Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Application Hardening

Web Application Hardening

2017年4~5月開催「ブートキャンプ特別講座」の資料になります。

Recruit Technologies

June 02, 2017
Tweet

More Decks by Recruit Technologies

Other Decks in Technology

Transcript

  1. 闌纏ךأ؛آُ٦ٕ     儎⠅׫  闌纏ך铡僇 怴统腚䓲䚍䱱׃ה⥜姻 剢傈

    剢 剢傈 抟 怴统ךؼٝز 怴统׾竲ֽ׋ְ➂כ⟣䠐ד      儎⠅׫ 怴统腚䓲䚍䱱׃ה⥜姻 怴统余䷼Ꟛ㨣ה⾱㔓锃叨 
  2. *OUFSOFU ؟٦غך圓䧭 • 6CVOUV4FSWFS-54 • 3VCZ • 3VCZPO3BJMT • /HJOY

    • 6OJDPSO • *NBHF.BHJDL Y • .Z42-B ؟٦غث٦ي" *1 UDQ ؟٦غث٦ي# *1 UDQ
  3. ׮׃׮8FC،فָٔ㠨׸׋׵ • TTIד8FC؟٦غחؚٗ؎ٝ׃ծ⟃♴ך䩛갫ד䗁傊׃גֻ׌ְׁ $ cd /var/www/app/ $ mv sns sns.old

    $ git clone https://github.com/nishimunea/bootcampsns sns $ sudo chown –R www-data.www-data sns $ sudo /etc/init.d/unicorn start
  4. ؚٗ؎ٝせ ػأٙ٦س ؚٗ؎ٝ #PPU$BNQ4/4 倜鋉ⵃ欽כֿ׍׵ ؒٓ٦⳿⸂ ؚٗ؎ٝ钠鏾ؒٓ٦ 倜鋉ⵃ欽כֿ׍׵ ؚٗ؎ٝせ ػأٙ٦س

    ⵃ欽Ꟛ㨣 ِ٦ؠ涫ꐮ ؒٓ٦⳿⸂ 邌爙せ 歗⫷ ،حف ٗ٦س ؚٗ؎ٝ䧭⸆ ⵃ欽Ꟛ㨣䧭⸆ ⵃ欽Ꟛ㨣ؒٓ٦ 钠鏾ؒٓ٦٥ ؚٗ،ؐز 铣׫鴥׫ ㊯׷俑㶵⟃ⰻ ח׃׬י֮ ײתך   ח׃׬י֮   爡㆞鏾זֻ׃׋ "QQMFJ1IPOFחג乆䕦 ⟝ך倜滠䫎珲 ׮׏ה铣׬
  5. ㊯׷俑㶵⟃ⰻ ח׃׬י֮ ײתך   ח׃׬י֮   爡㆞鏾זֻ׃׋ "QQMFJ1IPOFחג乆䕦

    ⟝ך倜滠䫎珲 ׮׏ה铣׬ ؚٗ؎ٝせ ػأٙ٦س ؚٗ؎ٝ #PPU$BNQ4/4 倜鋉ⵃ欽כֿ׍׵ ؒٓ٦⳿⸂ ؚٗ؎ٝ钠鏾ؒٓ٦ ؚٗ؎ٝせ ػأٙ٦س ⵃ欽Ꟛ㨣 ِ٦ؠ涫ꐮ ؒٓ٦⳿⸂ 邌爙せ 歗⫷ ،حف ٗ٦س ؚٗ؎ٝ䧭⸆ ⵃ欽Ꟛ㨣䧭⸆ ⵃ欽Ꟛ㨣ؒٓ٦ 钠鏾ؒٓ٦٥ ؚٗ،ؐز 铣׫鴥׫ 'ؿٖ٦ي邌爙 'ؚٗ؎ٝ歗꬗ 'ِ٦ؠ涫ꐮ歗꬗ 'ؚٗ؎ٝ 'فٗؿ؍٦ٕ歗⫷涫ꐮ 'ِ٦ؠ涫ꐮ 'ؿٖ٦يꬊ邌爙 'ؿٖ٦ي邌爙 ً؎ٝ歗꬗如갤 倜鋉ⵃ欽כֿ׍׵
  6. ㊯׷俑㶵⟃ⰻ ח׃׬י֮ ײתך  ח׃׬י֮  爡㆞鏾זֻ׃׋ "QQMFJ1IPOFחג乆䕦 ⟝ך倜滠䫎珲 ׮׏ה铣׬

