February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
191
11
장
사이트 간 요청 위조(CSRF)
11.3
POST
엔드포인트에 대한
CSRF
보통
CSRF
공격은
GET
엔드포인트를 공략한다. 하이퍼링크, 이미지,
HTML
태그를 통해
HTTP
GET
요청을 자동으로 시작하는
CSRF
를 배포하기 쉽기 때문이다.
하지만
POST
,
PUT
,
DELETE
엔드포인트를 대상으로
CSRF
페이로드를 전달하는 것도 가
능하다.
POST
페이로드를 전달하는 데에는 사용자 상호작용 등의 작업이 더 필요하다 (그림
11
-
3
).
사용자
1
은 악의적 웹 폼을 자신의 웹사이트에
생성한다.
사용자
1
은 이메일을 통해
이 웹 폼을 배포한다.
사용자
2
는 악의적 링크를 클릭해
폼을 작성하고 제출한다.
다른 서버에 사용자
2
를 대신해
HTTP
POST
요청이 이뤄진다.
서버는 사용자
2
의
HTTP
POST
를 처리한다.
사용자
2
만 액세스할 수 있는 내부 네트워크라
하더라도 서버 상태가 변경된다.
그림
11-3
CSRF
POST
에서는 폼의 작성자는 액세스할 수 없고 제출자는 액세스할 수 있는 서버를 대상으로 폼이 제
출된다.
POST
요청을 통한
CSRF
공격은 대체로 브라우저 폼을 통해 이뤄진다. 스크립트 없이
POST
요청을 일으킬 수 있는 몇 안 되는
HTML
객체 중
<
form
></
form
>
객체가 있기 때문이다.
<form action="https://www.mega-bank.com/transfer" ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.