Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Application Hardening (Boot Camp 2019)

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →

Web Application Hardening (Boot Camp 2019)

2019年度リクルート新人ブートキャンプ エンジニアコースの講義資料です

Avatar for Recruit Technologies

Recruit Technologies

June 24, 2019

More Decks by Recruit Technologies

Other Decks in Technology

Transcript

  1. ߨٛͷεέδϡʔϧ 36 2 1 9 0 ( ( 1 5-89

    0 0: 0 5-89 0 ۭ͖࣌ؒʹ ࣌ؒఔ౓ 9 0
  2. • 6CVOUV4FSWFS-54 • 3VCZ • 3BJMT • #PPUTUSBQ • K2VFSZ

    • 6OJDPSO • 1)1 ߏ੒৘ใ  • *NBHF.BHJDL  • 42-JUF • WTGUQE  • /HJOY • OFUDBU  • GDHJXSBQ  ˘זו
  3. 0 1

  4. 2 2 2 1 2 'ϑϨʔϜදࣔ 'ϩάΠϯը໘ 'Ϣʔβొ࿥ը໘ 'ϩάΠϯ 'ϓϩϑΟʔϧը૾ొ࿥

    'Ϣʔβొ࿥ 'ϑϨʔϜඇදࣔ 'ϑϨʔϜදࣔ ϝΠϯը໘ʢ࣍ทʣ
  5. 'ϑϨʔϜදࣔ • ϝΠϯը໘ʢQVCMJDJOEFYIUNMʣ͸ϩʔυ௚ޙɺϩάΠϯ৘ใऔಘ"1*ʢ'4ʣ͔Βϩά Πϯঢ়ଶΛऔಘ • ະϩάΠϯঢ়ଶ • ΫΤϦετϦϯάʹSFTFU@UPLFO͕ઃఆ͞Ε͍ͯΔ৔߹ɺύεϫʔυ๨Εը໘Λදࣔ ͢Δʢ'4ʣ •

    ΫΤϦετϦϯάʹSFTFU@UPLFO͕ઃఆ͞Ε͍ͯͳ͍৔߹ɺϑϩʔςΟϯάJGSBNFΛ ։͖ɺϩάΠϯը໘ ' Λදࣔ͢Δ • ϩάΞ΢τ ' ͕ਖ਼ৗऴྃͨ͠৔߹͸ɺϑϩʔςΟϯάJGSBNFͰ࠶౓ϩάΠϯը໘ ' Λදࣔ͢Δ • ϑϩʔςΟϯάJGSBNFදࣔத͸ɺϝΠϯը໘ͷૢ࡞ΛϒϩοΫ͢Δ
  6.  'ϩάΠϯը໘ʢMPHJOIUNMʣ • ϩάΠϯ໊ͱύεϫʔυͰϩάΠϯՄೳͱ͢Δ • ೖྗՄೳจࣈ͸ɺ6OJDPEFͷ#BTJD-BUJOʢ6 ʙ 6 'ʣ ͷൣғͱ͢Δ

    • ϩάΠϯ໊ͱύεϫʔυ͸࠷େจࣈͱͳΔΑ͏ʹϑΥʔϜͰ੍ݶ͢Δ • ϩάΠϯϘλϯΛԡ͢ͱɺඇಉظͰϩάΠϯ ' Λ࣮ߦ͢Δ • ϩάΠϯ ' ͕ਖ਼ৗऴྃͨ͠ΒɺϑϨʔϜඇදࣔ ' Λ࣮ߦͯ͠ϩάΠϯը໘Λด͡ɺ ϝΠϯը໘ʹભҠ͢Δ • ϩάΠϯ ' ͕ҟৗऴྃͨ͠Βɺฦ٫͞ΕͨΤϥʔจݴΛදࣔ͢Δ
  7. 'ϩάΠϯʢ1045TFTTJPOTʣ 26 : k c i m / PL O

    c i m / a a (( ) a /4 T I k 206 R e a 6 S m • U T I D 66 2 n C
  8.  'Ϣʔβొ࿥ը໘ʢSFHJTUFSIUNMʣ • ද໊ࣔɺϩάΠϯ໊ɺϝʔϧΞυϨεɺύεϫʔυͷೖྗϑΥʔϜΛදࣔ͢Δ • ϩάΠϯ໊ɺϝʔϧΞυϨεɺύεϫʔυͷೖྗՄೳจࣈ͸ɺ6OJDPEFͷ#BTJD-BUJOʢ6 ʙ 6 'ʣ ͷൣғͱ͢Δ