    'ذؗأز䫎珲 '倜滠䫎珲ٗ٦س 'فٗؿ؍٦ٕ歗⫷邌爙 '䫎珲ٗ٦س '麓⿠䫎珲ٗ٦س 歗⫷׾䫎珲 ⿼➂׾涫ꐮ ؚٗ،ؐز '歗⫷䫎珲 '⿼➂涫ꐮ 'ؚٗ،ؐز
  7. 'ؿٖ٦ي邌爙 • ً؎ٝ歗꬗QVCMJDJOEFYIUNMכٗ٦س湫䖓ծMPDBM4UPSBHFחِ٦ؠ䞔㜠ָ ろת׸גְ׷ֿה׾然钠 • ِ٦ؠせָ呓秛ׁ׸גְזֽ׸לծؿٗ٦ذ؍ؚٝJGSBNF׾Ꟛֹծ ؚٗ؎ٝ歗꬗ ' ׾邌爙ׅ׷ •

    ً؎ٝ歗꬗כծ"1*ךٖأهٝأ؝٦سָ鵤⽱ׁ׸׋㜥さծ$PPLJFךإحءّٝ䞔㜠ָ 搀⸬⻉٥֮׷ְכ㣟⸬׃׋׮ךהⴻ倖׃ծ䓼ⵖ涸חؚٗ،ؐز ' ׾遤ֲ • ؚٗ،ؐز ' ָ姻䌢穄✪׃׋㜥さכծMPDBM4UPSBHFח呓秛ׁ׸׋ِ٦ؠ䞔㜠׾⵴ꤐ׃ծ ؿٗ٦ذ؍ؚٝJGSBNFדⱄ䏝ؚٗ؎ٝ歗꬗ ' ׾邌爙ׅ׷ • ؿٗ٦ذ؍ؚٝJGSBNF邌爙⚥כծً؎ٝ歗꬗ך乼⡲׾ـٗحؙׅ׷
  8. 'ؚٗ؎ٝ歗꬗MPHJOIUNM • ؚٗ؎ٝせהػأٙ٦سדؚٗ؎ٝ〳腉הׅ׷ ˉ Ⰵ⸂〳腉俑㶵כծ6OJDPEFך#BTJD-BUJO6 ։ 6 ' ך眔㔲הׅ׷ ˉ

    ؚٗ؎ٝせהػأٙ٦سכ剑㣐俑㶵הז׷״ֲחؿؓ٦يדⵖꣲׅ׷ • ؚٗ؎ٝنةٝ׾䬃ׅהծꬊず劍דؚٗ؎ٝ ' ׾㹋遤ׅ׷ • ؚٗ؎ٝ ' ָ姻䌢穄✪׃׋׵ծ؟٦غַ׵鵤⽱ׁ׸׋ِ٦ؠ䞔㜠׾MPDBM4UPSBHFח 呓秛׃ծؿٖ٦يꬊ邌爙 ' ׾㹋遤׃גؚٗ؎ٝ歗꬗׾ꟗׄծً؎ٝ歗꬗ח鼂獳ׅ׷ • ؚٗ؎ٝ ' ָ殯䌢穄✪׃׋׵ծ鵤⽱ׁ׸׋ؒٓ٦俑鎉׾邌爙ׅ׷
  9. 'ؚٗ؎ٝ1045TFTTJPOT 㹋鄲⢽ 1045TFTTJPOT ؙٔؒأزنر؍ VTFSؚٗ؎ٝせ䗳갭٥俑㶵⴨ QBTTػأٙ٦س䗳갭٥俑㶵⴨ ٖأهٝأ؝٦س 姻䌢穄✪ 殯䌢穄✪ ٖأهٝأنر؍

