OKDT-IW02T6-JPNICdist.ppt

Size: px

Start display at page:

Download "OKDT-IW02T6-JPNICdist.ppt"

さゆりこうじょう
7 years ago
Views:

1 Internet Week 2002 tutorial - T6 riotaro@techstyle.jp

2 about Speaker Linux 2001 Allabout Linux PHP 2002 CISA

3 Web

4 cf.

7 :STRIDE Spoofing identity Tampering with data Repudiation Information disclosure Denial of Service attack Elevation of Privilege

8 IDC: HW: CPU ISP DNS ip FTP www smtp configuration logrotate ssh

9 1. Port Scan 20,22,80,8080, 2. Exploit Linux(ICMP), telnet, OpenSSH, Apache, DoS/DDoS, / HEAD GET 3. HTTP/HTTPS FORM FORM URL ( ) WWW DNS DB Admin

10 1. DNS JPNIC DNS DNS A 2. Cookie Cookie (/ ) XSS Cookie WWW DNS DB Admin

11 FORM URL ex. (D)DoS DB 2 WWW DNS DB Admin

13 strcpy nervous

14 strcpy(d,s); if(strlen(s)< sizeof(d)){ strcpy(s, d); } strcpy/strncpy strncpy(d,s,n); s NULL d[sizeof(d)-1] = 0 ; strncpy(d, s, sizeof(d)); // s if(d[sizeof(d)-1]!= 0 ){ // s }

15 CR/LF gets/fgets

16 format string printf(inputbuf); // inputbuf prinft(%s, inputbuf); // sprintf

17 strcpy strcat strncpy strncat memcpy sprintf printf strlen gets, scanf, include, readfile, fopen, file, link, unlink, symlink, rename, rmdir, chmod, chown, chgrp, exec, system, passthru, popen ( ) p TechStyle WEB 2002

link, unlink, symlink, rename, rmdir, chmod, chown,

18 FORM WEB SQL include URL HTML Referer

19 XSS JavaScriptCookie Not Found SQL Error HTML exploit Cookie disable Cookie input validation

20 Cookie Spoofing Cookie RFC Cookie Spoofing 1. victim.cracker.edu victim.cracker.edu session_id= spoof.cracker.edu session-id= 1111 Domain=.cracker.edu 3. victim.cracker.edu Cookie: $Version="1"; session_id="1234", $Version="1"; session_id="1111"; $Domain=".cracker.edu" victim.cracker.edu Cookie

21 input validation input validation, data cleaning URL HTML

22 %( ) GET URL %HH(H: ) URL ex. URL validation 1 ex. %00 (NULL), %0A( ), %20( ), %25( ) %2500 %00 NULL cf.url

23 (bang) ; (semi-colon) backslash) (colon), (comma) (minus) ex.!/bin/bash -f /etc/passwd ex.../../../../ *.png

24 <(lesser than) >(grater than) (double quote) (single quote) exploit Cookie ex. ex. ><script>alert(window.location);</script> ;alert(document.cookie); onmouseover= alert(document.cookie); ><script> alert(document.cookie);</script> ></a> <script> alert(document.cookie);</script> ;cat /etc/passwd >>/home/html/htdocs/index.html

25 HTML <p>,<bold>,<i>,<em>,<strong>,<pre>,<br> Well-formed exploit Javascript ex. <b onmouseover=[code]> </b> <img src= javascript:[code]> <style type= text/javascript >[code]</style>

26 PHP ereg_replace( [^0-9],,$data) addslashes($data) addcslashes (string str, string charlist) single,double, NULL slashing( ) quotemeta($data).+?[^](*)$ quote escapeshellcmd($data) escape nl2br ( $str ) <br /> htmlspecialchars ("<a href='test'>test</a>", ENT_QUOTES); HTML

27 WEB apache DB mysql / postgresql DB ID ACL IP

28 ID / Password hash hash DB ID WEB invisible /tmp/ WEB pay SQL DELETE unlink

29 XOR rand MD5 /

30 DoS DoS CPU WEB slashdot/ec NAT

31 Lim, John, Tuning Apache and PHP for Speed on Unix

33 ...

34 ... TCP/IP, Intel DoS ipchains Apache, SSH

35 OS UNIX, Linux (Debian,RedHat,Turbo,Miracle)

36 7.2? 7.3? rpm rebuilddb rpm -qa CVS, RCS

37 VMware

38 ab webalizer...

39 ML WEB TechStyle

41 WEB

42 Saltzer, J.H., and M.D. Schroeder, "The Protection of Information in Computer Systems," Proc. IEEE, Vol. 63, No. 9, Sept. 1975, pp Wall, Larry and Schwartz, Randal L. "Programming Perl" : Sebastopol, California : O'Reilly And Associates, Al-Herbish, Thamer, Secure UNIX Programming FAQ,1999 Wheeler, David A. Secure Programming for Linux and Unix HOWTO, 2002 Howard, M. and LeBlanc, David, WRITING SECURE CODE, 2002 RFC 2396, 2965 Lim, John, Tuning Apache and PHP for Speed on Unix,2001( )

43 Sier PR TechStyle Linux UNIX PHP Apache Postgres MySQL Linux Apache PHP MySQL PostgreSQL Ruby PHP Perl JavaScript HTML Flash IT RFC Ietf-draft W3C ODL BS

44 Thank You Please feel free to mail me

about Speaker! 岡田良太郎 1989 年神戸市立神戸工業高等専門学校電気工学科卒業 1999 年日本 Linux 協会運営委員 2001 年有限会社テューンビズ代表取締役就任 Allabout Linux ガイド担当 2002 年株式会社テックスタイル代表取締役就任 PHP カンファレ

Internet Week 2003 tutorial T13 セキュアな WEB アプリケーション開発構築 ~ ユーザーに不安を感じさせないサイトとは ~ 岡田良太郎株式会社テックスタイル http://techstyle.jp/ riotaro@techstyle.jp about Speaker! 岡田良太郎 1989 年神戸市立神戸工業高等専門学校電気工学科卒業 1999 年日本 Linux