20190227 JAWS DAYS 2019 re:Verse

20190227 JAWS-UG 初心者支部
20190306 #ssmjp
20190412 OWASP Sendai
でお話したJAWS DAYS 2019の裏側について、こんなことをやった！ということを引き継ぐ上での資料ともなるよう作成し、自分なりのアウトプットとして登壇した資料を公開します。
#jawsug_bgnr #jawsdays #jawsug #ssmjp #owaspsendai

Transcript

1. View Slide

2. ຬ׽શ੮͓඼ॻ͖
   w ࣮ߦҕһϝϯόʔબఆ
   w ςʔϚܾΊ
   w ࡢ೥ͷݟ௚͠
   w όοΫϩά؅ཧํ๏
   w εέδϡʔϧ࡞੒
   w ϨΠΞ΢τܾΊ
   w λΠϜςʔϒϧܾΊ
   w ηογϣϯΧςΰϦܾΊ
   w ໾ׂ෼୲
   w 8FCܝࡌσϦόϦ
   w ෺ཧϑΝγϦςΟܾΊ
   w $BMMGPS1BQFSTϧʔϧ
   w αϙʔλʔґཔ
   w αϙʔλɾελοϑ؅
   ཧ
   w 5γϟπ࡞੒
   w χϡʔεͷଧͪํ
   w ༧ࢉ؅ཧ
   w άοζ࡞੒
   w 3PBE5SJQ όε
   ͷੋඇ
   w εΧϥʔγοϓ
   w લ໷ࡇ
   w ֤ҕһϝϯόʔʹΑΔاը
   w ϥϯν
   w Ϩγʔόʔ؅ཧ
   w ௥ՃΠϕϯτ
   w ελοϑखॱॻ࡞੒
   w خ͍͠൵໐ͱޡࢉ
   w ࠙਌ձ
   w ౰೔ͷ՝୊
   w ࠓޙͷ՝୊ɾҾ͖ܧ͗
   

   View Slide

3. ࣮ߦҕһϝϯόʔબఆ
   w "84+পޱ͞Μ͔ΒΦϑΝʔ ͜ͷ೔͸໺ໟͰ"84+੢୩͞ΜΛғ͏ձ
   
   w ࡢ೥ͷ࣮ߦҕһ৿͞Μɾҏ౻͞Μ ͱ΋ʹ+"846(ؔ੢
   ͱͷڮ౉͠ͰࢁԼ
   ͞Μ͕ܾ·ͬͯͨ
   w ໺ໟҿΈձʹେڮ͞Μɺ੉ށౡ͞Μ͕͍ͯɺ੠͔͔͍ͬͯͨ
   w ଞʹϝϯόʔΛΞαΠϯ͍͍ͯ͠ΑͱݴΘΕͯɺࠓ·ͰҰॹʹίϛϡχςΟ
   ׆ಈͨ͜͠ͱͳ͍ࢁ࡚͞Μɺࠤʑ໦͞ΜɺԦ͞ΜʹΦϑΝʔͯ͠ঝ୚͑ͨ
   

   View Slide

4. ࣮ߦҕһϝϯόʔબఆ
   w ٢ߐɿ๭4*
   w ࢁԼɿ๭τϨʔχϯάاۀ
   w େڮɿ๭௨৴
   w ੉ށౡɿ๭4*
   w ࢁ࡚ɿ๭ཱྀߦ
   w ࠤʑ໦ɿ๭௨৴
   w Ԧɿ๭αʔϏεࣄۀ
   

   View Slide

5. ςʔϚܾΊ
   w ࡢ೥ͷςʔϚΛݟͭͭɺςʔϚΛҰਓͭͣͭ
   w $SPTT0WFSͱຬ׽શ੮͕ಉҰථͰɺ݁ՌΞϛμ͘͡
   w ܾ·ͬͨͷ͕ɺɺɺɺɺ
   

   View Slide

6. ຬ
   ׽
   શ
   ੮
   

   View Slide

7. ςʔϚܾΊ
   w ͔ͤͬ͘த՚ͳײ͡΍͠ɺϩΰ΋ࠓճ༻ʹͭͬͪ͘Ό͓͏ͥʂ
   

   View Slide

8. ຬ
   ׽
   શ
   ੮
   

   View Slide

9. ςʔϚܾΊ
   w ͪΐ͏Ͳɺ৽ϩΰ ·ͩΧϥʔ͡Όͳ͍
   ग़͖ͯͨ͠ɺچϩΰͱத՚ྉཧͱࠞ
   ͥ߹Θͤͯίϯςφੜ΍ͦ͏ͥʂ
   

   View Slide

10. https://jawsdays2019.jaws-ug.jp/
    

    View Slide

11. ࡢ೥ͷݟ௚͠
    w ࡢ೥ͷ͔͔ͬͨඅ༻Λ֬ೝ͠ɺݟ௚͍ͨ͠ϙΠϯτΛ֬ೝ
    w खಈ޻਺ΛҎԼʹ؆୯ʹࣗಈԽͰ͖Δ͔Λ֬ೝ
    w αϙʔλʔͷ਺ͷݟ௚͠
    w ηογϣϯొ࿥࣌ͷࣗಈԽ
    

