February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
345
27
장
서드파티 의존성 보안
서드파티 의존성 보안
CHAPTER
27
1
부 ‘정찰’에서는 퍼스트 파티 웹 애플리케이션에서 서드파티 의존성을 식별하는 방법을 알아
봤다.
2
부 ‘공격’에서는 서드파티 의존성이 퍼스트 파티 웹 애플리케이션에 통합된 다양한 방식을 분
석했다. 통합에 근거해 잠재적 공격 벡터를 식별했으며 그러한 통합을 익스플로잇하는 방법을
논의했다.
3
부는 해커를 저지하는 방어 기법을 다루므로
27
장은 서드파티 의존성을 통합할 때 발생할 수
있는 취약점으로부터 애플리케이션을 보호하는 법을 다룬다.
27.1
의존성 트리 평가
서드파티 의존성을 고려할 때 항상 염두에 둬야 할 가장 중요한 점은 서드파티도 자체적인 의
존성을 갖는 것이 많다는 점이다. 이런 것을 포스파티 의존성
fourth
-
party
dependency
이라고 부르기도
한다.
포스파티 의존성이 없는 단일 서드파티 의존성을 수작업으로 평가하는 것은 실천 가능하다. 서
드파티 의존성의 코드 수준을 수동으로 평가하는 것이 이상적인 경우도 있다.
안타깝게도 수작업으로 이뤄지는 코드 리뷰는 규모를 키우기가 쉽지 않고 많은 경우에 포스파티
346
3
부
방어
의존성이 있는 서드파티 의존성을 완전히 검토하는 일은 불가능하다. 포스파티 의존성이 또다
시 자체 의존성을 갖는다면 특히 더 그렇다.
이와 같이 서드파티
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.