    • ϩάΠϯ໊ɺύεϫʔυɺද໊ࣔ͸࠷େจࣈ·ͰɺϝʔϧΞυϨε͸࠷େจࣈ·Ͱͱ͢Δ • ද໊ࣔʹ͸೚ҙͷจࣈྻΛར༻Մೳ • ϓϩϑΟʔϧը૾ొ࿥ ' ͷͨΊɺը૾Λυϩοϓ͢ΔۣܗΤϦΞΛදࣔ͢Δ • ը૾͕υϩοϓ͞ΕͨΒɺඇಉظͰϓϩϑΟʔϧը૾ొ࿥ ' Λ࣮ߦ͢Δ • ϓϩϑΟʔϧը૾ొ࿥ ' ͕ҟৗऴྃͨ͠Βɺฦ٫͞ΕͨΤϥʔจݴΛදࣔ͢Δ • ར༻։࢝Ϙλϯ͕ԡ͞ΕͨΒɺඇಉظͰϢʔβొ࿥ ' Λ࣮ߦ͢Δ • Ϣʔβొ࿥͕ਖ਼ৗऴྃͨ͠ΒɺϑϨʔϜඇදࣔ ' Λ࣮ߦ͢Δ • Ϣʔβొ࿥ ' ͕ҟৗऴྃͨ͠Βɺαʔό͔Βฦ٫͞ΕͨΤϥʔจݴΛදࣔ͢Δ
  9. 'ϓϩϑΟʔϧը૾ొ࿥ʢ1045JDPOTʣ 4 8 4 2 0 2 m cT s

    4 2 m cT a :2 4 2/ 0 / 4 2 z z / x lx (( ) x 4 2/ 0 2 i _G I ic m cT lx 2::8: f e • :2 4 2/ 0 / 4 2 o Fr G I p r G I O PEm S • m cT F nJ N lx
  10. 'Ϣʔβొ࿥ʢ1045VTFSTʣ 4 4 / 4 0C s 4 / 2

    0C arDf 4 /492 0CkDo fpa 4 /:2940C 4 / : 4 :2940C i Do Ri o / u (( ) :294 slD R : slD R i Do u 4 nDkc D • 4 c_ms lD s kDo fpa Uw LS • i Do I T P i oOP ]D O i[oe U i Do LS • lD I lD 4 94kDoU LS
  11.  '4ύεϫʔυ๨Εը໘ʢQBTTXPSE@GPSHFUIUNMʣ • ϝʔϧΞυϨεͷೖྗϑΥʔϜΛදࣔ͢Δ • ૹ৴Ϙλϯ͕ԡ͞ΕͨΒɺඇಉظͰύεϫʔυϦηοτϝʔϧૹ৴ '4 Λ࣮ߦ͢Δ • ύεϫʔυϦηοτϝʔϧૹ৴

    '4 ͕ҟৗऴྃͨ͠Βɺαʔό͔Βฦ٫͞ΕͨΤϥʔจ ݴΛදࣔ͢Δ • ύεϫʔυϦηοτϝʔϧૹ৴ '4 ͕ਖ਼ৗऴྃͨ͠ΒɺϝʔϧΛૹ৴ͨ͜͠ͱΛࣔ͢จ ݴΛදࣔ͢Δ
  12. '4ύεϫʔυϦηοτϝʔϧૹ৴ʢ1045QBTTXPSE@SFTFUʣ /0 2==?: 31 4=4 4 2 B a D

    s n / B o B o (( ) o P o 4 : = d _ • a OF pm e _ i t ae _ k / S ei lT wr D ) 4=4 1 : 4 ( 4=4 1 : 4
  13.  '4ύεϫʔυϦηοτը໘ʢQBTTXPSE@SFTFUIUNMʣ • ৽͍͠ύεϫʔυͷೖྗϑΥʔϜΛදࣔ͢Δ • ૹ৴Ϙλϯ͕ԡ͞ΕͨΒɺΫΤϦετϦϯά͔ΒSFTFU@UPLFOΛநग़͠ɺඇಉظͰύε ϫʔυϦηοτ '4 Λ࣮ߦ͢Δ •

