February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
200
2
부
공격
12.2
간접
XXE
간접
XXE
에서 서버는 요청 형태에 따라
XML
객체를 생성한다. 사용자가 제공한 매개변수를
포함하는
XML
객체로 외부 엔티티 태그를 포함할 가능성이 있다 (그림
12
-
2
).
사용자
1
은 외부 엔티티를 포함하는
페이로드를 서버에 매개변수로 보낸다.
XML
파서는
XML
을 파싱한다.
서버는
XML
파일을 생성하고 사용자
매개변수는
XML
에 통합한다.
외부 엔티티 플래그가 처리되며
서버의 파일이 파싱 결과에 반영된다.
서버의 로컬 파일이 요청 결과와 함께
사용자
1
에게 반환된다.
그림
12-2
간접
XXE
사용자가 제출한
XML
객체를 직접 다루지 않는 엔드포인트에도
XXE
공격을 할 수 있는 경우
가 있다.
유사
XML
객체를 매개변수로 받는
API
를 접하면
XXE
공격 페이로드를 통해 외부 엔티티를
참조해보는 것이 당연하다. 하지만
API
가 페이로드의
XML
객체를 받아들이지 않는다고 해서
그
API
가
XML
파서를 사용하지 않는다고 볼 수는 없다.
다음 사례를 생각해보자. 개발자가
REST
API
엔드포인트를 통해 단 한 개의 매개변수를 요청
하는 애플리케이션을 작성한다고 하자. 이 애플리케이션은 매개변수를 회사에서 사용하는 엔
터프라이즈급
CRM
소프트웨어 패키지와 동기화하게 설계됐다.
CRM
소프트웨어의
API
는
XML ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.