Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 3 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved.

Size: px

Start display at page:

せぴあわかはら
7 years ago
Views:

4 - Erroneous Error Handling - Information Leakage web - Session Hijacking/Replay - OS Command Injection - Session Fixation - SQL Injection - Brute Force Password check - Buffer Overflow - Forceful Browsing - Parameter manipulation - Back door and Debug mode web - phishing pharming - - Erroneous Error Handling - Information Leakage - Cross Site Scripting XSS - - Cross Site Request Forgery CSRF - F/W Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 7 Buffer Overflow Cross-Site Scripting Parameter Manipulation Backdoor & Debug Options SQL Injection OS Command Injection Client Side Comment Error Codes Forceful Browsing Unnecessary Information HTTPS Misuse Cross-Site Request Forgeries Unnecessary File Server misconfiguration Insecure Cookies Session Hijack Session Replay Session Fixation Known Vulnerability Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 8

- F/W Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved.

5 Buffer Overflow GET/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u 6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190 %u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 9 Cross-Site Scripting Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 10

NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u

11 Parameter Manipulation http://www.example.com/buy.cgi?

8 SQL Injection select id from user_table where id= ${id} and pw= ${pw} or 1=1 -- abc select id from user_table where id= or 1=1 -- and pw= abc where SQL Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 15 SQL Injection xxx' and 1=1-- xxx' and 1=0-- and absinthe Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 16

Inc. All Rights Reserved. 15 SQL Injection xxx' and 1=1-- xxx' and 1=0-- and absinthe http://www.

10 Error Codes Unnecessary Information Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 19 Forceful Browsing Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 20

12 Cross-Site Request Forgeries hidden hidden Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 23 Cross-Site Request Forgeries Cookie Cookie Cookie <a href= </a> Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 24

13 Unnecessary File /var/www/htdocs/ Image/ css/ script/ data/ toiawase.dat exec.cgi Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 25 Unnecessary File Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 26

14 Server misconfiguration Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 27 Insecure Cookies Set-Cookie: ssid= Cookie: ssid= Set-Cookie: ssid=hkhd3ksa31gak9f; secure Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 28

com/ Set-Cookie: ssid=1392383 http://www.example.

16 Session Fixation Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 31 Session Fixation <a href=" PHPSESSID=abcdefg"> </a> Cookie Set-Cookie: PHPSESSID=abcdefg Cookie: PHPSESSID=abcdefg Cookie: PHPSESSID=abcdefg Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 32

jsp;jsessionid=jk3lsw8fjhgyt10 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved.

go.jp/singi/singi_fccsg/gaiyou/f-20050415-singi_fccsg/02.

038 3 30 2.38 9 2.46 1 2.54 95 6.57 5,900 13.

21 id=naka, pw=ieog39sj pw hash( ieog39sj ) Pc0gGUJNM4fr4 MHn+9JhQQ naka, Pc0gGUJNM4fr4MHn+9JhQQ ID Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 41 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 42

22 1 Keep-Alive Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 43 GET / HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwaveflash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: ja Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1;.NET CLR ) Host: Connection: Keep-Alive HTTP/ OK Date: Wed, 29 Nov :21:21 GMT Server: Apache Content-Length: Connection: close Content-Type: text/html; charset=shift_jis <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 44

23 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 45 GET /auth/index.html HTTP/1.1 Accept: */* Accept-Language: ja Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1;.NET CLR ) Host: Connection: Keep-Alive Authorization: Basic Z3Vlc3Q6Zm9vYmFy Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 46

24 $ perl -MMIME::Base64 -e 'print MIME::Base64::decode_base64("Z3Vlc3Q6Zm9vYmFy");' guest::foobar Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 47 GET /auth2/index.html HTTP/1.1 Accept: */* Accept-Language: ja Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1;.NET CLR ) Host: Connection: Keep-Alive Pragma: no-cache Authorization: Digest username="guest", realm="sec", qop="auth", algorithm="md5", uri="/auth2/index.html",nonce="yfgkvbijbaa=2a8b5d8f5e1d4f4f342a457d8b604640f5 1347d5", nc= , cnonce="bfae40a7d3fdeb264eb078563de43943",response= "44985ca43eb4c7001c9948efcfa23a1f" Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 48

31 <input type= hidden name= sec_key value= ALG2K9Q0E > Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 61 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 62

第2回_416.ppt

第2回_416.ppt 3 2 2010 4 IPA Web http://www.ipa.go.jp/security/awareness/vendor/programming Copyright 2010 IPA 1 2-1 2-1-1 (CSRF) 2-1-2 ID 2-1-3 ID 2-1-4 https: 2-1-5 ID 2-1-6 2-1-7 2-2 2-2-1 2-2-2 2-3 2 2-3-1 Web Copyright