    ύεϫʔυϦηοτ '4 ͕ҟৗऴྃͨ͠Βɺαʔό͔Βฦ٫͞ΕͨΤϥʔจݴΛදࣔ͢ Δ • ύεϫʔυϦηοτ͕ਖ਼ৗऴྃͨ͠ΒɺϑϨʔϜඇදࣔ ' Λ࣮ߦ͢Δ
  14. '4ύεϫʔυϦηοτʢ165QBTTXPSE@SFTFUʣ 4 3 30 2: _ d 4 : L

    _ d / : : (( ) 2 U c e / 32 U U T a 3 R P
  15.  'ϑϨʔϜඇදࣔ • ϩάΠϯ ' ɺϢʔβొ࿥ ' ɺύεϫʔυϦηοτ '4 ͕ਖ਼ৗऴྃ͠ɺϩάΠϯঢ়

    ଶͱͳͬͨ৔߹͸ϑϩʔςΟϯάJGSBNFΛ࡟আ͢Δ • ϝΠϯը໘ͷૢ࡞ͷϒϩοΫΛղআ͢Δ
  16. 32 12 0/ 5 G4I / 5 E 5 E

    (( ) E D E D 'ϓϩϑΟʔϧը૾දࣔʢ(&5VTFSTJEJDPOʣ
  17. / 2 0 0 / 0 4T 3 4 4G

    = ? 4G E (( ) : 7 : '4༑ͩͪϦετʢ(&5GSJFOETʣ
  18. /4 3 4 0 3 2 3 2 / 3

    2 ? 9 a: T T 9 E : T 9 G : (( ) G = ? '4༑ͩͪݕࡧʢ(&5GSJFOETTFBSDIʣ
  19. / 0 0 /3 4 S2 O / 3T P

    3 P T: 3 P T: (( ) T P : P // /0 4 4 '༑ͩͪొ࿥ʢ1045GSJFOETʣ
  20. 21 / : : / 24 3 0 (( )

    21 'ϩάΞ΢τʢ%&-&5&TFTTJPOTʣ
  21. )( 0// 0// 84/ / 3 /2 P / _

    _ O _ P (( ) • 0// 84/ / S T ' T _ 'ςΩετ౤ߘʢ1045GFFETʣ
  22. 1 >? = 6? / / _t [ P i

    U20 uG p sr nsr Tl g (( ) B:B < B6 ? >? B E> B:B U O B:B U < B6 ? >? B E> U O ?6 6< 4U :<6 < B6 ? >? B E> :<6 U20 L O [ 6 m hO O yo20 [] OR] ea '40(1λά৘ใऔಘʢ(&5PQFO@HSBQIʣ
  23. ' )( 0// 5 0// 4/ 23 / d 23

    / f d T S / e a a ie O a ie P (( ) • 0// 4/ 23 / _ g e f _ a 'ը૾౤ߘʢ1045GFFETʣ
  24.  '৽ண౤ߘϩʔυ • ϝΠϯը໘͸ɺ࣍ϖʔδͷ৽ணϩʔυ"1*Λඵஔ͖ʹൃߦ͠ɺ৽ண౤ߘͷ਺Λऔಘ͢Δ • ৽ண౤ߘͷ਺͕݅Ҏ্͋Ε͹ɺը໘ʹʮ/݅ͷ৽ண౤ߘʯϘλϯΛදࣔ͢Δ • ৽ண౤ߘ͕݅ͷ৔߹ɺ·ͨ͸ҟৗऴྃͨ͠৔߹͸ɺϘλϯΛը໘͔Βফڈ͢Δ • ϘλϯΛԡͨ͠৔߹ɺ৽ண౤ߘ"1*Λൃߦ͠ɺ৽ண౤ߘͷϩʔυΛߦ͏

