February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
176
2
부
공격
가 더 어렵다. 위의 예에서 우리는 악의적 링크 페이로드를 만들어서 우리가 공격하고 싶은 사
용자에게 직접 보냈다. 이는 이메일, 웹 기반 광고, 그 외의 여러 방법으로 이뤄진다.
더군다나 앞에서 논의한 반사
XSS
는 유효한 링크인 것으로 쉽게 가장할 수 있다. 다음의
HTML
코드를 보자.
메가뱅크 팬에 오신 것을 환영합니다!
합법적인 메가뱅크 지원 정보와 링크를 제공하는 최고의 소스입니다.
<a href="https://mega-bank.com/signup">신규 회원 가입</a>
<a href="https://mega-bank.com/promos">프로모션 정보</a>
<a href="https://support.mega-bank.com/search?query=open+
<script>alert('test');</script>checking+account">
출금 계좌 개설</a>
위에는 세 개의 링크가 있으며 모두 커스텀 텍스트가 있다. 그중 둘은 해롭지 않지만, ‘출금 계
좌 개설’ 텍스트가 있는 마지막 링크를 클릭하면 지원 페이지로 이동한다.
alert
()
창이 뜬다
면 뭔가 이상한 일이 벌어진다는 걸 알 수 있겠지만 저장
XSS
예와 같이 코드를 몰래 실행하는
것은 어렵지 않다. 사용자 정보를 수집해 다른 사용자의 흉내를 낸다든지, 지원 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.