February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
223
14
장
서비스 거부(DoS)
이는 악의적 정규 표현식을 해커가 사용해 상당한 역추적이 일어나기 전까지는 몇 년이고 웹
애플리케이션에 잠복해 있을 수 있음을 의미한다.
정규 표현식
DoS
공격은 생각보다 흔하며 적절한 페이로드를 찾는다면 쉽게 서버를 점검하거
나 클라이언트 머신을 무력화할 수 있다.
OSS
가 악의적 정규 표현식에 더 취약한 경우가 많은
점에 유의하자. 악의적 정규 표현식을 탐지할 만큼 실력이 있는 개발자는 많지 않기 때문이다.
14.2
논리
DoS
취약점
논리
DoS
logical
DoS
취약점이 발생하면 서버 리소스가 부정 사용자에게 낭비된다. 그 결과로 정
당한 사용자는 성능 저하를 겪거나 서비스를 받지 못한다 (그림
14
-
1
).
악의적 사용자가 계산 리소스를 많이 소모하는
API
를
반복적으로 요청한다.
정당한 사용자가 서비스를 요청하지만 서비스를
받지 못하거나 응답이 느리다.
그림
14-1
서버 리소스가 부정 사용자에게 낭비되어 정당한 사용자는 성능 저하나 서비스 중단을 겪는다.
정규 표현식은
DoS
취약점을 익스플로잇하는 쉬운 예다. 공격에 대한 조사와 시도를 할 수 있
는 출발점을 제공하기 때문이다(정규 표현식 파서가 있는 곳이라면 어디든지 가능하다 ). 하지
만
DoS
의 광범위한 본성으로
DoS
취약점은 모든 종류의 소프트웨어에서 찾을 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.