February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
183
11
장
사이트 간 요청 위조(CSRF)
사이트 간 요청 위조(
CSRF
)
CHAPTER
11
원하는 작업을 실행할 수 있는
API
엔드포인트를 알고 있지만 해당 엔드포인트가 권한 (예: 관
리자 계정 )을 요구해 액세스할 수 없는 경우가 있다.
11
장에서는 관리자 등 권한 있는 계정에서 자바스크립트 코드를 사용하지 않고 우리가 원하는
작업을 수행하는 결과를 얻는
사이트 간 요청 위조
(
CSRF
) 익스플로잇을 만든다.
CSRF
공격은 브라우저의 작동 방식에 착안해 웹사이트와 브라우저 사이의 신뢰 관계를 이용
한다. 안전을 확인하기 위해 사용하는
API
호출이 브라우저를 과도하게 신뢰하는 것을 찾아내
어 링크를 만들고 약간의 노력을 들여 수정함으로써 해커가 자신의 이익을 위해 요청을 일으키
되 그 요청을 생성하는 당사자는 그 사실을 알지 못한다.
CSRF
공격은 브라우저에서 일어나는 요청이 눈에 띄지 않기 때문에 당하는 사람이 눈치채지
못할 때가 많다. 이것은 이 공격 유형이 권한 있는 사용자를 이용해 본인이 알지 못하는 채로
서버에 대한 작업을 일으키는 데 사용됨을 의미한다.
CSRF
는 가장 은밀한 공격으로 개념이 만
들어진
2000
년대 초부터 웹사이트에 피해를 끼쳤다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.