Upgrade to Pro — share decks privately, control downloads, hide ads and more …

2017/08/25

Avatar for tanakata tanakata
August 25, 2017
0
46

 2017/08/25

Avatar for tanakata

tanakata

August 25, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
36
20171110
Avatar for tanakata tanakata
0
45
1013
Avatar for tanakata tanakata
0
50
徳丸0922
Avatar for tanakata tanakata
0
75
0901
Avatar for tanakata tanakata
0
42
0802徳丸.pdf
Avatar for tanakata tanakata
0
50
徳丸20170721.pdf
Avatar for tanakata tanakata
0
39

Featured

See All Featured
How People are Using Generative and Agentic AI to Supercharge Their Products, Projects, Services and Value Streams Today
Avatar for Helen Beal helenjbeal
1
120
AI Search:
Where Are We & What Can We Do About It?
Avatar for Aleyda Solis aleyda
0
6.9k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.7k
The Spectacular Lies of Maps
Avatar for Per Axbom axbom
PRO
1
520
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
130
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
110
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
65
8.4k
The MySQL Ecosystem @ GitHub 2015
Avatar for Sam Lambert samlambert
251
13k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
141
34k
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
45
8.6k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
Avatar for panda_program panda_program
122
21k

Transcript

  1. 2017/08/25 ಙؙຊྠಡձ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  2. ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  3. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸʢాʣ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸʢాʣ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸʢXSSʣʢຢʣ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊:࣮૷ʹෆඋ͕͋Δͱ༷ʑͳ੬ऑੑ͕ੜ·ΕΔ

  4. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ→DOS߈ܸͱ͸ʁ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ

  5. ϑΝΠϧΞοϓϩʔυʹର͢ΔDOS߈ܸ ˕DOS(DENIAL OF SERVICE)߈ܸ αʔόʔʹରͯ͠ڊେͳϑΝΠϧΛ࿈ଓͯ͠ૹ৴͢Δ͜ͱʹΑ ΓWEBαΠτʹաେͳෛՙΛ͔͚Δ ˕Өڹ ɾӨڹ͸Ԡ౴଎౓ͷ௿Լ ɾ࠷ѱͷ৔߹ɺαʔόͷఀࢭ

  6. ϑΝΠϧΞοϓϩʔυʹର͢ΔDOS߈ܸ ˕ରࡦ ΞοϓϩʔυϑΝΠϧͷ༰ྔ੍ݶ͕༗ޮ PHPͷ৔߹͸ PHP.INI Ͱઃఆ͢Δ͜ͱ͕Ͱ͖Δɻ

  7. ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸ

  8. αʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ˕֓ཁ Ξοϓϩʔμͷதʹ͸ར༻ऀ͕Ξοϓϩʔυͨ͠ϑΝΠϧΛWEBαʔόͷ ެ։σΟϨΫτϦʹอଘ͢Δ΋ͷ͕͋ΔɻϑΝΠϧͷ֦ுࢠ͕PHPͷΑ͏ ͳεΫϦϓτݴޠ͕ΞοϓϩʔυͰ͖ͯ͠·͏ͱWEBαʔό্Ͱ࣮ߦͰ͖ ͯ͠·͏ɻ ˕Өڹ ֎෦͔ΒεΫϦϓτ͕࣮ߦ͞ΕΔ͜ͱͰOSίϚϯυɾΠϯδΣΫγϣϯͷةݥ͕͋Δɻ WEBαʔό্ͷϑΝΠϧͷӾཡɾվ͟Μɾ࡟আ ֎෦αʔό΁ͷϝʔϧૹ৴

    ϑΝΠϧ QIQͳͲ ެ։σΟϨΫτϦ

  9. αʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ ˕߈ܸख๏ ߈ܸͰ͸ը૾ϑΝΠϧͷมΘΓʹεΫϦϓτΛΞοϓϩʔυ͢Δɻྫͱͯ͠ҎԼͷPHPεΫϦ ϓτΛΞοϓϩʔυ͢Δɻ Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ը૾Ͱ͸ͳ͍͕IMGཁૉͷ෦෼ʹɺ×ϚʔΫ͕දࣔ͞ΕΔɻ ϦϯΫΛΫϦοΫ͢ΔͱεΫϦϓτ͕࣮ߦ͞Εͯ /ETC/PASSWD ͕දࣔ͞ΕΔɻ ˕ରࡦ ֦ுࢠΛνΣοΫ͢Δ

    Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ެ։σΟϨΫτϦʹஔ͔ͣɺεΫϦϓτܦ༝ͰӾ ཡͤ͞Δ HACK.PHP IUUQFYBNQMFKQPQFO@EJS)"$,QIQ

  10. ·ͱΊ ϑΝΠϧΞοϓϩʔυʹର͢Δ߈ܸ ɾΞοϓϩʔυػೳʹର͢ΔDOS߈ܸ →Ξοϓϩʔυ࣌ɺ༰ྔ੍ݶ ɾαʔόʔ্ͷϑΝΠϧΛεΫϦϓτͱ࣮ͯ͠ߦ͢Δ߈ܸ →֦ுࢠʢJPGɾPNG౳ʣνΣοΫɾεΫϦϓτܦ༝ͰӾཡʢ࣮ߦͰ͖ͳ͍Α͏ʹʣ ɾ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸʢXSSʣʢຢʣ

  11. ͋Γ͕ͱ͏͍͟͝·ͨ͠ ϑΝΠϧΞοϓϩʔυʹ·ͭΘΔ໰୊

  12. ࢓ֻ͚ΛؚΉϑΝΠϧΛར༻ऀʹμ΢ϯϩʔυͤ͞Δ߈ܸ ˕֓ཁ ߈ܸ༻ʢ࢓ֻ͚ʣϑΝΠϧΞοϓϩʔυˠར༻ऀ͕ϑΝΠϧΛӾཡˠJSͷ ࣮ߦɺϚϧ΢ΣΞײછ ˕Өڹ ֎෦͔ΒεΫϦϓτ͕࣮ߦ͞ΕΔ͜ͱͰOSίϚϯυɾΠϯδΣΫγϣϯͷةݥ͕͋Δɻ WEBαʔό্ͷϑΝΠϧͷӾཡɾվ͟Μɾ࡟আ ֎෦αʔό΁ͷϝʔϧૹ৴ ˕ରࡦ Ξοϓϩʔυ͞ΕͨϑΝΠϧ͸ެ։σΟϨΫτϦʹஔ͔ͣɺ

    εΫϦϓτܦ༝ͰӾཡͤ͞Δ ϑΝΠϧ