    View Slide

12. όοΫϩά؅ཧํ๏
    w ࡢ೥͸#BDLMPHͱ(PPHMF%PDVNFOU
    w ࠓ೥͸5SFMMPͱ#BDLMPHͱ(PPHMF%PDVNFOU
    w 5SFMMPͰ΍Δ͜ͱΛՕ৚ॻ͖ͯ͠ɺ#BDLMPHͷ63-ΛషΓ෇͚Δӡ༻
    w ࣦഊʹऴΘͬͨɻ݁ہɺ5SFMMP͸΄ͱΜͲ࢖Θͳ͔ͬͨɻ
    w 5SFMMP͸্ҐʹੵΜͩνέοτΛݟ͚ͭͨਓ͕ରԠ͍ͯ͘͠ܗͳͷͰɺࠓճͷܗʹ͸߹Θ
    ͳ͔ͬͨ
    

    View Slide

13. εέδϡʔϧ࡞੒
    w ࡢ೥ͷΛ΋ͱʹεέδϡʔϧΛγϑτ ࡢ೥͸݄։࠵ɺࠓ೥͸݄։࠵
    
    w ͢Ͱʹɺ͍Ζ͍Ζͱ஗ΕͯΔ͜ͱ͕൑໌ ͜ͷͱ͖݄൒͹ͩͬͨؾ͕
    
    w ్த·Ͱ͸εέδϡʔϧ؅ཧ͍͚ͯͨ͠Ͳɺޙ൒͸ߋ৽͢Δ͜ͱͳ͠ ༨༟
    ͳ͔ͬͨ
    
    

    View Slide

14. ϨΠΞ΢τܾΊ
    w ςʔϚຬ׽શ੮ʹͳͬͨ͠ɺηογϣϯ਺૿΍͍ͨ͠
    w ϒʔεͷߏ੒ݟ௚͍ͨ͠
    w ͋ͱɺಉਓࢽ൦෍اը͍ͨ͠
    w ઌʹϨΠΞ΢τΛܾΊͯਖ਼ղ
    w ϒʔεͷ਺Λ૿΍͢ʹαϙʔλʔେଟ਺ݺͼࠐΉඞཁ͋Γ ࣗ෼ͷट͠ΊΔ
    
    w ͞Βʹ௥Ճϒʔεͷཁ๬͋Γ
    

    View Slide

15. ௥ՃϒʔεରԠ
    ಉਓࢽ൦෍ϒʔε

    ͷϨΠΞ΢τมߋ

    ͕ೖͬͨ
    

    View Slide

16. λΠϜςʔϒϧܾΊ
    w τϥοΫ਺͕ܾ·ͬͨΒηογϣϯ෼ͱͯ͠ɺ૊Μ͡Ό͓͏
    w ࠓ೥͸ϋϯζΦϯ΍Δͧʂ
    w ϥϯνηογϣϯ΋αϙʔλʔั·͑ͯ͗ͬͪ͗ͪʹ͠Α͏ʂ
    w ৽͘͠0QFO.JD੍౓औΓೖΕΑ͏ʂ
    

    View Slide

17. +FGG#F[PTʹ

    ತϝʔϧ͠Α͏

    ͱͯ͠·ͨ͠ɻ

    அΒΕ·ͨ͆͠
    

    View Slide

18. ηογϣϯΧςΰϦܾΊ
    w τϥοΫ਺͕ଟ͘ɺ։࠵Մೳͳηογϣϯ਺΋૿͑ͨʂ
    w ࡢ೥ɺແ͘ͳͬͨΧςΰϦͳͲΛ௥Ճˠ%#ɺ#JH%BUBؔ࿈
    w ௚ۙͷ೰Έͱͯ͠͸͖ͬͱ๊͍͑ͯΔ͸ͣʂˠ։ൃύΠϓϥΠϯ؀ڥ %FW&OW
    
    w 4FSWFSMFTTɺίϯςφLTɺ#MPDL$IBJOͳͲϗοτͳ࿩୊Λ༻ҙ
    w $'1͔Β.PCJMFɺ*B$ͳ࿩΋νϣΠε
    

    View Slide

19. ໾ׂ෼୲
    w ൺֱతɺશһ͕ৗʹ3FBEZͳঢ়ଶͰ͸ͳ͔ͬͨͷͰɺग़དྷΔλΠϛϯάͰ
    λεΫΛ͜ͳ͍ͯ͘͠΍Γํ
    w ͜Ε͕Α͔͔ͬͨͲ͏͔ͱ͍͑͹ɺ͋·ΓΑΖ͘͠͸ͳ͔͔ͬͨ΋
    

