February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
203
13
장
인젝션
인젝션
CHAPTER
13
웹 애플리케이션에 대한 공격 중 가장 일반적인 유형은
SQL
인젝션
이다.
SQL
인젝션은
SQL
데이터베이스를 타깃으로 삼는 인젝션 공격으로 악의적 사용자가 기존
SQL
질의에 매개변수
를 삽입하거나 기존 질의를 다른 것으로 대체하기도 한다. 이는
SQL
인터프리터에 기본적으로
주어지는 권한이 상승된 결과로 데이터베이스가 침해되는 결과를 일으킨다.
SQL
인젝션이 가장 흔하지만 그 외에 다른 형태의 인젝션도 있다. 인터프리터와 그 인터프리
터에서 읽어들일 페이로드가 있다면 인젝션 공격이 성립한다. 데이터베이스 (전통적인
SQL
인
젝션 )뿐 아니라
FFMPEG
(비디오 압축기 ) 같은 명령 줄 유틸리티
command
-
line
interface
(
CLI
)에 대
해서도 인젝션 공격을 할 수 있다는 뜻이다.
인젝션 공격의 여러 형태를 살펴봄으로써 이러한 공격을 수행하는 데 필요한 애플리케이션 아
키텍처를 이해하고 취약한
API
에 대한 페이로드를 어떻게 형성해 전달할 수 있는지 알아보자.
13.1
SQL
인젝션
인젝션 유형 중 가장 흔한 것은
SQL
인젝션이다 (그림
13
-
1
).
HTTP
페이로드에서
SQL
문
자열이 이스케이프
1
되어 최종 사용자를 대신해 커스텀
SQL
질의가 실행된다.
1
옮긴이_ 여기서 이스케이프 (
escape ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.