February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
217
13
장
인젝션
13.4
마치며
인젝션 스타일 공격이 일반적인
SQL
인젝션 외의 여러 기술에도 적용됨을 살펴보았다.
인젝션 스타일 공격은
XXE
공격과 달리 특정한 약점이 있어서 당하는 것이 아니라 사용자 입
력을 지나치게 신뢰하기 때문에 발생한다. 버그 바운티 헌터 또는 침투 테스터라면 인젝션 스
타일 공격에 숙달하는 것이 큰 도움이 된다. 잘 알려진 데이터베이스는 방어 구성이 되어 있는
반면, 파서와
CLI
에 대한 인젝션 공격은 문서를 찾기 힘든 만큼 견고한 방어 메커니즘을 갖추
지 않았을 가능성이 높기 때문이다.
인젝션 공격은 클라이언트의
HTTP
요청을 파싱한 텍스트를 포함하는 서버 코드의 실행 결과
로 발생하므로 애플리케이션의 기능에 대한 이해가 필요하다. 이러한 공격은 강력하고 우아하
며 데이터 절취, 계정 탈취, 퍼미션 상승, 혼란 발생 등 여러 목표를 달성할 수 있다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.