    BQQMJDBUJPOKTPO 姻䌢穄✪ OBNFؚٗ؎ِٝ٦ؠך邌爙せ JDPOفٗؿ؍٦ٕ歗⫷63- 殯䌢穄✪ FSSPSTؒٓ٦ًحإ٦آꂁ⴨ ⪒罋 • إحءّٝ䞔㜠ِ٦ؠ*%׾$PPLJFח鎸ꐮ׃תׅ
  10. 'ِ٦ؠ涫ꐮ歗꬗SFHJTUFSIUNM • 邌爙せծؚٗ؎ٝせծػأٙ٦سךⰅ⸂ؿؓ٦ي׾邌爙ׅ׷ ˉ ؚٗ؎ٝせהػأٙ٦سךⰅ⸂〳腉俑㶵כծ6OJDPEFך#BTJD-BUJO6 ։ 6 ' ך眔㔲הׅ׷ ˉ

    ؚٗ؎ٝせծػأٙ٦سծ邌爙せכ剑㣐俑㶵תדהׅ׷ ˉ 邌爙せחכ⟣䠐ך俑㶵⴨׾ⵃ欽〳腉 • فٗؿ؍٦ٕ歗⫷涫ꐮ ' ך׋׭ծ歗⫷׾سٗحفׅ׷瀂䕎ؒٔ،׾邌爙ׅ׷ ˉ 歗⫷ָسٗحفׁ׸׋׵ծꬊず劍דفٗؿ؍٦ٕ歗⫷涫ꐮ ' ׾㹋遤ׅ׷ ˉ فٗؿ؍٦ٕ歗⫷涫ꐮ ' ָ殯䌢穄✪׃׋׵ծ鵤⽱ׁ׸׋ؒٓ٦俑鎉׾邌爙ׅ׷ • ⵃ欽Ꟛ㨣نةָٝ䬃ׁ׸׋׵ծꬊず劍דِ٦ؠ涫ꐮ ' ׾㹋遤ׅ׷ • ِ٦ؠ涫ꐮָ姻䌢穄✪׃׋׵ծ؟٦غַ׵鵤⽱ׁ׸׋ِ٦ؠ䞔㜠׾ MPDBM4UPSBHFח呓秛׃ծؿٖ٦يꬊ邌爙 ' ׾㹋遤ׅ׷ • ِ٦ؠ涫ꐮ ' ָ殯䌢穄✪׃׋׵ծ؟٦غַ׵鵤⽱ׁ׸׋ؒٓ٦俑鎉׾邌爙ׅ׷
  11. 'فٗؿ؍٦ٕ歗⫷涫ꐮ1045JDPOT 㹋鄲⢽ 1045JDPOT ؙٔؒأزنر؍ GJMFOBNF歗⫷ؿ؋؎ٕせ䗳갭٥俑㶵⴨ GJMF歗⫷ؿ؋؎ٕ䗳갭٥غ؎شٔ SFTJ[F@NBY@QJYFMٔ؟؎ؤ儗ך剑㣐ؾؙإٕ侧⟣䠐٥侭侧 ٖأهٝأ؝٦س 姻䌢穄✪ 殯䌢穄✪

    ٖأهٝأنر؍ BQQMJDBUJPOKTPO 姻䌢穄✪ GJMF@OBNF،حفٗ٦سׁ׸׋فٗؿ؍٦ٕ歗⫷ךؿ؋؎ٕせ 殯䌢穄✪ FSSPSTؒٓ٦ًحإ٦آ ⪒罋 • SFTJ[F@NBY@QJYFMח剣⸬ז⦼ָ䭷㹀ׁ׸׋㜥さծ䭷㹀ׁ׸׋ؾؙإٕ⟃ⰻח ת׷״ֲ歗⫷׾ٔ؟؎ؤׅ׷ • 歗⫷ؿ؋؎ָٕ1/(ծ(*'ծ+1&(⟃㢩ד֮׸לծ殯䌢穄✪ׅ׷
  12. 'ِ٦ؠ涫ꐮ1045VTFST 㹋鄲⢽ 1045VTFST ؙٔؒأزنر؍ VTFS<VTFS>ؚٗ؎ٝせ䗳갭٥俑㶵⴨ VTFS<QBTT>ػأٙ٦س䗳갭٥俑㶵⴨ VTFS<OBNF>邌爙せ䗳갭٥俑㶵⴨ VTFS<JDPO@GJMF@OBNF>فٗؿ؍٦ٕ歗⫷ךؿ؋؎ٕせ⟣䠐٥俑㶵⴨ ٖأهٝأ؝٦س 姻䌢穄✪

