SlideShare une entreprise Scribd logo
1  sur  92
0                  !!
#wasbook


WebApplicationSecurityStudy    #wassta
Who are you ?
• @tnantoka
•
• bornneet.com
• JavaScript
  • looseleaf
  • jsany
Node
#wasbook ?

• @ockeghem
•
•
•             …


                    http://zapanet.info/blog/item/2128
•   1    Web

•   2

•   3    Web
        HTTP

•   4    Web

•   5

•   6

•   7                Web

•   8    Web

•   9          Web
•   1    Web

•   2

•   3    Web
        HTTP

•   4    Web

•   5

•   6

•   7                Web

•   8    Web

•   9          Web
Let’s start!
※ #wasbook



 blog.bornneet.com
                     w
Index
• Chapter1
• Chapter2
• Chapter3
 • HTTP
 • Session
 • Same origin policy
• Appendix
Index
• Chapter1
• Chapter2
• Chapter3
 • HTTP
 • Session
 • Same origin policy
• Appendix
Chapter1




vulnerability
•
•“   ”
•
    • check & fix


•
    •
Index
• Chapter1
• Chapter2
• Chapter3
 • HTTP
 • Session
 • Same origin policy
• Appendix
Chapter2




Setup
for Windows
• #wasbook
for mac

• #wasbook            mac

 • http://blog.bornneet.com/Entry/306/

• @ockeghem          reply
VMware

• 30
•                   4000

• http://www.act2.com/products/fusion3.html
Local Proxy

• HTTP
  •
    •
•
  • tamper data
Index
• Chapter1
• Chapter2
• Chapter3
 • HTTP
 • Session
 • Same origin policy
• Appendix
Chapter3




Basis
HTTP
HTTP

client          server
HTTP

client                   server


          HTTP Request
HTTP

client                    server


          HTTP Request



          HTTP Response
HTTP Request
GET /index.html HTTP/1.1 rn

Host: www.bornneet.com rn
User-Agent: Mozilla/5.0 (Macintosh; ... Firefox/4.0 rn
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 rn
Accept-Language: ja,en-us;q=0.7,en;q=0.3 rn
Accept-Encoding: gzip, deflate rn
Accept-Charset: Shift_JIS,utf-8;q=0.7,*;q=0.7 rn
Keep-Alive: 115 rn
Connection: keep-alive rn
Cookie: ... rn

rn
HTTP Response
HTTP/1.1 200 OK rn

Date: Mon, 11 Apr 2011 14:03:03 GMT rn
Server: Apache rn
X-Powered-By: ModLayout/3.2.1 rn
Cache-Control: no-cache rn
Connection: close rn
Content-Type: text/html rn
Content-Encoding: gzip rn
Content-Length: 41 rn

rn

<html><body>Hello, wasbook!</body></html>
Status code

• 2XX:
• 3XX:
• 4XX:
• 5XX:
Headers
• UserAgent
• Content-Type
• Conetnt-Length
• Set-Cookie
• Cookie
• and more...
Version
• HTTP 1.0
 •
• HTTP 1.1
 • Host
 • keep-alive
 • Chunked
 • and more...
Method
• GET
 • QueryString
 •
 •             URI

 •
• POST
 • Body
 •
 •
 •
•
    • PUT
    • DELETE
• Request

•           …
• Request

•           …
REST vs SOAP
• REST
 •              URI

 •
 •   “Web       ”

• SOAP
 •       POST
Session
Stateless
client               server
Stateless
client     @tnantoka
                          server
           HTTP Request
Stateless
client     @tnantoka
                           server
           HTTP Request



             @tnantoka

           HTTP Response
client   server
client                  server
         HTTP Request
client                   server
         HTTP Request




         HTTP Response
Cookie
client            server
Cookie
client    @tnantoka
                         server
          HTTP Request
Cookie
client    @tnantoka
                         server
          HTTP Request


                              SessionID
                              123abc
                              @tnantoka
Cookie
client     @tnantoka
                              server
          HTTP Request


                                   SessionID
             @tnantoka             123abc

          HTTP Response            @tnantoka

         Set-Cookie: 123abc
client   server
client                    server
         HTTP Request
         Cookie: 123abc
client                    server
         HTTP Request
         Cookie: 123abc

                               SessionID
                                123abc...
                               @tnantoka!
client                    server
         HTTP Request
         Cookie: 123abc

                               SessionID
                                123abc...
            @tnantoka          @tnantoka!