    View Slide

20. 8FCܝࡌσϦόϦ
    w ηογϣϯొ࿥ϑΥʔϜΛ࡞ͬͯɺউखʹόοΫϩάʹνέοτ͕੾ΒΕ
    ΔΑ͏ʹ࿈ܞ
    

    View Slide

21. ͜ͷ߲໨͕Α͔͔ͬͨͲ͏͔͸ผͷ࿩
    

    View Slide

22. ෺ཧϑΝγϦςΟܾΊ
    w ͬ͘͟ΓίΞϝϯόʔͰߏ੒Λىͯ͜͠ɺӡӦձࣾʹͯ1%'Խͯ͠΋Β͏
    w ωοτϫʔΫ͸ࠓ೥͸8J͞ΜʹΦϑΝʔ ӡӦϝϯόʔͷπςͰ
    
    w ֎޲͚ͷ഑৴͸ͳ͔ͬͨͷͰɺ8J'J؀ڥͷΈΛ༻ҙ

    ˞ޕલதʹ8J'J઀ଓෆՄ໰୊ʹ͍ͭͯ͸ޙ΄Ͳ
    

    View Slide

23. $BMMGPS1BQFSTϧʔϧ
    w %SPJE,BJHJ΍$PEF#MVFͳͲͷ$'1ϧʔϧΛࢀߟʹ࡞੒
    w $'1͔Βͷબఆͷޙͷ࿈བྷํ๏ʹͳ͔ͳ͔೰Μͩ
    w ͳͥམͱ͞ΕͨͷͰ͔͢ʂʁͱ͔ݴΘΕͯ΋ɺ·ͣͪ͜Β͕ࠔΔ
    w ड͔ΔͱݴΘΕͯΤϯτϦʔͨ͠ͷʹʂతͳ΋ͷ΋͋ͬͨͷͰɺ͜͜Β΁
    Μ͸վળͷ༨஍͋Γ
    

    View Slide

24. αϙʔλʔґཔ
    w 8FCެ։ͱͱ΋ʹਃ͠ࠐΈ͖ͯͨ͠اۀ΋͍͕ͨɺ͍͢͝੎͍Ͱਃ͠ࠐΈ
    ͕͋ͬͨΘ͚Ͱ͸ͳ͍
    w ͜Ε͕ࡢ೥ͷ՝୊Ͱ΋͋ͬͨͷͰɺͪ͜Β͔ΒαϙʔλʔґཔΛͨ͠ɻ
    w αϙʔλʔґཔॻͱ͍͏΋ͷ΋༻ҙͯ͠ɺग़͢اۀ΋͕͋ͬͨɺଟ͘͸ա
    ڈʹ+"846(ษڧձͰొஃ͍͍ͨͩͨɺ஌Γ߹ͬͨํʑͳͲʹɺ
    'BDFCPPLϝοηͰತΓ·ͨ͠ɻ
    

    View Slide

25. ίϛϡχςΟΠϕϯτ͔ͩΒͦ͜

    ͜͜·ͰϑϥϯΫʹ΍Εͨͷ͔΋ʁ
    

    View Slide

26. αϙʔλʔɾελοϑɾΠϕϯτاۀͱͷλεΫ؅ཧ
    w ݁Ռతʹపఈతʹ4MBDLʹট଴ͯ͠ɺใ࿈૬Λͦ͜
    Ͱߦ͏͜ͱͱͨ͠ɻ
    w 'BDFCPPLϝοηͰͷ΍ΓऔΓ΋Ұ෦͕͋ͬͨɺ୭
    ͕୭ͱͲ͜·Ͱ࿩͔ͯͨ͠Λ͋Δఔ౓ɺڞ༗Ͱ͖Δ
    Α͏ʹ͓͖͔ͯͨͬͨ͠ɻ
    

