Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
情報セキュリティ勉強会 実践編
Search
Yusuke Saito
August 30, 2017
Technology
1
730
情報セキュリティ勉強会 実践編
Webアプリの脆弱性対策について
Yusuke Saito
August 30, 2017
Tweet
Share
More Decks by Yusuke Saito
See All by Yusuke Saito
情報セキュリティ勉強会 基礎編
yusuke_saito
2
1.2k
せっかくのグローバルイベントだから海外のエンジニアと話そう!
yusuke_saito
0
510
RFCから読むHTTP/2の仕組みと速さの秘密
yusuke_saito
0
340
Other Decks in Technology
See All in Technology
エンジニア採用ノウハウ0から継続的な採用に至るまで / Try recruiting engineers
ohageeq
0
120
Azure SQL Database Hyperscale HA レプリカの監視
sansantech
PRO
0
160
Namespace, Now and Then
tagomoris
0
140
What is “Lambdaless” Serverless
smt7174
0
150
日本の医療システムの再構築を目指すスタートアップ「カケハシ」のフロントエンド領域でのチャレンジ / Challenges in the frontend domain at “Kakehashi”
kakehashi
3
1.7k
AWS IAM Identity Center議論会 〜 認証認可結合モデルと認証認可分離モデル / 20240827-jawsug-arch-iam_identity_center
opelab
3
280
バックログを導入し やっぱやめた話
ota42y
0
130
リクルートのデータマネジメント組織に 求められてきたコト
recruitengineers
PRO
4
290
20240825_bedrock_helpdesk_jp.pdf
gamogamo
0
120
Building Static Websites with Sculpin
opdavies
0
1.4k
Practical AWS Step Functions. Batch systems built with no code.
kinunori
1
110
「名前解決」から振り返るAmazon VPC
yuki_ink
0
310
Featured
See All Featured
Being A Developer After 40
akosma
81
580k
The Power of CSS Pseudo Elements
geoffreycrofte
71
5.2k
The Illustrated Children's Guide to Kubernetes
chrisshort
46
48k
Producing Creativity
orderedlist
PRO
340
39k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
225
22k
For a Future-Friendly Web
brad_frost
173
9.3k
Reflections from 52 weeks, 52 projects
