February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
101
4
장
서브도메인 찾기
아무 웹사이트를 골라 요청을 선택하고
Headers
탭의
General
→
Request
URL
항목을 보
면 어느 도메인에 요청을 했거나 응답이 어디로부터 왔는지 볼 수 있다. 기본 웹사이트와 연계
된 서버를 찾는 데 이것으로 충분할 때도 많다.
4.3
공개된 레코드를 이용하기
오늘날 웹에 공개된 정보는 너무나 많고 실수로 누설된 데이터가 몇 년 동안 방치되기도 한다.
뛰어난 해커는 이러한 점을 이용해 쉽게 공격할 수 있는 흥미로운 정보를 찾아낸다.
지금까지 침투 테스트를 수행하면서 다양한 정보를 웹에서 찾을 수 있었다.
●
실수로 공개했다가 비공개로 되돌린 깃허브 저장소의 캐시된 사본
●
SSH
키
●
아마존
AWS
나
Stripe
같은 서비스의 여러 가지 키를 공개된 웹 애플리케이션에 임시로
게시했다가 삭제한 것
●
외부에 공개하지 않는
DNS
와
URL
목록
●
출시 전인 제품의 세부 사항을 담은 비공개 페이지
●
웹에서 제공하되 검색 엔진의 크롤링을 허가하려고 하지 않았던 재무 기록
●
이메일 주소, 전화 번호, 사용자명
이러한 정보를 다음과 같은 곳에서 구할 수 있다.
●
검색 엔진
●
소셜 미디어 게시물
●
archive
.
org
와 같은 아카이빙 애플리케이션
●
이미지 검색과 역 이미지 검색
1
1
옮긴이_ 구글의 ‘이미지로 검색’ 기능
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.