February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
98
1
부
정찰
나타나더라도 버그 바운티 헌터보다 우리가 먼저 찾아내야 하므로 시간이 촉박하다.
그러므로 우리는 메가뱅크에서 아직 방어가 덜 된 쉬운 타깃을 찾고자 한다. 이 테스트는 당사자
에게 의뢰받은 윤리적 테스트이지만 그렇다고 해서 우리 마음대로 휘저어도 되는 것은 아니다.
가장 먼저 할 일은 정찰을 수행해
mega
-
bank
.
com
에 붙은 서브도메인의 목록으로 웹 애플리케
이션 맵을 채우는 것이다 (그림
4
-
1
).
www
는 외부에 공개된 웹 애플리케이션 자체를 가리키
므로 우리는 그쪽에 관심이 없다. 고객을 상대하는 큰 회사들은 실제로 기본 도메인에 붙은 여
러 서브도메인을 운영한다. 이러한 서브도메인들은 각각 이메일, 관리자 애플리케이션, 파일
서버 등의 용도로 사용된다.
그림
4-1
mega
-
bank
.
com
의 단순한 서브도메인 웹이다. 이러한 웹은 훨씬 복잡할 수도 있고 외부망에서 액세스할 수
없는 서버를 포함하기도 한다.
서브도메인 데이터를 찾는 방법은 많이 있으며 원하는 결과를 얻으려면 여러 방법을 시도해봐
야 할 것이다. 우선 가장 단순한 방법부터 알아보자.
4.2
브라우저에 내장된 네트워크 분석 도구
처음에는 메가뱅크에서 눈에 보이는 기능을 따라가며 백그라운드에서 일어나는
API
요청을 관
찰함으로써 유용한 데이터를 수집할 수 있다. 이러한 방법으로 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.