jeffersonlam
346
20k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
248
20k
Principles of Awesome APIs and How to Build Them.
keavy
125
16k
Six Lessons from altMBA
skipperchong
26
3.3k
Code Reviewing Like a Champion
maltzj
518
39k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
33
1.9k
Transcript
ηΩϡϦςΟษڧձ ࣮ફฤ 2017/08/30
࣍ 1. ྫͷΞϨ 2. WebγεςϜ͕ड͚Δ߈ܸͱ 3. Δ͖ରࡦͱ 4. ੬ऑੑͷݟ͚ͭํͱ
ྫͷΞϨ
IUUQXXXTPGUJDPSKQTFNJ@PQQEG
ηΩϡϦςΟରࡦͬͯͨΓલ SQLΠϯδΣΫγϣϯ͕ݪҼͰΧʔυใ͕ྲྀग़ͨ͠ࣄ݅Ͱ͢ɻ ܾͷϙΠϯτɺ
ηΩϡϦςΟରࡦͬͯͨΓલ SQLΠϯδΣΫγϣϯ͕ݪҼͰΧʔυใ͕ྲྀग़ͨ͠ࣄ݅Ͱ͢ɻ ܾͷϙΠϯτɺ
ηΩϡϦςΟରࡦͬͯͨΓલ SQLΠϯδΣΫγϣϯ͕ݪҼͰΧʔυใ͕ྲྀग़ͨ͠ࣄ݅Ͱ͢ɻ ܾͷϙΠϯτɺ
SQLΠϯδΣΫγϣϯରࡦΛࢪͨ͠ ϓϩάϥϜΛఏڙ͖͢࠴
ಉ࣌ʹɺ
ʮ·͍͠ʯඞਢͰͳ͍
ʮ·͍͠ʯඞਢͰͳ͍
ʮ·͍͠ʯඞਢͰͳ͍
ͯ͞ɺԿ͕Δඞཁͷ ͋Δରࡦͳͷ͔
None
None
None
෮श͠·͠ΐ͏ɻ
ࡋͰෛ͚ͳ͍ͨΊͷྗ ʮࡋରࡦʯͱͯ͠ɺԼهͷΑ͏ͳυΩϡϝϯτʹॻ͍ͯ ͋Δ͜ͱɺʮͬͯͨΓલʯͱ͍͏ѻ͍Λड͚·͢ɻ
ࡋͰෛ͚ͳ͍ͨΊͷྗ ʮࡋରࡦʯͱͯ͠ɺԼهͷΑ͏ͳυΩϡϝϯτʹॻ͍ͯ ͋Δ͜ͱɺʮͬͯͨΓલʯͱ͍͏ѻ͍Λड͚·͢ɻ ๏ɾྩɾলྩ
ࡋͰෛ͚ͳ͍ͨΊͷྗ ʮࡋରࡦʯͱͯ͠ɺԼهͷΑ͏ͳυΩϡϝϯτʹॻ͍ͯ ͋Δ͜ͱɺʮͬͯͨΓલʯͱ͍͏ѻ͍Λड͚·͢ɻ ๏ɾྩɾলྩ ܦࡁ࢈ۀলͷΨΠυϥΠϯ
ࡋͰෛ͚ͳ͍ͨΊͷྗ ʮࡋରࡦʯͱͯ͠ɺԼهͷΑ͏ͳυΩϡϝϯτʹॻ͍ͯ ͋Δ͜ͱɺʮͬͯͨΓલʯͱ͍͏ѻ͍Λड͚·͢ɻ ๏ɾྩɾলྩ ܦࡁ࢈ۀলͷΨΠυϥΠϯ *1"ͷΨΠυϥΠϯ
ࡋͰෛ͚ͳ͍ͨΊͷྗ ʮࡋରࡦʯͱͯ͠ɺԼهͷΑ͏ͳυΩϡϝϯτʹॻ͍ͯ ͋Δ͜ͱɺʮͬͯͨΓલʯͱ͍͏ѻ͍Λड͚·͢ɻ ๏ɾྩɾলྩ ܦࡁ࢈ۀলͷΨΠυϥΠϯ *1"ͷΨΠυϥΠϯ ۀքஂମͷΨΠυϥΠϯ
WebγεςϜ͕ड͚Δ ߈ܸͱ
ใηΩϡϦςΟ10େڴҖ
ใηΩϡϦςΟ10େڴҖ
OWASP Top10 OWASP (The Open Web Application Security Project) ͕ൃද͢Δɺॏ
ཁͳڴҖΛ·ͱΊͨυΩϡϝϯτɻϦεΫͷߴ͞߈ܸγφϦΦ·ͱ ·͍ͬͯΔͷͰɺඇৗʹࢀߟʹͳΔɻ https://www.owasp.org/images/7/79/OWASP_Top_10_2013_JPN.pdf
OWASP Top10 (2013)
OWASP Top10 (2013)
OWASP Top10 (2013)
OWASP Top10 (2013)
Δ͖ରࡦͱ
҆શͳΣϒαΠτͷ࡞Γํ http://www.ipa.go.jp/security/vuln/websecurity.html
҆શͳΣϒαΠτͷ࡞Γํ ։ൃ࣌ʹ࣮ࢪ͖͢ηΩϡϦςΟରࡦʹ͍ͭ ͯ·ͱΊΒΕ͍ͯ·͢ɻ