    View Slide

27. 5γϟπ࡞੒
    w ຬ׽શ੮Ά͍த՚ײͱɺاۀϩΰΛฒ΂ͨπΞʔσʔτ5γϟπͷΑ͏ͳ΋
    ͷΛΠϝʔδ
    w ຊ౰͸ຕΛߟ͍͑ͯͨ

    ে༉ɺԘɺΧϨʔ

    γʔϑʔυɺຯḩ
    

    View Slide

28. View Slide

29. χϡʔεͷଧͪํ
    w ৽͍͠औΓ૊ΈΛଧͪग़͠ɺਃࠐΈ͕ൃੜ͢Δ΋ͷʹ͍ͭͯ͸ɺ͔ͳΒͣɺ
    ࣄલࠂ஌ΛχϡʔεͰྲྀ͔ͯ͠Βɺެ։
    w ؾ͍ͮͨΒɺਃࠐΈ࢝·ͬͯͨʂΛపఈతʹ΍Ίͨ
    w ͳΜͱͳ͘ɺ్த͔ΒΠϯύΫτ͋Δը૾Ͱؾʹ͔͚ͯ΋Β͑ΔΑ͏ʹ͠
    ͚͔ͨͬɺεΩϚφʔεɺεΩϚϑΝϛϦʔͷը૾Λଟ༻
    

    View Slide

30. ˡεΩϚϑΝϛϦʔrͷधཁʹԠ͑ͨՈ଒ͷϑϦʔࣸਅૉࡐαΠτ
    ͷधཁʹԠ͑ͨ؃ޢࢣϑϦʔࣸਅૉࡐαΠτεΩϚφʔεˠ
    

    View Slide

31. ༧ࢉ؅ཧ
    w ࡢ೥ͷ༧ࢉ؅ཧදΛͦͷ··γϑτ͠ͳ͕ΒεϓϨουγʔτ؅ཧ
    w اۀαϙʔλʔͷࢧԉଟ਺ͷͨΊɺ͋ΒΏΔۚમ໘Ͱͷ༨༟
    w ϥϯνͷ୯ՁҾ্͖͛
    w ύʔςΟγϣϯ૿ՃʹΑΔΠϯϑϥίετ૿
    w άοζ௥Ճൃ஫
    w 5γϟπͷϑϧΧϥʔରԠ
    

    View Slide

32. άοζ࡞੒
    w اۀ΋ࢀՃऀ΋تͿ΋ͷΛʂ
    w ࡢ೥ʹҾ͖ଓ͖ɺͷ΅Γͷ࡞੒
    w εςοΧʔҎ֎ʹɺϙοϓιέοτɺ௚ܘDNεςοΧʔɺϥόʔόϯ
    υɺͲΒম͖ɺমҹ΋ҰॹʹϓϨθϯτɺ࣮ߦҕһϝϯόʔ͚ͩͷύʔΧʔ
    ͳͲ
    

    View Slide

33. άοζ࡞੒
    

    View Slide

34. View Slide

35. ͋Β͔͡ΊBJ͔FQTϑΝΠϧ΋

    ΋Β͓ͬͯ͘͜ͱΛ๨Εͣʹʂ
    اۀϩΰϑΝΠϧͷऔѻʹ͓͚Δ

    ϨΪϡϨʔγϣϯ͕ݫ͍͠اۀ΋

    ͍Δ͜ͱʹ஫ҙ
    

    View Slide

36. 3PBE5SJQ όε
    ͷੋඇ
    w ࡢ೥ͷར༻਺ɺར༻ͷ͞Εํ͔Βɺࠓ೥΋։࠵͢Δ͔Ͳ͏͔ͷੋඇΛϢʔ
    βʔʹ໰͍͔͚
    w ͋ͬͯ΋ͳͯ͘΋͍͍ͱ͍͏੠͕ͬ͘͟Γ൒ʑ͘Β͍Ͱ͸͕͋ͬͨɺ։࠵
    Λܾఆ
    w ଞʹ͸৽װઢΛҰ྆आΓ੾Δͱ͔ɺεΧϥʔγοϓҊΛॆ࣮ͤ͞Δ౳
    

    View Slide

37. εΧϥʔγοϓ
    w ࡢ೥͸εΧϥʔγοϓ͕஍ํ+"846(ͷਪનࣜͰ͕͋ͬͨɺࠓճ͸ࣗݾਪ
    નɺଞݾਪન͋Γɺ೥ྸ੍ݶͳ͠ͱͨ͠ɻ
    w ඞͣΞ΢τϓοτͯ͠΋Β͏͜ͱ͕લఏͰɺສԁͷࢧڅ
    w ਓͷ༧ఆʹ͍͕ͯͨ͠ɺਓ͔͠ਃ͠ࠐΈͳ͔ͬͨͷ͸গ͠࢒೦
    

    View Slide

38. લ໷ࡇ
    w ձ৔͸"84+Ͱձ৔Ωϟύ
    ਓͱ͍ͯͨ͠ͷͰɺε
    Χϥʔɺύʔτφʔɺొஃ
    ऀɺελοϑɺւ֎੎શһ
    ͷࢀՃ͸ग़དྷͳ͔͚ͬͨ
    Ͳɺ΋͏গ͠དྷͯ΄͔ͬ͠
    ͨɻ
    

