February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
147
7
장
애플리케이션 아키텍처 약점 식별
애플리케이션 아키텍처 약점 식별
CHAPTER
7
지금까지 웹 애플리케이션의 요소를 식별하고, 웹 애플리케이션의
API
의 형상을 결정하고, 웹
애플리케이션이 사용자의 웹 브라우저와 어떻게 상호작용하는지 알아내는 여러 기법을 살펴
봤다. 각 기법은 자체로도 중요하지만 개별적으로 수집한 정보를 조직화했을 때 더 큰 가치가
있다.
1
부에서 제시한 대로 정찰 과정에서 노트를 만든다면 더할 나위 없이 좋다. 어떤 웹 애플리케
이션은 전체 기능을 탐색하는 데 몇 달이 걸릴 만큼 많은 비용이 들기 때문에 조사 결과를 적
절히 문서화하는 것이 필수적이다. 정찰하는 동안 작성하는 문서의 양은 여러분 (테스터, 해커,
취미가, 공학자 등)에게 달려 있으며 우선순위가 올바로 매겨지지 않으면 가치가 떨어질 수 있
기는 하지만 데이터가 전혀 없는 것보다는 과한 것이 낫다.
이상적으로는 테스트하는 각 애플리케이션에 대해 잘 조직화된 노트 모음이 만들어져야 한다.
노트에는 다음과 같은 정보를 기입한다.
●
웹 애플리케이션에 사용한 기술
●
HTTP
동사별
API
엔드포인트
●
API
엔드포인트 형상의 목록 (가능한 경우 )
●
웹 애플리케이션의 기능 (예: 댓글, 인증, 알림 등 )
●
웹 애플리케이션에 사용한 도메인
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.