҆શͳΣϒαΠτͷ࡞ΓํɹνΣοΫϦετ
੬ऑੑͷݟ͚ͭํ
Σϒ݈߁அ༷ ΣϒΞϓϦͷ੬ऑੑݕࠪͷํ๏ʹ͍ͭͯ· ͱΊΒΕ͍ͯ·͢ɻ
੬ऑͳαΠτͰ੬ऑੑΛݟ͚ͭͯΈΑ͏
WebGoat IUUQTHJUIVCDPN8FC(PBU8FC(PBU ͓खܰʹ੬ऑੑΛࢼͤΔ 8FCΞϓϦέʔγϣϯɻ ͱͬͯ੬ऑʂ
੬ऑ͗ͯ͢֎ʹཱͯΔͷ ጨΒΕΔͷͰ
ΦεεϝDockerͰʂ docker run -p 8080:8080 webgoat/webgoat-7.1
IUUQMPDBMIPTU8FC(PBU HVFTUHVFTUͰϩάΠϯͨ͠Β
ϝχϡʔ͔Βࢼ͍ͨ͠੬ऑੑΛ୳ͯ͠༡΅͏ʂ
੬ऑੑνΣοΫπʔϧ 08"41;"1 08"41͕ఏڙ͢Δπʔϧɻ IUUQTXXXPXBTQPSHJOEFYQIQ08"41@;FE@"UUBDL@1SPYZ@1SPKFDU
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̍ʣ ;"1ͷΦϓγϣϯ͔ΒɺʮϩʔΧϧɾ ϓϩΩγʯΛઃఆ͢Δɻ ઌఔͷ8FC(PBU͕Ͱಈ͍͍ͯ Δͱࢥ͏ͷͰɺॏͳΒͳ͍ϙʔτͰಈ ͔͠·͠ΐ͏ʂʢྫͰʣ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̎ʣ ωοτϫʔΫઃఆ͔Β8FCϓϩ ΩγΛઃఆɻઌఔͷ;"1Ͱઃఆ ͨ͠ϙʔτΛࢦఆͯ͠Լ͍͞ɻ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̏ʣ ϒϨʔΫઃఆΛ0/
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̏ʣ ϒϨʔΫઃఆΛ0/
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̐ʣ ϒϥβ͔Β ΞΫηεΛ࣮ߦ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̑ʣ ΞΫηεΛั֫ʂ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̒ʣ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̒ʣ ύϥϝʔλΛॻ͖͑ͯ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̒ʣ ύϥϝʔλΛॻ͖͑ͯ (0
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̓ʣ Ϩεϙϯε͕ฦͬͯ͘Δʂ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̓ʣ Ϩεϙϯε͕ฦͬͯ͘Δʂ ଓ͖Λ(0ʂ
OWASP ZAPͷ͍ํ ϩʔΧϧϓϩΩγฤʢ̔ʣ ϒϥβʹϨεϙϯε͕දࣔ͞ΕΔʂ
͓खܰʹ͍ΖΜͳ੬ऑੑΛπʔϧͰ νΣοΫͯ͘͠ΕͨΒ͍͍ͷʹʂ
OWASP ZAPͷ͍ํ ηΩϡϦςΟεΩϟϯฤʢ̍ʣ
OWASP ZAPͷ͍ํ ηΩϡϦςΟεΩϟϯฤʢ̍ʣ ΫΠοΫελʔτ͔Β
OWASP ZAPͷ͍ํ ηΩϡϦςΟεΩϟϯฤʢ̍ʣ ΫΠοΫελʔτ͔Β 63-Λೖྗͯ͠
OWASP ZAPͷ͍ํ ηΩϡϦςΟεΩϟϯฤʢ̍ʣ ΫΠοΫελʔτ͔Β 63-Λೖྗͯ͠ (0
OWASP ZAPͷ͍ํ ηΩϡϦςΟεΩϟϯฤʢ̎ʣ ࣌ؒ݁ߏ͔͔Δɻ ʢવαΠτنʹΑΔʣ ͜ΕSVCZHPBUͱ͍͏ผͷ(PBUͰͷ݁Ռɻ ɻ