢ΑͶʁ

    View Slide

  23. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͜ΕΛ࢖͍·͠ΐ͏ɻ

    View Slide

  24. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͖֮͑Εͳ͍ͷͰɺ
    πʔϧͷซ༻͕Φεεϝʂ

    View Slide

  25. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·࣭ͩ໰Ͱ͢ɻ

    View Slide

  26. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    αʔόʔɺ
    Ͳ͏ͯ͠·͢ʁ

    View Slide

  27. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϩϯλϧαʔόʔ
    ʢɾ㱼ɾʣ

    View Slide

  28. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ͱ͢ΑͶ
    ʉʔʉ

    View Slide

  29. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͪΐͬͱઃఆΛ
    ɹ֬ೝͯ͠Έ·͠ΐ͏ɻ

    View Slide

  30. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ʮ8"'ʯ

    View Slide

  31. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͳʹͦΕ͓͍͍͠ͷ
    ɾТɾʆ

    View Slide

  32. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    [email protected]"[email protected]'JSFXBMM
    8FC"QQMJDBUJPO'JSFXBMM
    Web Application Firewallʢུশ:WAFɺϫϑʣͱ
    ͸ɺ΢ΣϒΞϓϦέʔγϣϯͷ੬ऑੑΛѱ༻ͨ͠߈
    ܸ͔Β΢ΣϒΞϓϦέʔγϣϯΛอޢ͢ΔηΩϡϦ
    ςΟରࡦͷҰͭ
    [1]

    View Slide

  33. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    8"'ͷઃఆ0''ɺ
    μϝઈରɻ

    View Slide

  34. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ϩϦϙοϓ8"'ͷઃఆ
    ୅දతͳϨϯλϧαʔόʔ֤ࣾͷ8"'ઃఆํ๏
    ɾ
    9αʔόʔ8PSE1SFTTηΩϡϦςΟઃఆ
    ɾ
    ͘͞ΒΠϯλʔωοτ8FCΞϓϦέʔγϣϯϑΝΠΞ΢Υʔϧ
    8"'
    ͷઃఆ
    ɾ
    ϑΝʔεταʔόʔ8"' 8ΞϓϦέʔγϣϯϑΝΠΞ΢Υʔϧ

    ɾ
    ໊͓લDPNίϯτϩʔϧύωϧ8"'ઃఆ
    ɾ
    ϔςϜϧ8"'ͷઃఆํ๏
    ɾ
    ͳͲ
    $1*ڞ༻Ϩϯλϧαʔόʔ8"'ʢ8FCΞϓϦέʔγϣϯϑΝΠΞ
    ΢Υʔϧʣ
    ɾ

    View Slide

  35. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ՄೳͳݶΓ
    ࠷৽൛ͷ1)1΋
    ࢖͍·͠ΐ͏ɻ
    ซͤͯ

    View Slide

  36. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ݹ͍όʔδϣϯͷ1)1ɺ
    μϝઈରɻ

    View Slide

  37. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·ͩ·࣭ͩ໰Ͱ͢ɻ

    View Slide

  38. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ޻ΤŚΣŐʢшʆʣŐΣŚΤ޻޻

    View Slide

  39. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ϓϥάΠϯɺ
    Ͳ͏બΜͰ·͢ʁ

    View Slide

  40. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ

    View Slide

  41. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ

    View Slide

  42. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖ͬͯΔਓ͕͍ͳ͍
    ɾТɾʆ

    View Slide

  43. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    બͿج४ ໨҆
    ͸ʁ

    View Slide

  44. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϣʔβʔ਺͕ଟ͍

    View Slide

  45. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ

    View Slide

  46. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    Ϣʔβʔ਺͕ଟ͍
    ׆ൃʹϝϯςφϯε͞Ε͍ͯΔ

    View Slide

  47. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ

    View Slide

  48. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࠷ޙͷ࣭໰Ͱ͢ɻ

    View Slide

  49. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ςʔϚɺ
    Ͳ͏ͯ͠·͢ʁ

    View Slide

  50. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ

    View Slide

  51. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࢖͍ͬͯΔਓʹ
    ฉ͘ɻ

    View Slide

  52. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ࣗ࡞ ɾТɾʆ

    View Slide

  53. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ʮެࣜσΟϨΫτϦʯ

    View Slide

  54. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ςʔϚσΟϨΫτϦ

    View Slide

  55. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͳͥʮެࣜσΟϨΫτϦʯʁ

    View Slide

  56. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ୈࡾऀʹΑΔνΣοΫ͕ೖΔ͜ͱͰ࠷
    ௿ݶͷ඼࣭͕อূ͞ΕΔ
    ϑΥʔϥϜΛ௨ͯ͡੬ऑੑ΍όάΛ࡞
    ऀʹ௚઀ใࠂͰ͖ɺൺֱతૣ͘मਖ਼͞
    ΕΔՄೳੑ͕ߴ͍
    ɾ
    ɾ

    View Slide

  57. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ·ͱΊ
    ɾ·ͣ͸࠷৽൛ͷ8PSE1SFTTͰ
    ɾύεϫʔυ͸೉͘͠
    ɾαʔόʔͷ8"'ઃఆ͸ඞͣ༗ޮԽ
    ɾซͤͯ1)1ͷόʔδϣϯ΋࠷৽ʹ
    ɾϓϥάΠϯ͸Ϣʔβʔ਺ͱߋ৽Λ֬ೝ
    ɾςʔϚ͸ެࣜσΟϨΫτϦͰ

    View Slide

  58. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    4QFDJBM5IBOLT
    ͋ͳͨͷ8PSE1SFTTΛ҆શʹอͭํ๏
    ٶ಺ོߦ

    View Slide

  59. ୈճ8PSE#FODIࡾୋˏϛλΧϑΣʙ8PSE1SFTTͷηΩϡϦςΟ͸͡ΊͷҰาʙ
    ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ

    View Slide