February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
184
2
부
공격
11.1
질의 매개변수 변조
가장 일반적인
CRSF
공격 유형인 하이퍼링크를 통한 매개변수 변조를 알아보자.
웹의 하이퍼링크 형식 대부분은
HTTP
GET
요청과 관계가 있다.
HTML
코드에서 가장 일반
적인 것은
<
a
href
="
https
://
my
-
site
.
com
"></
a
>
형태다.
HTTP
GET
요청 방식은 어디서 왔고 무엇을 읽으며 네트워크를 어떻게 타고 다니는지와 관
계없이 단순하고 일관적이다.
HTTP
GET
이 유효하려면 지원되는
HTTP
명세 버전을 따라야
하므로 어떤 애플리케이션이든
GET
요청의 구조는 똑같다고 확신할 수 있다.
HTTP
GET
은 다음과 같이 이뤄진다.
GET /resource-url?key=value HTTP/1.1
Host: www.mega-bank.com
모든
HTTP
GET
요청은
HTTP
메서드 (
GET
), 리소스의
URL
, 선택적인 질의 매개변수 순
으로 구성된다. 질의 매개변수는 물음표에서 시작해 공백이 나타날 때까지 이어진다. 그 뒤에
HTTP
명세가 따라오며 그 다음 행에는 리소스
URL
을 찾을 수 있는 호스트가 온다.
웹 서버는 요청을 받으면 질의 매개변수와 함께 요청을 한 사용자가 누구이며 브라우저 종류가
무엇이고 어떤 데이터 형식으로 반환하기를 기대하는지 식별하는 추가 정보를 핸들러
handler ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.