February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
161
8
장
1부를 마치며
1
부 ‘정찰’에서는 웹 애플리케이션의 구조와 기능을 조사해 문서화하는 여러 방법을 알아보았다. 최상위 도메
인뿐 아니라 서브도메인에 존재하는 서버에서
API
를 찾는 방법을 평가했다. 엔드포인트가 노출하는
API
와
수용하는
HTTP
동사를 찾는 방법을 검토했다.
서브도메인,
API
,
HTTP
동사의 맵을 만든 다음 각 엔드포인트에서 어떤 요청과 응답 페이로드를 수용하는
지 판별하는 방법을 살펴보았다. 일반적인 관점에서 접근했으며 공개된 명세를 찾음으로써 페이로드의 구조를
더 빠르게 알아내는 방법도 살펴봤다.
애플리케이션의
API
구조를 매핑하는 방법을 조사한 다음으로는 서드파티 의존성과 관한 논의를 시작하고
자체 개발한 애플리케이션에서 서드파티 통합을 검출하는 여러 방법을 평가했다.
SPA
프레임워크, 데이터
베이스, 웹 서버를 검출하는 방법을 배웠으며 다른 의존성의 버전을 식별하는 일반적인 기법(핑거프린팅 같은
것)을 배웠다.
끝으로 아키텍처의 결함으로 기능에 대한 보호가 허술해질 수 있음을 논의하며 정찰에 대한 내용을 마무리했
다. 안전하지 않은 웹 애플리케이션 아키텍처의 몇 가지 공통적 형태를 평가함으로써 성급히 개발된 웹 애플
리케이션이 겪는 위험에 대한 통찰을 얻었다.
이제
2
부 ‘공격’에서는 해커가 현대 웹 애플리케이션에 침투하기 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.