February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
195
12
장
XML 외부 엔티티(XXE)
XML
외부 엔티티(
XXE
)
CHAPTER
12
XML
외부 엔티티
(
XXE
) 공격은 실행하기는 매우 쉽지만 그 피해는 막심하다. 이 공격은 애플
리케이션 코드의 잘못 구성된
XML
파서에 의존한다.
일반적으로
XXE
공격 취약점은 거의 모두가
XML
(또는 유사
XML
) 페이로드를 수용하는
API
엔드포인트로 발견된다.
HTTP
엔드포인트에서
XML
을 수용하는 것이 일반적이지 않다
고 생각할 수 있겠지만 유사
XML
형식은 스케일러블 벡터 그래픽스
Scalable
Vector
Graphics
(
SVG
),
HTML
/
DOM
,
PDF
(
XFDF
),
RTF
를 아우른다. 유사
XML
형식은
XML
명세와 공통점이 많
아 많은
XML
파서에서 입력으로 받을 수 있다.
XXE
공격은
XML
명세에서 외부 파일을 임포트하는 특수한 표기에 착안한 것이다. 이러한 특
수한 지시자를
외부 엔티티
라 하는데 이것은
XML
파일을 평가하는 머신에서 해석된다. 그러므
로 서버의
XML
파서에 특별한
XML
페이로드를 보냄으로써 서버의 파일 구조에 속한 파일을
침범할 수 있게 된다.
XXE
를 통해 다른 사용자의 파일이라든지 유닉스 기반 서버가 올바로 작동하는 데 필수적인
/
etc
/
shadow
같은 중요 자격 증명을 저장하는 파일에 액세스하기도 한다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.