OWASP ZAPで 脆弱性診断士気分を味わってみた話

Transcript

1. 08"41;"1Ͱ
   ੬ऑੑ਍அ࢜ؾ෼ΛຯΘͬͯΈͨ࿩
   
   08"41&WFOJOH0LJOBXB-5
   ੴ઒ത
   

   View Slide

2. ࣗݾ঺հ
   ੴ઒തʢ͍͔͠ΘͻΖ͠ʣ
   w ࣾ಺৘γεΠϯϑϥ୲౰
   w ɹɹɹ!QJSPY@
   

   View Slide

3. 08"41;"1ͱ͸ʁ
   w 08"41;FE"UUBDL1SPYZ
   w 08"41ൃɺແྉͷηΩϡϦςΟπʔϧ
   w 8FCΞϓϦͷ੬ऑੑݕग़Λαϙʔτ
   w εύΠμʔػೳʢࣗಈΫϩʔϦϯάʣɺ

   "DUJWF4DBOʢ੬ऑੑ਍அ༻ͷݕࠪจࣈྻͰεΩϟϯʣɺ
   ϩʔΧϧϓϩΩγػೳʢखಈͰͷ੬ऑੑ਍அʣɺFUD
   w "1*Λୟ͍ͯ֎෦͔Βͷૢ࡞΋Մೳ
   ͱΓ͋͑ͣɺ๭Πϕϯτ༻ʹͭͬͨ͘

   ɹɹɹɹɹɹ͓ࢠ༷޲͚8FCΞϓϦΛ਍அͯ͠Έͨɻ
   

   View Slide

4. ࢥߟλΠϓ਍அΞϓϦɿ/&0,JET
   w ࣭໰ʹ౴͑ͯࢥߟλΠϓΛ͸͖͡ग़͢ʂʂ
   

   View Slide

5. /&0,JETͷߏ੒
   w ͜Μͳײ͡Ͱ͢ɻ
   AWS
   Lambda
   Amazon

   S3
   Amazon

   DynamoDB
   Amazon API
   Gateway
   3&45"1*
   ɾઃ໰ηοτ
   ɾ਍அ݁Ռ
   ɾઃ໰ηοτΛฦ͢
   ɾճ౴݁Ռͷ਍அ
   ɾ੩తWebαΠτ
   ɹɹɹɹ1$ʹ08"41;"1Λಋೖɹɹɹɹɹɹɹɹ
   

   View Slide

6. ࠓճ΍ͬͨ͜ͱ
   w 1$ϩʔΧϧʹ08"41;"1Λಋೖͯ͠Έͨɻ
   w "DUJWF4DBOͰࣗಈ਍அΛ૸ΒͤͯΈͨɻ
   w ϓϩΩγػೳͰ௨৴Λվ͟Μͯ͠Έͨɻ
   ɹɹɹɹɹɹɹɹɹɹͷຊͰʔ͢
   

   View Slide

7. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
   w ϩʔΧϧ1$ʢ.BDʣʹΠϯετʔϧ
   w ίϯςφͰ08"41;"1Λಈ͔ͯ͠Έ·ͨ͠ɻ
   w %PDLFSެࣜͷίϯςφΠϝʔδ͕͋Γ·͢ɻ

   IUUQTIVCEPDLFSDPNSPXBTQ[BQEPDLFSTUBCMF
   

   View Slide

8. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
   w ଧͭ΂͠ʂʂ
   w 1$ίϯςφؒͰϘϦϡʔϜΛϚ΢ϯτ͓͚ͯ͠͹ɺϨϙʔτͷ
   ϑΝΠϧΛϩʔΧϧ؀ڥͰ΋ѻ͑Δ
   w ᶃʮ08"41;"1઀ଓ༻ʢ(6*ʣʯͱᶄʮϓϩΩγ༻ʯͰ

   ϙʔτϑΥϫʔσΟϯάΛͭઃఆ͢Δ
   w 8FCϒϥ΢β͔Β઀ଓʂʂ

   IUUQMPDBMIPTU BOPOZNUSVFBQQ;"1
   $ docker pull owasp/zap2docker-stable
   $ docker run -u zap -v /tmp/owaspzap:/home/zap
   -p 10001:8080 -p 10002:8090
   -i owasp/zap2docker-stable zap-webswing.sh
   

