Upgrade to Pro — share decks privately, control downloads, hide ads and more …

OWASP ZAPで 脆弱性診断士気分を味わってみた話

OWASP ZAPで 脆弱性診断士気分を味わってみた話

石川 博

March 07, 2019
Tweet

More Decks by 石川 博

Other Decks in Technology

Transcript

  1. 08"41;"1Ͱ
    ੬ऑੑ਍அ࢜ؾ෼ΛຯΘͬͯΈͨ࿩

    08"41&WFOJOH0LJOBXB-5
    ੴ઒ത

    View full-size slide

  2. ࣗݾ঺հ
    ੴ઒തʢ͍͔͠ΘͻΖ͠ʣ
    w ࣾ಺৘γεΠϯϑϥ୲౰
    w ɹɹɹ!QJSPY@

    View full-size slide

  3. 08"41;"1ͱ͸ʁ
    w 08"41;FE"UUBDL1SPYZ
    w 08"41ൃɺແྉͷηΩϡϦςΟπʔϧ
    w 8FCΞϓϦͷ੬ऑੑݕग़Λαϙʔτ
    w εύΠμʔػೳʢࣗಈΫϩʔϦϯάʣɺ

    "DUJWF4DBOʢ੬ऑੑ਍அ༻ͷݕࠪจࣈྻͰεΩϟϯʣɺ
    ϩʔΧϧϓϩΩγػೳʢखಈͰͷ੬ऑੑ਍அʣɺFUD
    w "1*Λୟ͍ͯ֎෦͔Βͷૢ࡞΋Մೳ
    ͱΓ͋͑ͣɺ๭Πϕϯτ༻ʹͭͬͨ͘

    ɹɹɹɹɹɹ͓ࢠ༷޲͚8FCΞϓϦΛ਍அͯ͠Έͨɻ

    View full-size slide

  4. ࢥߟλΠϓ਍அΞϓϦɿ/&0,JET
    w ࣭໰ʹ౴͑ͯࢥߟλΠϓΛ͸͖͡ग़͢ʂʂ

    View full-size slide

  5. /&0,JETͷߏ੒
    w ͜Μͳײ͡Ͱ͢ɻ
    AWS
    Lambda
    Amazon

    S3
    Amazon

    DynamoDB
    Amazon API
    Gateway
    3&45"1*
    ɾઃ໰ηοτ
    ɾ਍அ݁Ռ
    ɾઃ໰ηοτΛฦ͢
    ɾճ౴݁Ռͷ਍அ
    ɾ੩తWebαΠτ
    ɹɹɹɹ1$ʹ08"41;"1Λಋೖɹɹɹɹɹɹɹɹ

    View full-size slide

  6. ࠓճ΍ͬͨ͜ͱ
    w 1$ϩʔΧϧʹ08"41;"1Λಋೖͯ͠Έͨɻ
    w "DUJWF4DBOͰࣗಈ਍அΛ૸ΒͤͯΈͨɻ
    w ϓϩΩγػೳͰ௨৴Λվ͟Μͯ͠Έͨɻ
    ɹɹɹɹɹɹɹɹɹɹͷຊͰʔ͢

    View full-size slide

  7. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
    w ϩʔΧϧ1$ʢ.BDʣʹΠϯετʔϧ
    w ίϯςφͰ08"41;"1Λಈ͔ͯ͠Έ·ͨ͠ɻ
    w %PDLFSެࣜͷίϯςφΠϝʔδ͕͋Γ·͢ɻ

    IUUQTIVCEPDLFSDPNSPXBTQ[BQEPDLFSTUBCMF

    View full-size slide

  8. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
    w ଧͭ΂͠ʂʂ
    w 1$ίϯςφؒͰϘϦϡʔϜΛϚ΢ϯτ͓͚ͯ͠͹ɺϨϙʔτͷ
    ϑΝΠϧΛϩʔΧϧ؀ڥͰ΋ѻ͑Δ
    w ᶃʮ08"41;"1઀ଓ༻ʢ(6*ʣʯͱᶄʮϓϩΩγ༻ʯͰ

    ϙʔτϑΥϫʔσΟϯάΛͭઃఆ͢Δ
    w 8FCϒϥ΢β͔Β઀ଓʂʂ

    IUUQMPDBMIPTU BOPOZNUSVFBQQ;"1
    $ docker pull owasp/zap2docker-stable
    $ docker run -u zap -v /tmp/owaspzap:/home/zap
    -p 10001:8080 -p 10002:8090
    -i owasp/zap2docker-stable zap-webswing.sh