     殯䌢穄✪ ٖأهٝأنر؍ BQQMJDBUJPOKTPO 姻䌢穄✪ OBNFؚٗ؎ِٝ٦ؠך邌爙せ JDPOؚٗ؎ِٝ٦ؠךفٗؿ؍٦ٕ歗⫷63- 殯䌢穄✪ FSSPSTؒٓ٦ًحإ٦آ ⪒罋 • $PPLJFחإحءّٝ䞔㜠ِ٦ؠ*%׾鎸ꐮ׃תׅ • فٗؿ؍٦ٕ歗⫷ָ䭷㹀ׁ׸גְזְַծ姻׃ְ歗⫷ؿ؋؎ٕדזְ㜥さծ ؟٦غ⩎ד欽䠐׃׋رؿٕؓز歗⫷׾فٗؿ؍٦ٕ歗⫷ח鏣㹀׃תׅ
  13. 'ذؗأز䫎珲1045GFFET 㹋鄲⢽ 1045GFFET ؙٔؒأزنر؍ GFFE@UZQFUFYU䗳갭٥俑㶵⴨ DPNNFOU؝ًٝز䗳갭٥俑㶵⴨ ٖأهٝأ؝٦س 姻䌢穄✪ 殯䌢穄✪ ♶姻זؙٔؒأز

    殯䌢穄✪ ♶姻זإحءّٝ ٖأهٝأنر؍ BQQMJDBUJPOKTPO ז׃ ⪒罋 • GFFE@UZQFָUFYU⟃㢩ך㜥さծ俑㶵⴨ָ俑㶵⟃♳ך㜥さכ殯䌢穄✪ׅ׷
  14. '歗⫷䫎珲1045GFFET 㹋鄲⢽ 1045GFFET ؙٔؒأزنر؍ GFFE@UZQFJNBHF䗳갭٥俑㶵⴨ JNBHF歗⫷ؿ؋؎ٕ 䗳갭٥غ؎شٔ ٖأهٝأ؝٦س 姻䌢穄✪ 殯䌢穄✪

    ♶姻זؙٔؒأز 殯䌢穄✪ ♶姻זإحءّٝ ٖأهٝأنر؍ BQQMJDBUJPOKTPO ז׃ ⪒罋 • GFFE@UZQFָJNBHF⟃㢩ך㜥さծ䫎珲ׁ׸׋ؿ؋؎ָٕ姻׃ְ歗⫷דזְ㜥さכ殯䌢穄✪ׅ׷
  15. '倜滠䫎珲ٗ٦س • ً؎ٝ歗꬗כծ如ل٦آך倜滠ٗ٦س"1*׾猱縧ֹח涪遤׃ծ倜滠䫎珲ך侧׾《䖤ׅ׷ • 倜滠䫎珲ך侧ָ⟝⟃♳֮׸לծ歗꬗חչ/⟝ך倜滠䫎珲պنةٝ׾邌爙ׅ׷ ˉ 倜滠䫎珲ָ⟝ך㜥さծת׋כ殯䌢穄✪׃׋㜥さכծنةٝ׾歗꬗ַ׵嶊⿠ׅ׷ • نةٝ׾䬃׃׋㜥さծ倜滠䫎珲"1*׾涪遤׃ծ倜滠䫎珲ךٗ٦س׾遤ֲ ˉ

