February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
286
3
부
방어
해커원
HackerOne
과 버그크라우드
Bugcrowd
가 그 예로, 이러한 회사는 커스터마이즈하기 쉬운 법적
템플릿뿐 아니라 제출과 분류를 위한 웹 인터페이스도 제공한다. 해커원은 웹에서 가장 유명한
버그 바운티 플랫폼이며 소기업에서 버그 바운티 프로그램을 꾸리는 것을 돕고 보안 연구자 및
윤리적 해커를 연결해준다 (그림
20
-
2
).
형식을 갖춘 책임 있는 공개 정책을 가지고 버그 바운티 프로그램을 운영한다면 프리랜서 침투
테스터 (버그 바운티 헌터 )와 최종 사용자가 취약점을 찾아서 보고할 동기를 가질 것이다.
그림
20-2
버그 바운티 플랫폼 해커원
20.4
서드파티 침투 테스팅
책임 있는 공개 시스템과 더불어 버그 바운티 프로그램을 통한 공개에 인센티브를 제공하면 서
드파티 침투 테스팅은 코드베이스의 보안에 대해 자체 개발 팀으로부터 얻지 못하는 깊은 통찰
을 제공할 수 있다. 서드파티 침투 테스터는 조직과 직접적인 협력 관계가 아니라는 점에서 버
그 바운티 헌터와 비슷하지만 웹 애플리케이션의 보안에 대한 통찰을 제공한다.
버그 바운티 헌터 (대체로 최상위
1
% 미만 )는 프리랜서 침투 테스터다. 그들은 원할 때 일을
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.