    View full-size slide

  9. ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ
    w ىಈʂʂʂʂʂ

    View full-size slide

  10. w ͜Μͳײ͡ʂʂʂʂʂ
    ʢ̍ʣ08"41;"1ͷಋೖʢίϯςφʣ

    View full-size slide

  11. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w "DUJWF4DBOػೳͱ͸ʁʁ
    w ର৅63-ʹରͯࣗ͠ಈͰ੬ऑੑεΩϟϯΛ࣮ࢪ
    w 63-ͷ୳ࡧ΋΍ͬͯ͘ΕΔɻ
    w ط஌ͷ੬ऑੑΛݕग़͢ΔͨΊͷจࣈྻͷ௥Ճɻ
    w ਍அ͕ʮ߈ܸʯͱ൑அ͞ΕΔ৔߹͕͋ΔͷͰɺવΔ΂͖ਃ੥Λɻ

    View full-size slide

  12. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w εΩϟϯதͷը໘
    w 63-୳ࡧ
    w 3FRVFTUͷ63-຤ඌʹʮRVFSZYYYʜʯΛ෇༩
    w ౷ܭ
    w ॲཧ࣌ؒʜ
    w ϦΫΤετ਺ʜ
    ฏۉϦΫΤετඵͰͨ͠ɻ
    ʢϐʔΫͰϦΫΤετඵ͙Β͍ʣ

    View full-size slide

  13. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w ग़·ͨ͠ɺ਍அ݁Ռɻ
    w ͋Γ·ͨ͠ɺ੬ऑੑɻ

    View full-size slide

  14. ʢ̎ʣ"DUJWF4DBOͰ੬ऑੑνΣοΫ
    w ਍அ݁Ռʢશͯ)551ϔομؔ࿈ʣ
    λΠϓ ϦεΫ ֓ཁ ରࡦ
    X-Frame-Options
    Header Not Set

    w ΫϦοΫδϟοΩϯά߈ܸͷϦεΫ
    w JGSBNFͰΛຒΊࠐΈɺݟ͑ͳ͍ʢಁ໌ͳʣ8FCϖ
    ʔδͷϘλϯΛΫϦοΫͤ͞Δɺ౳
    ɾ)551ϔομʹ
    ɹʮ9'3".&015*0/ʯΛ

    ɹઃఆ͢΂͠

    Web Browser XSS
    Protection Not
    Enabled

    w 944ʢΫϩεαΠτεΫϦϓςΟϯάʣͷϦεΫ
    w ϒϥ΢βଆͷ944ϑΟϧλ༗ޮԽͷઃఆ͕͞Ε͍ͯ
    ͳ͍ʢσϑΥϧτ͸༗ޮʹͳ͍ͬͯΔʣ
    ɾ)551ϔομʹ
    ɹʮ99441SPUFDUJPOʯΛ
    ɹઃఆ͢΂͠

    X-Content-Type-
    Options Header
    Missing

    w ϒϥ΢βଆͰҙਤ͠ͳ͍ಈ࡞ΛҾ͖ى͜͢ϦεΫ
    w ίϯςϯπλΠϓ͕ࢦఆ͞Ε͍ͯͳ͍ͷͰɺϒϥ΢
    βଆͰͷޡͬͨ൑அॲཧΛͯ͠͠·͏Մೳੑ͋Γ
    ɾ)551ϔομʹ
    ɹʮ9$POUFOU5ZQF0QUJPOTʯΛ

    ɹઃఆ͢΂͠

    View full-size slide

  15. w 08"41;"1ΛϓϩΩγαʔόͱͯ͠ར༻ɻ

    ௨৴Λશ෦೷͍ͪΌ͏ɺ)5514Ͱ΋೷͍ͪΌ͏ɻ
    ʢ08"41;"1Ͱσίʔυͪ͠Ό͏ɻʣ
    w Πϝʔδ͸͜Μͳײ͡ɻ
    ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w 08"41;"1ΛϓϩΩγαʔόͱͯ͠ࢦఆ
    w 08"41;"1Ͱ࡞੒ͨ͠$"ϧʔτূ໌ॻΛొ࿥

    View full-size slide

  16. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w 3FTQPOTFͷσʔλͷ಺༰Λ֬ೝɻ
    ໊લͱ਍அ݁Ռ

    View full-size slide

  17. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w ௚઀ॻ͖׵͑Δ͜ͱ͕Ͱ͖Δɻ
    վ͟Μ

    View full-size slide

  18. w վ͟Μ͞Εͨ਍அ݁Ռ͕දࣔɻ
    ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    ઃܭͷ্ݶΛ
    ௒͑ͨ఺਺
    λΠϓͷҰۃԽ΋
    ઃܭ࣌ͷ૝ఆ֎