    View Slide

39. ֤ҕһϝϯόʔʹΑΔاը
    w "84ஶऀηογϣϯ
    w ୔౉͋·Ͷ͞ΜొஃαΠϯձ
    w ϋΠϒϦουΫϥ΢υηογϣϯ
    w ίϛϡχςΟτϥοΫ
    w $'1͔Β࠾୒
    

    View Slide

40. ϥϯν
    w "-# "QQMJDBUJPO-PBE#BMBODFS൱"XTPNF-VODI#PY
    νέοτͱ4όέοτͰഇغϩε̌
    w ห౰୯Ձͷେ෯Ξοϓͱɺσουεϖʔεͩͬͨறं৔Λ׆༻͢ΔܗͰɺΩονϯΧʔ ৯෼
    ͷ
    ΞαΠϯ
    w ݄։࠵Ͱפ͍ͱ͓΋͍͔ͬͯͨΒɺϥʔϝϯ༻ҙ͕ͨ͠ɺ

    ΦϖϨʔγϣϯ໰୊Ͱൢച͕ಷԽʁຯ͸ඒຯ͔ͬͨ͠ײ૝ଟʑʂ
    w ห౰৯͸෼Ͱॠࡴ ࡢ೥͸ͷདྷ৔ʹɺ
    
    w ؾ෼Ͱւ࿝৯΂͔ͨͬͨࢁ࡚͞Μͷҙݟʹ൓ͯ͠ɺ

    ߕ֪ྨΞϨϧΪʔͱ͍͏ҙݟ͕ͪΒ΄ΒɻάϧςϯΞϨϧΪʔͳͲɺ

    ͍Ζ͍Ζͱߟ͑ͳ͍ͱɻɻɻ
    

    View Slide

41. View Slide

42. View Slide

43. Ϩγʔόʔ؅ཧ
    w ֤छ*%Χʔυ ύεϙʔτ౳
    Ͱ࣮ࡍʹ΍͍ͬͯ
    ΔΠϕϯτ͕୆࿷ͷηΩϡϦςΟΠϕϯτ
    )*5$0/ɻ
    w ͜ΕΛԠ༻Ͱ͖ͳ͍͔ʁ
    w ݁Ռతʹ໊ࢗͰ୅༻
    w ฦ٫͞Εͳ͔ͬͨ࠷ޙͷ୆͕ऩ༰͞Εͨςʔ
    ϒϧʹͻ͔͔ͬͬͯͨͨΊɺआΓύΫ͸ʂ
    

    View Slide

44. ಉਓࢽ൦෍
    w ٕज़ॻయͷଘࡏ͕େ͖͍ͷͰɺ"84΍"MFYBݶఆͷಉਓࢽ൦෍͸౰ͨΔͱ
    ༧૝
    w αʔΫϧूΊʹࠔ೉͍͚ͯͨ͠Ͳɺͦ΋ͦ΋αʔΫϧूΊͯΔ͜ͱΛ஌Β
    ͳ͍ਓୡ͕ଟʑ
    w ϝοη΍5XJUUFSͰತΔͳͲͯ͠ɺશ෦ͰͭͷαʔΫϧ͕ࢀՃ
    w 403"$0.ϘλϯΛചΓ͍ͨ403"$0.ʹಉਓࢽͷ෇࿥ʹϘλϯ͚ͭΔ
    ͳΒച͍͍ͬͯΑͱଧ਍ ʮླ໦ѥඒͷڧ͍Ωζφʯύλʔϯ
    
    

    View Slide

45. िؒޙʹ͸

    αʔΫϧΧοτ
    

    View Slide

46. ௥ՃΠϕϯτ
    w ࠃࡍަྲྀϒʔεͰ೔ؖେֶੜಉ࢜ͷֶੜަྲྀΠϕϯτ %PSBZBLJ$BGF
    
    w ୔౉͋·Ͷ͞ΜαΠϯձ
    w ελϯϓϥϦʔ :BQQMJ͞Μ͔ΒͷఏҊ
    
    

