Lock in $30 Savings on PRO—Offer Ends Soon! ⏳

2017/08/25

Avatar for tanakata tanakata
August 25, 2017
0
45

 2017/08/25

Avatar for tanakata

tanakata

August 25, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
35
20171110
Avatar for tanakata tanakata
0
43
1013
Avatar for tanakata tanakata
0
49
徳丸0922
Avatar for tanakata tanakata
0
74
0901
Avatar for tanakata tanakata
0
40
0802徳丸.pdf
Avatar for tanakata tanakata
0
49
徳丸20170721.pdf
Avatar for tanakata tanakata
0
38

Featured

See All Featured
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
Avatar for Aleyda Solis aleyda
2
9.1k
Jamie Indigo - Trashchat’s Guide to Black Boxes: Technical SEO Tactics for LLMs
Avatar for Tech SEO Connect techseoconnect
PRO
0
29
Visualization
Avatar for Eitan Lees eitanlees
150
16k
Marketing Yourself as an Engineer | Alaka | Gurzu
Avatar for Gurzu gurzu
0
89
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
190
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
14k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
120
Hiding What from Whom? A Critical Review of the History of Programming languages for Music
Avatar for Tomoya Matsuura tomoyanonymous
0
290
Odyssey Design
Avatar for Ryan Kendrick rkendrick25
PRO
0
430
Building AI with AI
Avatar for Ines Montani inesmontani
PRO
1
570
A Soul's Torment
Avatar for Nat Ma seathinner
1
2k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
Avatar for panda_program panda_program
122
21k

Transcript

  1. 2017/08/25 ಙؙຊྠಡձ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  2. ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  3. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸʢాʣ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸʢాʣ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸʢXSSʣʢຢʣ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊:࣮૷ʹෆඋ͕͋Δͱ༷ʑͳ੬ऑੑ͕ੜ·ΕΔ

  4. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ→DOS߈ܸͱ͸ʁ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ

  5. ϑΝΠϧΞοϓϩʔυʹର͢ΔDOS߈ܸ ˕DOS(DENIAL OF SERVICE)߈ܸ αʔόʔʹରͯ͠ڊେͳϑΝΠϧΛ࿈ଓͯ͠ૹ৴͢Δ͜ͱʹΑ ΓWEBαΠτʹաେͳෛՙΛ͔͚Δ ˕Өڹ ɾӨڹ͸Ԡ౴଎౓ͷ௿Լ ɾ࠷ѱͷ৔߹ɺαʔόͷఀࢭ

  6. ϑΝΠϧΞοϓϩʔυʹର͢ΔDOS߈ܸ ˕ରࡦ ΞοϓϩʔυϑΝΠϧͷ༰ྔ੍ݶ͕༗ޮ PHPͷ৔߹͸ PHP.INI Ͱઃఆ͢Δ͜ͱ͕Ͱ͖Δɻ

  7. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸ

  8. αʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ˕֓ཁ Ξοϓϩʔμͷதʹ͸ར༻ऀ͕Ξοϓϩʔυͨ͠ϑΝΠϧΛWEBαʔόͷ ެ։σΟϨΫτϦʹอଘ͢Δ΋ͷ͕͋ΔɻϑΝΠϧͷ֦ுࢠ͕PHPͷΑ͏ ͳεΫϦϓτݴޠ͕ΞοϓϩʔυͰ͖ͯ͠·͏ͱWEBαʔό্Ͱ࣮ߦͰ͖ ͯ͠·͏ɻ ˕Өڹ ֎෦͔ΒεΫϦϓτ͕࣮ߦ͞ΕΔ͜ͱͰOSίϚϯυɾΠϯδΣΫγϣϯͷةݥ͕͋Δɻ WEBαʔό্ͷϑΝΠϧͷӾཡɾվ͟Μɾ࡟আ ֎෦αʔό΁ͷϝʔϧૹ৴

    ϑΝΠϧ QIQͳͲ ެ։σΟϨΫτϦ

  9. αʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ˕߈ܸख๏ ߈ܸͰ͸ը૾ϑΝΠϧͷมΘΓʹεΫϦϓτΛΞοϓϩʔυ͢Δɻྫͱͯ͠ҎԼͷPHPεΫϦ ϓτΛΞοϓϩʔυ͢Δɻ Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ը૾Ͱ͸ͳ͍͕IMGཁૉͷ෦෼ʹɺ×ϚʔΫ͕දࣔ͞ΕΔɻ ϦϯΫΛΫϦοΫ͢ΔͱεΫϦϓτ͕࣮ߦ͞Εͯ /ETC/PASSWD ͕දࣔ͞ΕΔɻ ˕ରࡦ ֦ுࢠΛνΣοΫ͢Δ

    Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ެ։σΟϨΫτϦʹஔ͔ͣɺεΫϦϓτܦ༝ͰӾ ཡͤ͞Δ HACK.PHP IUUQFYBNQMFKQPQFO@EJS)"$,QIQ

  10. ·ͱΊ ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ →Ξοϓϩʔυ࣌ɺ༰ྔ੍ݶ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ →֦ுࢠʢJPGɾPNG౳ʣνΣοΫɾεΫϦϓτܦ༝ͰӾཡʢ࣮ߦͰ͖ͳ͍Α͏ʹʣ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸʢXSSʣʢຢʣ

  11. ͋Γ͕ͱ͏͍͟͝·ͨ͠ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  12. ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸ ˕֓ཁ ߈ܸ༻ʢ࢓ֻ͚ʣϑΝΠϧΞοϓϩʔυˠར༻ऀ͕ϑΝΠϧΛӾཡˠJSͷ ࣮ߦɺϚϧ΢ΣΞײછ ˕Өڹ ֎෦͔ΒεΫϦϓτ͕࣮ߦ͞ΕΔ͜ͱͰOSίϚϯυɾΠϯδΣΫγϣϯͷةݥ͕͋Δɻ WEBαʔό্ͷϑΝΠϧͷӾཡɾվ͟Μɾ࡟আ ֎෦αʔό΁ͷϝʔϧૹ৴ ˕ରࡦ Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ެ։σΟϨΫτϦʹஔ͔ͣɺ

    εΫϦϓτܦ༝ͰӾཡͤ͞Δ ϑΝΠϧ