February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
97
4
장
서브도메인 찾기
서브도메인 찾기
CHAPTER
4
API
엔드포인트를 살펴보고 테스트하기에 앞서 해당 웹 애플리케이션의 도메인 구조에 먼저
익숙해져야 한다. 오늘날 단일 도메인만으로 웹 애플리케이션을 전적으로 서비스하는 곳은 찾
아보기 힘들다.
웹 애플리케이션은 대개 클라이언트와 서버 도메인으로 분할되어 있으며, 잘 알려진
https
: //
www
로 된 곳도 있고 단순히
https
: //
로 된 곳도 있다. 웹 애플리케이션을 구성하는 서브도메
인을 반복적으로 찾아내어 기록하는 능력은 웹 애플리케이션에 대한 정찰의 첫 단계가 되는 유
용한 기술이다.
4.1
한 도메인에 여러 애플리케이션이 있는 경우
메가뱅크라는 이름의 은행에서 의뢰받은 블랙 박스 침투 테스트를 잘 수행하기 위해 웹 애플리
케이션의 매핑을 시도한다고 가정하자. 우리는
https
://
www
.
mega
-
bank
.
com
에 있는 메가뱅
크 애플리케이션에 사용자가 로그인해 자신의 은행 계정에 액세스할 수 있음을 알고 있다.
우리는 메가뱅크가
mega
-
bank
.
com
도메인 이름에 연결된 인터넷에 액세스할 수 있는 다른 서
버도 갖고 있는지 특히 궁금하다. 그 이유는 다음과 같다. 메가뱅크는 버그 바운티 프로그램
을 운영하며 그 프로그램의 범위는
mega
-
bank
.
com
도메인 전체를 포괄한다. 그 결과
mega ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.