    View Slide

47. ελοϑखॱॻ࡞੒
    

    View Slide

48. خ͍͠൵໐ͱޡࢉ
    w ਃࠐ਺͕Χϯετ

    ਃࠐऀ਺ʹରͯ͠དྷ৔ऀ਺͕଍ΒͣͱΈͳ͠ɺʹରͯ͠ͷ
    ͱͯͨ͠
    
    w ݁Ռɺͷਃ͠ࠐΈɺ࣮ࡍͷདྷ৔ऀ਺͸ Ϧετόϯυ͸
    
    w Ұिؒલʹ͸߱ਫ֬཰ʂ
    w ͳͷʹ੖ΕΔΘɺפ͘ͳ͍Θ
    

    View Slide

49. ࠙਌ձ
    w ࡢ೥ΑΓ΋৯ࣄ΋͓ञ΋ഒͷྔΛ஫จ͍ͯͨ͠ͷʹɺ৯ࣄ͕͙͢ʹແ͘ͳ
    Δɻ
    w "844BNVSBJൃද
    w -5λΠτϧ͢Β΋ɺઈରʹλΠϜςʔϒϧʹ৐ͤΔΑ͏ʹࢦࣔ
    w நબձͷܠ඼ʹɺগ͠ଟΊʹ࡞͍ͬͯͨ5γϟπɺύʔΧʔɺͲΒম͖ͷমҹ
    w ͓͔͑Γͷ͍͞͸(&58*-%
    

    View Slide

50. ࠓޙͷ՝୊ɾҾ͖ܧ͗
    w ٳܜॴͷઃஔ
    w λόίͷՐ
    w ݸਓ৘ใͷऔѻ
    w ࣸਅࡱӨʹ͓͚ΔϨΪϡϨʔγϣϯ
    w མͱ͠෺
    

    View Slide

51. ޕલதͷ8JGJ઀ଓෆՄ໰୊
    w ࣌લ·Ͱɹձ৔طઃ"1Ͱৗʹ.CQTۙ͘ग़ͯΔ
    w ࣌લɹɹɹձ৔طઃ"1͕ɺ઀ଓ͸Ͱ͖Δ͕Πϯλωοτ઀ଓͳ͠ͱͷදࣔʹͳΔΑ͏ʹͳͬͨ
    w *1෷͍ग़͠͸Ͱ͖͍ͯΔ͜ͱΛ֬ೝ
    w ใ஌͞Ε͍ͯΔ-PDBM%/4αʔόʹQJOHͨ͠ͱ͜ΖɺMPTTଟൃͩͬͨΓશࣦഊͷঢ়ଶ
    w ͞Βʹɺ%/4ॲཧ͕ඇৗʹ஗͘ͳ͍ͬͯΔ͜ͱΛ֬ೝ
    w ୺຤ଆͰ%/4ΛMPDBM%/4͔ΒʹखಈͰม͑Δͱɺ࣌ؒ͸͔͔Δ͕઀ଓͰ͖ΔΑ͏ʹͳΔ͜
    ͱΛ֬ೝ
    w ͜ͷ͜ͱ͔Βɺ%/4Λ-PWBM%/4͔Β1VCMJD%/4ʹมߋ͢Δ͜ͱʹͨ͠
    

    View Slide

52. ޕલதͷ8JGJ઀ଓෆՄ໰୊
    w ɹɹɹ%)$1ઃఆΛมߋͯ͠ͱ (PPHMF1VCMJD%/4
    Λใ஌͢ΔΑ͏ʹมߋ͠
    ͨ
    w ͜ͷઃఆมߋͰ࣌ؒ͸͔͔Δ͕઀ଓͰ͖ΔΑ͏ʹͳͬͨ͜ͱΛ֬ೝ
    w ͦΕͰ΋ɺ୺຤ʹΑΓɺܨ͕Βͳ͔ͬͨΓɺͭͳ͕Δͷʹ΋͕͔͔࣌ؒΔঢ়ଶ͕ܧଓ
    w ύέοτΩϟϓνϟ͔ΒɺಛఆΞυϨε͔ΒSFGVTFฦͯ͘͠Δ͜ͱΛ֬ೝ
    w ࠷࣮ۙࢪͨ͠ձ৔ઃඋͷߏ੒มߋΛݩʹ໭͢ํ͕վળ͕ݟࠐ·ΕΔͱ൑அ
    w ݩͷߏ੒΁ͷ࠶มߋΛ࣮ࢪͨ͠
    w Ҏ߱͸ऴྃ·Ͱ઀ଓʹ໰୊͕ͳ͘ͳͬͨʢͦͷޙདྷ৔ऀ਺͸ਓऑ·Ͱ৳ͼͨʣ
    ༧૝Ҏ্ͷࢀՃऀਓ਺ʹΑΔ8JGJ
    ઀ଓͱձ৔ͷ/8ػث͕࣋ͭ
    -PDBM%/4ͷੑೳݶք͕໰୊