    View full-size slide

  19. ʢ̏ʣϓϩΩγػೳͰ௨৴ͷվ͟Μ
    w खಈͰΞϓϦΛૢ࡞͍ͯ͠Δ͏ͪʹɺ

    "DUJWF4DBOͰ͸ݕ஌Ͱ͖ͳ͔ͬͨ੬ऑੑ΍ɺ

    ୳ࡧର৅͔Β࿙Ε͍ͯͨ63-Λൃݟɻ
    w 501ϖʔδͰϑΥʔϜͷόϦσʔγϣϯʢະೖྗ͸/(ʣΛ

    ͍͍͔ͯͨͤ͠ɺҎ߱ͷϖʔδ͸νΣοΫͰ͖͍ͯͳ͔ͬͨ໛༷ɻ

    View full-size slide

  20. ৼΓฦΓ
    w ͓खܰʹ੬ऑੑ਍அ࢜ͬΆ͍ؾ෼͸ຯΘ͑ͨɻ
    w "DUJWF4DBOͰ͸ݟ͔ͭΒͳ͍੬ऑੑ΋͋ͬͨͷͰɺ
    ϚχϡΞϧૢ࡞ˠ஌ࣝɾϊ΢ϋ΢͕ඞཁɻ

    ʢո͍͠ͱ͜Ζʹ౰ͨΓΛ͚ͭͯखಈνΣοΫʣ
    w ֎෦ͷ੬ऑੑ਍அΛड͚Δલʹɺ08"41;"1Ͱ
    ηϧϑνΣοΫΛ͢Δͷ͸༗Γ͔΋ɻ

    ʢ੬ऑੑ૞ࡧπʔϧج൫Λ࡞ͬͯࣾ಺։์ɺͱ͔ʣ

    View full-size slide

  21. ͓·͚τϐοΫ
    w ॳΊͯ"84΁ͷϖωετϨʔγϣϯਃ੥ͨ͠ɻ
    w ਃ੥ϑΥʔϜ͕ӳޠ0OMZͳͷͰɺ

    Կͱॻ͚͹͍͍ͷ͔೰Έͳ͕Βਃ੥ɻ
    w ͕ɺ࠷ۙϙϦγʔมΘͬͨΑ͏Ͱʮਃ੥ෆཁʯͱճ౴
    ͕͖ͨɻ
    w %P4߈ܸɺେن໛ΠϕϯτҎ֎͸ਃ੥ෆཁʁ
    w /%"ʢൿີอ࣋ܖ໿ʣͷక݁͸ඞཁʁʁ

    ˠ"84͞Μʹ໰͍߹ΘͤதͰ͢

    View full-size slide

  22. ͓·͚τϐοΫ
    w %PDLFSίϯςφ൛ͷ08"41;"1
    w ίϯςφΠϝʔδʹ೔ຊޠϑΥϯτ͕ೖ͍ͬͯͳ͍ɻ
    w 08"41;"1ͷ΢Οϯυ΢Λ࠷େදࣔʹ͍ͯ͠Δͱɺ
    όοΫάϥ΢ϯυͷผ΢Οϯυ΢ʹؾ͚ͮͳ͍ɻɻ

    ˡ͜͏͍͏ͷɻ
    w ಉ࣌ར༻͸ηογϣϯ·Ͱʁ

    ʢผϒϥ΢β͔Βಉ࣌ʹܨ͍ͩΒΤϥʔʹͳͬͨɻʣ

    View full-size slide

  23. ͓·͚τϐοΫ
    w %PDLFSίϯςφ൛ͷ08"41;"1
    w ίϯςφىಈ͢Δͨͼʹ/BNF͕มΘΔ༡ͼ৺
    w QSBDUJDBM@IFMMNBO
    w BHJUBUFE@NFSLMF
    w IFVSJTUJD@CFBWFS
    w CMJTTGVM@GFSNBU
    w WJHJMBOU@NPOUBMDJOJ
    w FBHFS@WBSBIBNJIJSB
    w ʜ
    ˞గਖ਼ʢਃ͠༁͋Γ·ͤΜͰͨ͠ʣ˞
    ͜Ε͸%PDLFSଆͷ࢓༷Ͱͨ͠ɻ
    Φʔϓϯιʔε൛%PDLFSͷίΞ෦෼Λ
    ίϯϙʔωϯτԽ͢Δʮ.PCZ1SPKFDUʯͱ͍͏
    औΓ૊Έ͕͋Γɺͦͷͳ͔ͷʮOBNFTHFOFSBUPSʯ
    Ͱίϯςφ໊Λੜ੒͍ͯ͠ΔΑ͏Ͱ͢ɻ
    ʢʡ@ʡͷࠨӈͷ୯ޠΛϥϯμϜͰ૊Έ߹Θͤʣ
    IUUQTHJUIVCDPNNPCZNPCZUSFFNBTUFS
    QLHOBNFTHFOFSBUPS

    View full-size slide