    植㖈ٗ٦س׃גְ׷䫎珲⟃꣬ח涫ꐮׁ׸׋Ⰻגך䫎珲׾ٗ٦سׅ׷ ˉ "1*涪遤䖓ծչ/⟝ך倜滠䫎珲պنةٝ׾歗꬗ַ׵嶊⿠ׅ׷ ˉ ٗ٦س׃׋䫎珲׾歗꬗ח邌爙ׅ׷ ˉ GJOE@OFXהGJOE@PMEך"1*ך㛇挿הׅ׷׋׭ծ歗꬗ח邌爙ׁ׸גְ׷剑倜ה剑〢ךؿ؍٦س*%כ+BWB4DSJQUד盖椚ׅ׷
  16. '倜滠䫎珲ٗ٦س(&5GFFETGFFE@JEGJOE@OFX 㹋鄲⢽ (&5GFFETGJOE@OFX JODMVEF@JUFNT ؙٔؒأزنر؍ GFFE@JE 㛇挿הׅ׷ؿ؍٦س*%䗳갭٥侭侧 JODMVEF@JUFNT 䫎珲ⰻ㺁׾《䖤ׅ׷ַやַ⟣䠐٥JOUFHFS ٖأهٝأ؝٦س

    姻䌢穄✪ 殯䌢穄✪ ♶姻זؙٔؒأز 殯䌢穄✪ ♶姻זإحءّٝ ٖأهٝأنر؍ BQQMJDBUJPOKTPO 䖓鶢ךչ䫎珲ٗ٦س堣腉ךٖأهٝأنر؍պ׾⿫撑 ⪒罋 • JODMVEF@JUFNTָ㶷㖈׃זְծת׋כ⦼ָ⟃㢩ך㜥さծDPVOUך׫鵤⽱ׅ׷ • ِ٦ؠ劤➂ה׉ך⿼➂ך䫎珲ך׫《䖤〳腉הׅ׷
  17. '麓⿠䫎珲ٗ٦س • ً؎ٝ歗꬗כծ麓⿠䫎珲ٗ٦س"1*׾涪遤׃ծ歗꬗ח邌爙ׁ׸גְזְ 麓⿠䫎珲ך侧׾《䖤ׅ׷ • 麓⿠䫎珲ך侧ָ⟝⟃♳֮׸לծ歗꬗חչ׮׏ה铣׬պنةٝ׾邌爙ׅ׷ ˉ 倜滠䫎珲ָ⟝ך㜥さծת׋כ殯䌢穄✪׃׋㜥さכծنةٝ׾邌爙׃זְ • نةٝ׾䬃׃׋㜥さծ麓⿠䫎珲"1*׾涪遤׃ծ麓⿠䫎珲׾ٗ٦سׅ׷

    ˉ 植㖈ٗ٦س׃גְ׷䫎珲ך⵸ח涫ꐮׁ׸גְ׷⟝ⴓך䫎珲׾ٗ٦سׅ׷ ˉ "1*涪遤䖓ծչ׮׏ה铣׬պنةٝ׾歗꬗ַ׵嶊⿠ׅ׷ ˉ ٗ٦س׃׋䫎珲׾歗꬗ח邌爙׃ծⱄ䏝ծ麓⿠䫎珲ך侧׾《䖤ׅ׷ ˉ 麓⿠䫎珲ָת׌㶷㖈ׅ׷㜥さכծչ׮׏ה铣׬պنةٝ׾ⱄן邌爙ׅ׷
  18. '麓⿠䫎珲ٗ٦س(&5GFFETGFFE@JEGJOE@PME 㹋鄲⢽ (&5GFFETGJOE@PME JODMVEF@JUFNT ؙٔؒأزنر؍ GFFE@JE 㛇挿הׅ׷ؿ؍٦س*%䗳갭٥侭侧 JODMVEF@JUFNT 䫎珲ⰻ㺁׾《䖤ׅ׷ַやַ⟣䠐٥JOUFHFS ٖأهٝأ؝٦س

    姻䌢穄✪ 殯䌢穄✪ ♶姻זؙٔؒأز 殯䌢穄✪ ♶姻זإحءّٝ ٖأهٝأنر؍ BQQMJDBUJPOKTPO 䖓鶢ךչ䫎珲ٗ٦س堣腉ךٖأهٝأنر؍պ׾⿫撑 ⪒罋 • JODMVEF@JUFNTָ㶷㖈׃זְծת׋כ⦼ָ⟃㢩ך㜥さծDPVOUך׫鵤⽱ׅ׷ • ِ٦ؠ劤➂ה׉ך⿼➂ך䫎珲ך׫《䖤〳腉הׅ׷ • ♧䏝חٗ٦سׅ׷麓⿠䫎珲כ剑㣐⟝הׅ׷
  19. '䫎珲ٗ٦س(&5GFFET 㹋鄲⢽ (&5GFFETGJOE@PME JODMVEF@JUFNT ؙٔؒأزنر؍ ז׃ ٖأهٝأ؝٦س 姻䌢穄✪ 殯䌢穄✪ ♶姻זؙٔؒأز

