February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
167
10
장
사이트 간 스크립팅(XSS)
사이트 간 스크립팅(
XSS
)
CHAPTER
10
오늘날 웹 애플리케이션에서 사용자 상호작용이 증가함에 따라 나타난
XSS
취약점은 인터넷
에서 가장 일반적인 취약점이다.
웹 애플리케이션이 사용자의 브라우저에서 스크립트를 실행한다는 점을 이용한다는 것이
XSS
공격의 핵심적인 작동 원리다. 만약 동적으로 생성되어 실행되는 스크립트를 누군가 (특히 최
종 사용자)가 어떤 식으로든 오염시키거나 수정할 수 있게 되면 스크립트 때문에 웹 애플리케
이션이 위험에 처할 수 있다.
XSS
공격을 크게 다음 세 가지로 분류한다.
●
저장
stored
(코드를 실행하기 전에 데이터베이스에 저장 )
●
반사
reflected
(코드를 데이터베이스에 저장하지 않고 서버에 의해 반사 )
●
DOM
기반
DOM
-
based
(코드를 브라우저에 저장해 실행 )
다른 기준으로 분류하기도 하지만 이 세 가지는 현대 웹 애플리케이션에서 항상 주시해야 할
XSS
의 유형을 망라한다.
오픈 소스 웹 애플리케이션 보안 프로젝트
Open
Web
Application
Security
Project
(
OWASP
)와 같은 단체
에서도 위 세 가지
XSS
공격을 웹에서 가장 일반적인
XSS
공격 벡터로 지목했다.
이 세 가지를 모두 논의하겠지만 먼저
XSS
공격이 어떻게 생성되며 그러한
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.