    • ݱࡏϩʔυ͍ͯ͠Δ౤ߘҎ߱ʹొ࿥͞Εͨશͯͷ౤ߘΛϩʔυ͢Δ • "1*ൃߦޙɺʮ/݅ͷ৽ண౤ߘʯϘλϯΛը໘͔Βফڈ͢Δ • ϩʔυͨ͠౤ߘΛը໘ʹදࣔ͢Δ • GJOE@OFXͱGJOE@PMEͷ"1*ͷج఺ͱ͢ΔͨΊɺը໘ʹදࣔ͞Ε͍ͯΔ࠷৽ͱ࠷ݹͷϑΟʔυ*%͸+BWB4DSJQUͰ؅ཧ͢Δ
  25. / 4332 4 20 3? 17 230 =3 ) 43320

    2 ( D E 17 230 =3 ( t I ID l =3 3 E / m g m f (( ) s ti d c_ G w • 17 230 =3 o u 1: = T r • e t T n '৽ண౤ߘϩʔυʢ(&5GFFETGFFE@JEGJOE@OFXʣ
  26.  'աڈ౤ߘϩʔυ • ϝΠϯը໘͸ɺաڈ౤ߘϩʔυ"1*Λൃߦ͠ɺը໘ʹදࣔ͞Ε͍ͯͳ͍ աڈ౤ߘͷ਺Λऔಘ͢Δ • աڈ౤ߘͷ਺͕݅Ҏ্͋Ε͹ɺը໘ʹʮ΋ͬͱಡΉʯϘλϯΛදࣔ͢Δ • ৽ண౤ߘ͕݅ͷ৔߹ɺ·ͨ͸ҟৗऴྃͨ͠৔߹͸ɺϘλϯΛදࣔ͠ͳ͍ •

    ϘλϯΛԡͨ͠৔߹ɺաڈ౤ߘ"1*Λൃߦ͠ɺաڈ౤ߘΛϩʔυ͢Δ • ݱࡏϩʔυ͍ͯ͠Δ౤ߘͷલʹొ࿥͞Ε͍ͯΔ݅෼ͷ౤ߘΛϩʔυ͢Δ • "1*ൃߦޙɺʮ΋ͬͱಡΉʯϘλϯΛը໘͔Βফڈ͢Δ • ϩʔυͨ͠౤ߘΛը໘ʹදࣔ͠ɺ࠶౓ɺաڈ౤ߘͷ਺Λऔಘ͢Δ • աڈ౤ߘ͕·ͩଘࡏ͢Δ৔߹͸ɺʮ΋ͬͱಡΉʯϘλϯΛ࠶ͼදࣔ͢Δ
  27. / 4332 4 920: 2 91 230 =3 ) 43320

    2 ( r D 91 230 =3 ( l 9=3 3 D / m g m f (( ) E i s d c_ • 91 230 =3 I G? I ?1: 9= T t • e T o • n i u 'աڈ౤ߘϩʔυʢ(&5GFFETGFFE@JEGJOE@PMEʣ
  28. 100/ 125/ 3/)25 3 /0 2 04 ( / m

    sm sm (( ) ci d T = f • tl ul d ?G • o ?G_ dEen ?G '౤ߘϩʔυʢ(&5GFFETʣ
  29. / (( ) 1 5 5 5a d e 5

    ' 5a c 5 _ e 5 e 5 ౤ߘϩʔυػೳͷϨεϙϯεϘσΟ
  30. ( ) 2 0 3 3 E / (( )

    a 5 G4 • T / G4 • G4 '4ϢʔβҰཡऔಘʢ(&5VTFSTʣ
  31.  ݕࠪͷείʔϓ • ݕࠪର৅͸ 5$1͔ΒΞΫηεͰ͖Δ.BJM)PHΛআ͍ͨશͯͷػೳͰ͢ • .BJM)PHʹؔͯ͠͸ࣾ಺ωοτϫʔΫ͔Β֎ʹϝʔϧ͕ૹ৴͞ΕΔػೳΛ࡞Δ ͜ͱ͕೉͔ͬͨ͠ɺͱ͍͏։ൃ্ͷ౎߹Ͱ༻ҙ͍ͯ͠·͢ • ࣮ࡍʹ͸ϝʔϧ͸ૹ৴͞Ε͍ͯΔ΋ͷͱࢥͬͯݕࠪΛߦ͍ͬͯͩ͘͞