    殯䌢穄✪ ♶姻זإحءّٝ ٖأهٝأنر؍ BQQMJDBUJPOKTPO 䖓鶢ךչ䫎珲ٗ٦س堣腉ךٖأهٝأنر؍պ׾⿫撑 ⪒罋 • ِ٦ؠ劤➂ה׉ך⿼➂ך䫎珲ך׫《䖤〳腉הׅ׷ • ♧䏝חٗ٦سׅ׷麓⿠䫎珲כ剑㣐⟝הׅ׷
  20. "1*♧鋮  ػأ ًاحس ،ؙءّٝせ 㼎䘔ׅ׷堣腉  TFTTJPOT 1045 DSFBUF

    'ؚٗ؎ٝ  TFTTJPOT %&-&5& EFTUSPZ 'ؚٗ،ؐز  VTFST 1045 DSFBUF 'ِ٦ؠ涫ꐮ  VTFSTNBOBHF (&5 NBOBHF ِ٦ؠ盖椚盖椚罏ぢֽ堣腉  VTFSTJEJDPO (&5 JDPO 'فٗؿ؍٦ٕ歗⫷邌爙  JDPOT 1045 DSFBUF 'فٗؿ؍٦ٕ歗⫷涫ꐮ  GSJFOET 1045 DSFBUF ' ⿼➂涫ꐮ  GFFET (&5 JOEFY ' 䫎珲ٗ٦س  GFFET 1045 DSFBUF 'ذؗأز䫎珲 '歗⫷䫎珲  GFFETGFFE@JEGJOE@OFX (&5 GJOE@OFX '倜滠䫎珲ٗ٦س  GFFETGFFE@JEGJOE@PME (&5 GJOE@PME '麓⿠䫎珲ٗ٦س
  21. ٌرٕ♧鋮 VTFST JE JOUFHFS VTFS TUSJOH OBNF TUSJOH QBTT TUSJOH

    BENJO CPPMFBO JDPO@GJMF@OBNF TUSJOH GSJFOET JE JOUFHFS GSPN@VTFS@JE JOUFHFS UP@VTFS@JE JOUFHFS GFFET JE JOUFHFS UZQF TUSJOH VTFS@JE JOUFHFS JNBHF@GJMF@OBNF TUSJOH FYJG TUSJOH DPNNFOU TUSJOH VTFSIBT@NBOZ GSPN@VTFS GSPN@VTFS CFMPOHT@UP VTFS VTFSIBT@NBOZ UP@VTFS UP@VTFS CFMPOHT@UP VTFS VTFSIBT@NBOZ UP@VTFS UISPVHIGSJFOET TPVSDFUP@VTFS VTFSIBT@NBOZ GSPN@VTFS UISPVHIGSJFOETTPVSDFGSPN@VTFS VTFSIBT@NBOZ GFFE GFFECFMPOHT@UP VTFS
  22. ؼٝز  ػأ ًاحس ،ؙءّٝせ ؽآطأٔأؙך넝ְ腚䓲䚍ך侧  TFTTJPOT 1045 DSFBUF

    ⦐  TFTTJPOT %&-&5& EFTUSPZ ז׃  VTFST 1045 DSFBUF ⦐  VTFSTNBOBHF (&5 NBOBHF ⦐  VTFSTJEJDPO (&5 JDPO ⦐  JDPOT 1045 DSFBUF ⦐  GSJFOET 1045 DSFBUF ז׃  GFFET (&5 JOEFY ⦐  GFFET 1045 DSFBUF ⦐  GFFETGFFE@JEGJOE@OFX (&5 GJOE@OFX ז׃  GFFETGFFE@JEGJOE@PME (&5 GJOE@PME ז׃