January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
356
｜
第
11
章
他发现了导致任意
HTTP
请求注入、从
HTTPS
降级到
HTTP
，以及通过跟踪
方法向客户端呈现恶意内容的缺陷。
引入
TLS
扩展是为了通过密码方式将重新协商与现有会话绑定来解决这个问
题
注
26
。流行的
TLS
库已经实现了该扩展，并支持安全重新协商。
压缩
TLS 1.2
和以前的版本支持通过
DEFLATE
注
27
压缩。当压缩应用于包含
HTTP
报头（具有已知的结构和格式）的块时，可以通过观察压缩的密文来
揭示会话令牌。犯罪攻击的目标是
TLS
内部的压缩，而破坏和时间攻击利用
HTTP
压缩（不管传输层如何）来揭示
HTTP
响应中的秘密。
STARTTLS
STARTTLS
命令用于通过明文协议（例如，
SMTP
、
IMAP
、
pop 3
或
FTP
）
建立
TLS
会话，如实例
11-4
所示利用了
SMTP
注
28
。
TLS
会话是在确认
STARTTLS
指令后协商的，如前所述，涉及记录交换。
实例 11-4：通过 SMTP 启动一个 TLS 会话
root@kali:~#
telnet mail.imc.org 25
Trying 207.182.41.81...
Connected to mail.imc.org.
Escape character is '^]'.
220 proper.com ESMTP Sendmail 8.14.9/8.14.7; Wed, 29 Oct 2014 09:03:59
EHLO world
250-proper.com Hello wifi-nat.bl.uk (may be forged), ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.