    • αʔόʹΠϯετʔϧ͞Ε͍ͯΔιϑτ΢ΣΞ͕ݪҼͱͳͬͯى͜Δ੬ऑ ੑ΋ 5$1Λ௨ͯ͠߈ܸ͕ՄೳͰ͋Ε͹ର৅ʹؚΈ·͢ • ϛυϧ΢ΣΞͷઃఆෆඋ͕ݪҼͰى͜Δ੬ऑੑ΋ର৅ʹؚΈ·͢
  32.  ݕࠪର৅ͱ͢Δ੬ऑੑ • ຊߨٛͰ͸ɺϏδωεϦεΫͷߴ͍੬ऑੑͷΈΛݕࠪͷର৅ͱ͠·͢ • ۩ମతʹ͸ҎԼΑ͏ͳࣄ৅ΛҾ͖ى͜͢੬ऑੑͰ͢ u ೚ҙίʔυ࣮ߦ u ೚ҙ04ίϚϯυ࣮ߦ

    u ҰൠϢʔβʹଞϢʔβͷ ݸਓ৘ใʢϝʔϧΞυϨεɺ ύεϫʔυϋογϡʣ͕࿙Ӯ u ؅ཧऀϢʔβʹଞϢʔβͷ ฏจύεϫʔυ͕࿙Ӯ u σʔλϕʔεͷෆਖ਼ૢ࡞ u ଞͷϢʔβʹͳΓ͢·ͯ͠ ϩάΠϯ΍౤ߘ͕Ͱ͖Δ u αʔό্ͷ೚ҙͷϑΝΠϧ͕ ಡΈग़ͤΔ u ଞϢʔβͷϒϥ΢βͰ೚ҙͷ +BWBTDSJQU͕࣮ߦͰ͖Δ
  33. ஫ҙࣄ߲  • ଞͷडߨऀʹରͯ͠߈ܸΛ࢓ֻ͚ͳ͍͜ͱ • ීஈͷύεϫʔυ΍ϝʔϧΞυϨεΛ࢖Θͳ͍͜ͱ • 8FCΞϓϦʹ͸੬ऑੑ͕͋ΔͨΊɺߨࢣʹόϨΔڪΕ͕͋Γ·͢ • ԋशͷճ౴͸ൿີʹ͢Δ͜ͱ

    • ԋशظؒத͸1VCMJDͳ(JU)VCͳͲͰ؅ཧͯ͠΋Β͔ͬͯ·͍·ͤΜ͕ɺԋ शऴྃޙʹ͸ඞͣ1SJWBUFʹ͢Δ͔࡟আ͍ͯͩ͘͠͞ • ࣗशύʔτʹ͍ͭͯɺଞͷߨٛͷ࣌ؒதʹ಺৬͠ͳ͍͜ͱʂ • ๻ౖ͕ΒΕ·͢ʂ
  34.  %#εΩʔϚɾϞσϧ        

                                                          VTFSIBT@NBOZ GSPN@VTFS GSPN@VTFS CFMPOHT@UP VTFS VTFSIBT@NBOZ UP@VTFS UP@VTFS CFMPOHT@UP VTFS VTFSIBT@NBOZ UP@VTFS UISPVHIGSJFOET TPVSDFUP@VTFS VTFSIBT@NBOZ GSPN@VTFS UISPVHIGSJFOETTPVSDFGSPN@VTFS VTFSIBT@NBOZ GFFE GFFECFMPOHT@UP VTFS
  35. ώϯτ #   7 / 01 5 74 7

    7 - 1 67E 7 / 01 5 74 7 7 6 5 - 1 5 5 / 01 5 74 7 8 7 6 - 1 67E 8 7 6 74 5: - 1 74 5: 8776 - 1 67E 8776 / 01 5 74 7 7 39 4 : - 1 67E 4 63 7 7 7 7 3 7 /21 64 7 G ˞੬ऑੑ͕ෳ਺ͷ"1*ʹ·͕ͨΔ৔߹͸ݦࡏԽ͢ΔՕॴͷΈΧ΢ϯτ