    ੾Γ෼͚ରࡦͷૣ͔ͬͨ8J͞Μ
    ʹײँʂ
    

    View Slide

53. View Slide

54. ޕલதͷ8JGJ઀ଓෆՄ໰୊
    w 8J͞Μͷରࡦ಺༰Λɺେڮ͞Μ͕ϒϩάʹॻ͍ͯ·ͱΊͯ͘Ε·͠
    ͨɻੋඇɺඞಡ͍͖ͨͩͨ͘ɻ
    IUUQCMPHNBNPIBDZDPNFOUSZ
    

    View Slide

55. ։࠵ޙͷ50%0
    w ੥ٻॲཧ

    ϲ݄Ͱ΍Γऴ͍͑ͨͱ͜Ζ
    w εϥΠυ΍ϒϩάͳͲͷܝࡌ

    'PMMPX6Qܝࡌ
    w υΩϡϝϯτͳͲͷҾ͖ܧ͗
    w མ͠෺ॲཧ
    w ࣮ߦҕһϝϯόʔϓϩϑܝࡌ

    ˠຊ౰͸ॳظͷஈ֊Ͱ΍͓͖͔ͬͯͨͬͨ
    w +"846(ͷ5PQ͔͑͞͠ͱӬ୅ڙཆ
    w ݸਓαϙʔλʔ΁ͷ5γϟπૹ෇

    ˠࢀՃ͞Εͳ͔ͬͨํʑ΁ͷૹ෇
    w Ξϯέʔτूܭ

    ˠࢀՃΞϯέʔτͷूܭ݁ՌΛొஃऀ΁'#
    w ࣸਅڞ༗

    ࣄલʹࣸਅࡱӨʹ͍ͭͯड़΂͓ͯ͘΂͖

    IUUQTKBXTEBZTKBXTVHKQ
    QPMJDZ
    w αϙʔλʔ΁ͷ͓ྱ
    

    View Slide

56. w Πϕϯτاۀʹผ్ࢧ෷͍͢Δ΋ͷ
    w +"846(ޱ࠲͔ΒҾ͖ग़͢ඞཁͷ͋Δ΋ͷ
    w ͦΕͧΕͲ͜Ͱඅ༻͕ൃੜ͍ͯ͠Δ͔Λ֬ೝ͠ɺূ੻ͱͱ΋ʹద੾ͳ͓ۚ
    ͷॲཧΛ͢Δඞཁ͕͋Δɻ
    w ड͚औΓαΠϯ
    w ߪೖ࣌ͷϨγʔτ
    w 4USJQFͷ՝ۚൃੜه࿥
    ੥ٻॲཧ
    

    View Slide

57. w ొஃऀͷεϥΠυ63-͸ηογϣϯ৘ใՕॴʹܝࡌ͸΋ͪΖΜɺΞ΢τ
    ϓοτ͍͍ͨͩͨϒϩάͳͲ΋ͻͨ͢Βௐࠪͯ͠'PMMPX6Qܝࡌ
    εϥΠυ΍ϒϩάͳͲͷܝࡌ
    

    View Slide

58. w ͸ܝࡌ͍ͯͨ͠ɻ

    IUUQTKBXTEBZTKBXTVHKQQPMJDZ
    w ͸͜ΕΛܝࡌ͠๨Ε͍ͯͨͨΊɺࢀՃऀͳͲࡱӨͨࣸ͠ਅܝࡌͳ
    Ͳ͕ग़དྷͳ͍ɻPS[
    w اۀ΋ؚΊɺࡱӨ͠

    ͨࣸਅͷڞ༗ͳͲ͸

    ΨΠυϥΠϯΛఆΊ

    ͓ͯ͘ඞཁ͋Γ
    ࣸਅڞ༗
    

    View Slide

59. ։ձͷѫࡰ શจ
    ఻͔͑ͨͬ
    ͨΞ΢τϓοτͯ͜͠͏࿩
    
    

    View Slide

60. ։ձͷѫࡰ શจ
    ఻͔͑ͨͬ
    ͨΞ΢τϓοτͯ͜͠͏࿩
    
    