   View Slide

9. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
   w ىಈʂʂʂʂʂ
   

   View Slide

10. w ͜Μͳײ͡ʂʂʂʂʂ
    ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
    

    View Slide

11. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w "DUJWF4DBOػೳͱ͸ʁʁ
    w ର৅63-ʹରͯࣗ͠ಈͰ੬ऑੑεΩϟϯΛ࣮ࢪ
    w 63-ͷ୳ࡧ΋΍ͬͯ͘ΕΔɻ
    w ط஌ͷ੬ऑੑΛݕग़͢ΔͨΊͷจࣈྻͷ௥Ճɻ
    w ਍அ͕ʮ߈ܸʯͱ൑அ͞ΕΔ৔߹͕͋ΔͷͰɺવΔ΂͖ਃ੥Λɻ
    

    View Slide

12. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w εΩϟϯதͷը໘
    w 63-୳ࡧ
    w 3FRVFTUͷ63-຤ඌʹʮRVFSZYYYʜʯΛ෇༩
    w ౷ܭ
    w ॲཧ࣌ؒʜ
    w ϦΫΤετ਺ʜ
    ฏۉϦΫΤετඵͰͨ͠ɻ
    ʢϐʔΫͰϦΫΤετඵ͙Β͍ʣ
    

    View Slide

13. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w ग़·ͨ͠ɺ਍அ݁Ռɻ
    w ͋Γ·ͨ͠ɺ੬ऑੑɻ
    

    View Slide

14. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w ਍அ݁Ռʢશͯ)551ϔομؔ࿈ʣ
    λΠϓ ϦεΫ ֓ཁ ରࡦ
    X-Frame-Options
    Header Not Set
    த
    w ΫϦοΫδϟοΩϯά߈ܸͷϦεΫ
    w JGSBNFͰΛຒΊࠐΈɺݟ͑ͳ͍ʢಁ໌ͳʣ8FCϖ
    ʔδͷϘλϯΛΫϦοΫͤ͞Δɺ౳
    ɾ)551ϔομʹ
    ɹʮ9'3".&015*0/ʯΛ

    ɹઃఆ͢΂͠
    
    Web Browser XSS
    Protection Not
    Enabled
    খ
    w 944ʢΫϩεαΠτεΫϦϓςΟϯάʣͷϦεΫ
    w ϒϥ΢βଆͷ944ϑΟϧλ༗ޮԽͷઃఆ͕͞Ε͍ͯ
    ͳ͍ʢσϑΥϧτ͸༗ޮʹͳ͍ͬͯΔʣ
    ɾ)551ϔομʹ
    ɹʮ99441SPUFDUJPOʯΛ
    ɹઃఆ͢΂͠
    
    X-Content-Type-
    Options Header
    Missing
    খ
    w ϒϥ΢βଆͰҙਤ͠ͳ͍ಈ࡞ΛҾ͖ى͜͢ϦεΫ
    w ίϯςϯπλΠϓ͕ࢦఆ͞Ε͍ͯͳ͍ͷͰɺϒϥ΢
    βଆͰͷޡͬͨ൑அॲཧΛͯ͠͠·͏Մೳੑ͋Γ
    ɾ)551ϔομʹ
    ɹʮ9$POUFOU5ZQF0QUJPOTʯΛ

    ɹઃఆ͢΂͠
    

    View Slide

15. w 08"41;"1ΛϓϩΩγαʔόͱͯ͠ར༻ɻ

    ௨৴Λશ෦೷͍ͪΌ͏ɺ)5514Ͱ΋೷͍ͪΌ͏ɻ
    ʢ08"41;"1Ͱσίʔυͪ͠Ό͏ɻʣ
    w Πϝʔδ͸͜Μͳײ͡ɻ
    ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w 08"41;"1ΛϓϩΩγαʔόͱͯ͠ࢦఆ
    w 08"41;"1Ͱ࡞੒ͨ͠$"ϧʔτূ໌ॻΛొ࿥
    

    View Slide

16. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w 3FTQPOTFͷσʔλͷ಺༰Λ֬ೝɻ
    ໊લͱ਍அ݁Ռ
    

    View Slide

17. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w ௚઀ॻ͖׵͑Δ͜ͱ͕Ͱ͖Δɻ
    վ͟Μ
    

    View Slide

18. w վ͟Μ͞Εͨ਍அ݁Ռ͕දࣔɻ
    ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    ઃܭͷ্ݶΛ
    ௒͑ͨ఺਺
    λΠϓͷҰۃԽ΋
    ઃܭ࣌ͷ૝ఆ֎
    

