February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
189
11
장
사이트 간 요청 위조(CSRF)
2
.
해커는 다음과 같은 매개변수가 있는
URL
문자열을 만든다.
<a href="https://www.megabank.com/transfer?to_user=<해커의 계좌>&amount=10000">이곳을
클릭하세요</a>
.
3
.
해커는 예금이 충분하고 로그인할 확률이 가장 높은 대상을 공략할 것인지 혹은 발각되
기 전에 최대한 많은 사람에게 뿌릴 것인지 배포 전략을 수립한다.
이런 공격은 이메일이나 소셜 미디어를 통해 배포할 때가 많다. 배포의 용이성으로 회사에 악
영향을 줄 수 있다. 심지어 가능한 한 많은 사람에게 링크를 뿌리기 위해 해커가 웹 광고 캠페
인을 활용하기도 한다.
11.2
GET
페이로드 바꿔치기
브라우저의 기본
HTTP
요청이
GET
요청이므로,
URL
매개변수를 수용하는 많은
HTML
태
그는 상호작용하거나
DOM
에 로딩될 때 자동으로
GET
요청을 일으킨다. 그러므로
GET
요
청은
CSRF
를 통한 공격이 가장 쉽다.
우리는 앞의 예에서 하이퍼링크
<
a
></
a
>
태그를 사용해, 사용자가 자신의 브라우저에서
GET
요청을 실행하게 했다. 이미지를 가지고도 그와 같은 일을 할 수 있다.
<!--링크와 달리, 이미지는 DOM에 로딩될 때 HTTP GET 요청을 수행한다. 웹페이지를 로딩
하는 사용자는 아무런 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.