February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
129
5
장
API 분석
64
로, 또는 그 반대로 변환할 수 있다. 베이스
64
로 인코딩된 문자열을
atob
함수의 인자로 전
달하면 네트워크를 통해 전송되는 사용자명과 패스워드를 볼 수 있다.
/*
* 베이스64로 인코딩된 문자열을 디코드.
* 결과 = joe:1234
*/
atob('am9lOjEyMzQ=');
기본 인증은 메커니즘이 이렇게 취약하기 때문에
SSL
/
TLS
트래픽 암호화를 적용한 웹 애플리
케이션에서만 제한적으로 사용된다. 공공장소의
WiFi
핫스폿을 이용해 자격 증명을 가로채는
것과 같은 방법은 먹히지 않는다.
로그인/홈페이지로의 리다이렉트
redirect
1
를 분석하며 얻은 교훈은 요청의 인증이 실제로 일어나
며
Authorization
:
Basic
am9lOjEyMzQ
=
을 통해 이뤄진다는 점이다. 빈 페이로드를 가지고
다른 엔드포인트를 시도할 때 흥미로운 것이 반환되지 않는 경우에 가장 먼저 할 일은 인증 헤
더를 붙임으로써 인증된 사용자로서 요청했을 때 어떤 차이점이 있는지 살펴보는 것이다.
5.3
엔드포인트 형상
서브도메인을 여러 개 찾아내고 각 서브도메인의
HTTP
API
도 알아냈으면 리소스별
HTTP
동사를 확인해 조사 결과를 애플리케이션 맵에 추가할 차례다. 서브도메인,
API
, 형상에 대한
완전한 목록을 얻은 후에는 주어진
API
가 어떤 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.