February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
133
6
장
서드파티 의존성 식별
서드파티 의존성 식별
CHAPTER
6
오늘날 웹 애플리케이션 대부분은 자체 개발한 코드와 외부 코드를 조합해 만들며 이때 다양한
통합 기법 중 한 가지를 사용한다. 외부 의존성은 특정 라이선스 모델을 따르는 다른 회사의 독
점적 자산일 수도 있고 공개 소프트웨어가 될 수도 있다. 그러한 서드파티 의존성을 이용하는
데에는 위험이 따른다. 서드파티 의존성에 대한 보안 검토를 자체 개발한 코드만큼 철저하게
하지 않을 때도 있다.
정찰을 수행하는 동안 서드파티 통합을 많이 보게 되는데 의존성과 통합 방법을 유심히 살펴볼
필요가 있다. 때로는 이러한 의존성을 공격 벡터로 활용할 수 있다. 때로는 그러한 의존성의 취
약점이 잘 알려져 있어 공격 기법을 스스로 개발하지 못하더라도
공통적인 취약점과 노출
Common
Vulnerabilities
and
Exposures
(
CVE
) 데이터베이스에서 공격을 그대로 따라 할 수 있다.
6.1
클라이언트 측 프레임워크 검출
개발자들은 복잡한
UI
인프라를 직접 구축하지 않고 관리와 테스트가 잘된
UI
프레임워크를
이용할 때가 많다. 복잡한 상태를 처리하는
SPA
라이브러리, 브라우저의 자바스크립트 기능의
부족한 점을 보완하는 자바스크립트 프레임워크(
Lodash
,
jQuery
), 웹사이트의 외형과
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.