    View Slide

61. View Slide

62. View Slide

63. View Slide

64. View Slide

65. View Slide

66. View Slide

67. View Slide

68. View Slide

69. View Slide

70. View Slide

71. w ςʔϚʮຬ׽શ੮ʯͰɺѹ౗తͳίϯςϯπͷྔΛ༻ҙ͢Δͱ͍͏͜ͱΛ໨ඪͱ
    ͍ͯͨͨ͠ΊɺఏҊ͞ΕͨΞΠσΞΛ௵͢ͱ͍ͬͨ͜ͱ͸ແ͔ͬͨɻ
    w ΞΠσΞΛ΍ΔҎ্͸੹೚Λ࣋ͬͯɺ͔ͭɺඞͣχϡʔεϦϦʔεΛͯ͠ɺ։࠵લ
    ͔ΒࢀՃऀ͕ڻ͘Α͏ͳίϯςϯπͷྔ͕͋Δͱ͍͏͜ͱΛΘ͔ͬͯ΋Β͑ͨɻ
    w ͦͷ্Ͱɺࠓ೥࣮ࡍʹདྷͯ΋Β͑Δਓ਺Λਓ໨ඪͱ͍ͯͨ͠ͱ͜Ζɺେ͖
    ্͘ճΔ਺ͷํʹདྷͯ΋Β͑ͨͷ͸ɺࠓճͷզʑͷ΍Γํ͸ͦ͏ؒҧͬͯ͸ͳ
    ͔ͬͨͱ͍͏ɺ͜Ε͔Βͷࣗ৴ʹ΋ͳͬͨɻ
    w ݁ՌΛܾΊͯɺ౒ྗͰா৲ CZদݪ༟ Իָϓϩσϡʔα
    
    
    ऴΘͬͯΈͯɺվΊͯ
    

    View Slide

72. w IUUQTBTDJJKQFMFN
    ࢲ͸͜ͷهࣄΛಡΉ͚ͩͰ
    ྦΛྲྀͤ·͢ɻ
    

    View Slide

73. ࣗݾ঺հ
    • @Typhon666_death (ςϙ)
    • ࢓ࣄɿ๭ηΩϡϦςΟઐ໳ձࣾʹͯɺ

    ηΩϡϦςΟΤϯδχΞ/ίϯαϧλϯτ/ΞφϦετ/Ӧۀ

    ͯ͠·ͨ͠
    • ۀ຿ɿҎલ͸ଟछاۀ޲͚MSS΍ۚ༥ػؔ޲͚ASPɺ

    ࠓ͸ࣗࣾAIαʔϏεͷӡ༻อक
    • ׆ಈίϛϡχςΟɿ
    • OWASP Japan Promotion Teamϝϯόʔ
    • Security-JAWS ӡӦϝϯόʔ
    • X-Tech JAWS ӡӦϝϯόʔ
    • ϨτϩήʔϜษڧձ ӡӦϝϯόʔ
    • શ೴ΞʔΩςΫνϟएखͷձ ӡӦϝϯόʔ

    https://www.slideshare.net/Typhon666_death IUUQTBXTBNB[PODPNKQCMPHTOFXTBXTTBNVSBJ
    

    View Slide

74. ࣗݾ঺հ
    ʜʜ͖͑͜·͔͢ʜ"84ϢʔβʔΑʜ͋ͳ
    ͨͷਆͰ͢ʜʜࠓʜ͋ͳͨͷʜ৺ʹʜ௚
    ઀ʜݺͼ͔͚͍ͯ·͢ʜདྷ೥ͷʜ+"84
    %":4ͰʜԿΛ͍͔ͨ͠ʜߟ͑ΔͷͰ͢ʜ
    ελοϑΛ͍ͨ͠ͷ͔ʜొஃ͍ͨ͠ͷ͔ʜ
    ొஃΛ͍ͨ͠ͷͰ͋Ε͹ʜ͍·͔ΒωλΛ
    ࢓ࠐΉͷͰ͢ʜʜ
    
    

    View Slide

75. ࣗݾ঺հ
    ʜʜ͖͑͜·͔͢ʜ"84αϙʔλʔΑʜ͋
    ͳͨͷਆͰ͢ʜʜࠓʜ͋ͳͨͷʜ৺ʹʜ௚
    ઀ʜݺͼ͔͚͍ͯ·͢ʜདྷ೥ͷʜ+"84
    %":4ͰʜԿΛ͍͔ͨ͠ʜߟ͑ΔͷͰ͢ʜ
    اۀαϙʔλʔΛ͍ͨ͠ͷ͔ʜݸਓαϙʔ
    λʔΛ͍ͨ͠ͷ͔ʜ͍ͣΕʹͯ͠΋ʜ༧ࢉ
    Λʜ༧ࢉΛʜࠓ͔Β֬อ͢ΔͷͰ͢ʜ
    
    

    View Slide

76. Ξ΢τϓοτ͠ͳ͍ͷ͸஌త
    ͳศൿ
    

    View Slide

77. Ξ΢τϓοτ͠ͳ͍ͷ͸஌త
    ͳศൿ
    IUUQTTTNQLBOPSH
    

    View Slide

78. Ξ΢τϓοτ͠ͳ͍ͷ͸஌త
    ͳศൿ
    IUUQTPXBTQTFOEBJDPOOQBTTDPNFWFOU
    

    View Slide

79. ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ
    ࣍ͷӡӦ͸͋ͳͨʂ
    

    View Slide