    View Slide

19. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w खಈͰΞϓϦΛૢ࡞͍ͯ͠Δ͏ͪʹɺ

    "DUJWF4DBOͰ͸ݕ஌Ͱ͖ͳ͔ͬͨ੬ऑੑ΍ɺ

    ୳ࡧର৅͔Β࿙Ε͍ͯͨ63-Λൃݟɻ
    w 501ϖʔδͰϑΥʔϜͷόϦσʔγϣϯʢະೖྗ͸/(ʣΛ

    ͍͍͔ͯͨͤ͠ɺҎ߱ͷϖʔδ͸νΣοΫͰ͖͍ͯͳ͔ͬͨ໛༷ɻ
    

    View Slide

20. ৼΓฦΓ
    w ͓खܰʹ੬ऑੑ਍அ࢜ͬΆ͍ؾ෼͸ຯΘ͑ͨɻ
    w "DUJWF4DBOͰ͸ݟ͔ͭΒͳ͍੬ऑੑ΋͋ͬͨͷͰɺ
    ϚχϡΞϧૢ࡞ˠ஌ࣝɾϊ΢ϋ΢͕ඞཁɻ

    ʢո͍͠ͱ͜Ζʹ౰ͨΓΛ͚ͭͯखಈνΣοΫʣ
    w ֎෦ͷ੬ऑੑ਍அΛड͚Δલʹɺ08"41;"1Ͱ
    ηϧϑνΣοΫΛ͢Δͷ͸༗Γ͔΋ɻ

    ʢ੬ऑੑ૞ࡧπʔϧج൫Λ࡞ͬͯࣾ಺։์ɺͱ͔ʣ
    

    View Slide

21. ͓·͚τϐοΫ
    w ॳΊͯ"84΁ͷϖωετϨʔγϣϯਃ੥ͨ͠ɻ
    w ਃ੥ϑΥʔϜ͕ӳޠ0OMZͳͷͰɺ

    Կͱॻ͚͹͍͍ͷ͔೰Έͳ͕Βਃ੥ɻ
    w ͕ɺ࠷ۙϙϦγʔมΘͬͨΑ͏Ͱʮਃ੥ෆཁʯͱճ౴
    ͕͖ͨɻ
    w %P4߈ܸɺେن໛ΠϕϯτҎ֎͸ਃ੥ෆཁʁ
    w /%"ʢൿີอ࣋ܖ໿ʣͷక݁͸ඞཁʁʁ

    ˠ"84͞Μʹ໰͍߹ΘͤதͰ͢
    

    View Slide

22. ͓·͚τϐοΫ
    w %PDLFSίϯςφ൛ͷ08"41;"1
    w ίϯςφΠϝʔδʹ೔ຊޠϑΥϯτ͕ೖ͍ͬͯͳ͍ɻ
    w 08"41;"1ͷ΢Οϯυ΢Λ࠷େදࣔʹ͍ͯ͠Δͱɺ
    όοΫάϥ΢ϯυͷผ΢Οϯυ΢ʹؾ͚ͮͳ͍ɻɻ

    ˡ͜͏͍͏ͷɻ
    w ಉ࣌ར༻͸ηογϣϯ·Ͱʁ

    ʢผϒϥ΢β͔Βಉ࣌ʹܨ͍ͩΒΤϥʔʹͳͬͨɻʣ
    

    View Slide

23. ͓·͚τϐοΫ
    w %PDLFSίϯςφ൛ͷ08"41;"1
    w ίϯςφىಈ͢Δͨͼʹ/BNF͕มΘΔ༡ͼ৺
    w QSBDUJDBM@IFMMNBO
    w BHJUBUFE@NFSLMF
    w IFVSJTUJD@CFBWFS
    w CMJTTGVM@GFSNBU
    w WJHJMBOU@NPOUBMDJOJ
    w FBHFS@WBSBIBNJIJSB
    w ʜ
    ˞గਖ਼ʢਃ͠༁͋Γ·ͤΜͰͨ͠ʣ˞
    ͜Ε͸%PDLFSଆͷ࢓༷Ͱͨ͠ɻ
    Φʔϓϯιʔε൛%PDLFSͷίΞ෦෼Λ
    ίϯϙʔωϯτԽ͢Δʮ.PCZ1SPKFDUʯͱ͍͏
    औΓ૊Έ͕͋Γɺͦͷͳ͔ͷʮOBNFTHFOFSBUPSʯ
    Ͱίϯςφ໊Λੜ੒͍ͯ͠ΔΑ͏Ͱ͢ɻ
    ʢʡ@ʡͷࠨӈͷ୯ޠΛϥϯμϜͰ૊Έ߹Θͤʣ
    IUUQTHJUIVCDPNNPCZNPCZUSFFNBTUFS
    QLHOBNFTHFOFSBUPS
    

    View Slide