         HTTP Response
ID
• ! && ! && !
 •
 •
 • Cookie
   • Secure, HttpOnly...
 •
• Basic
•
  • base64
•
• SSL
same origin policy
Sandbox
• browser
Same origin policy
• JavaScript
  • FQDN
  • Scheme
  • Port number
•
Cross-domain
• <script>
• <img>
• <frame>
• <form>
•
• src=”          ”
• http://hamachiya.com/junk/cj.html
•
•
• X-Frame-Options           meta
Appendix




TLS/SSL
SSL ? TLS ?
• SSL          by Netscape

•       →TLS

•
•
Layer5
         HTTP
                /


 HTTP

  SSL

  TCP

  IP
https://www.verisign.co.jp/repository/faq/SSL/https.html
Hybrid
•
    •
    •
•
    •
•
• CA
•
CA
CA
CA
CA
Hash
       CA
CA




Hash
       CA
CA




Hash
       CA
CA




Hash
       CA
CA




Hash
       CA
Hash
Hash




CA
Hash




     Decrypt



CA
Hash




     Decrypt



CA
Hash

               equal?


     Decrypt



CA
EV

•
•
•
    •
CA



    CA-1



(   CA-2)
2011/3

• CA

    • mail.google.com, login.skype.com...
•
•
• #wasbook
•

Contenu connexe

Tendances

Choosing A Proxy Server - Apachecon 2014
Choosing A Proxy Server - Apachecon 2014Choosing A Proxy Server - Apachecon 2014
Choosing A Proxy Server - Apachecon 2014
bryan_call
 
Масштабируя TLS / Артём Гавриченков (Qrator Labs)
Масштабируя TLS / Артём Гавриченков (Qrator Labs)Масштабируя TLS / Артём Гавриченков (Qrator Labs)
Масштабируя TLS / Артём Гавриченков (Qrator Labs)
Ontico
 
Interactive web. O rly?
Interactive web. O rly?Interactive web. O rly?
Interactive web. O rly?
timbc
 

Tendances (20)

Choosing A Proxy Server - Apachecon 2014
Choosing A Proxy Server - Apachecon 2014Choosing A Proxy Server - Apachecon 2014
Choosing A Proxy Server - Apachecon 2014
 
Developing cacheable PHP applications - Confoo 2018
Developing cacheable PHP applications - Confoo 2018Developing cacheable PHP applications - Confoo 2018
Developing cacheable PHP applications - Confoo 2018
 
Масштабируя TLS / Артём Гавриченков (Qrator Labs)
Масштабируя TLS / Артём Гавриченков (Qrator Labs)Масштабируя TLS / Артём Гавриченков (Qrator Labs)
Масштабируя TLS / Артём Гавриченков (Qrator Labs)
 
DNS over HTTPS
DNS over HTTPSDNS over HTTPS
DNS over HTTPS
 
Web performance across the HTTP to HTTPS transition
Web performance across the HTTP to HTTPS transitionWeb performance across the HTTP to HTTPS transition
Web performance across the HTTP to HTTPS transition
 
HTTPS, Here and Now
HTTPS, Here and NowHTTPS, Here and Now
HTTPS, Here and Now
 
Developing cacheable PHP applications - PHPLimburgBE 2018
Developing cacheable PHP applications - PHPLimburgBE 2018Developing cacheable PHP applications - PHPLimburgBE 2018
Developing cacheable PHP applications - PHPLimburgBE 2018
 
Just curl it!
Just curl it!Just curl it!
Just curl it!
 
Http3 fullstackfest-2019
Http3 fullstackfest-2019Http3 fullstackfest-2019
Http3 fullstackfest-2019
 
Rate Limiting with NGINX and NGINX Plus
Rate Limiting with NGINX and NGINX PlusRate Limiting with NGINX and NGINX Plus
Rate Limiting with NGINX and NGINX Plus
 
HTTPS: All you need to know
HTTPS: All you need to knowHTTPS: All you need to know
HTTPS: All you need to know
 
HTTP For the Good or the Bad
HTTP For the Good or the BadHTTP For the Good or the Bad
HTTP For the Good or the Bad
 
HTTP/3
HTTP/3HTTP/3
HTTP/3
 
Defeating The Network Security Infrastructure V1.0
Defeating The Network Security Infrastructure  V1.0Defeating The Network Security Infrastructure  V1.0
Defeating The Network Security Infrastructure V1.0
 
The HTML5 WebSocket API
The HTML5 WebSocket APIThe HTML5 WebSocket API
The HTML5 WebSocket API
 
Intro to WebSockets
Intro to WebSocketsIntro to WebSockets
Intro to WebSockets
 
Interactive web. O rly?
Interactive web. O rly?Interactive web. O rly?
Interactive web. O rly?
 
SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012
 
Apache httpd 2.4 Reverse Proxy
Apache httpd 2.4 Reverse ProxyApache httpd 2.4 Reverse Proxy
Apache httpd 2.4 Reverse Proxy
 
Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015Security and Privacy on the Web in 2015
Security and Privacy on the Web in 2015
 

Similaire à 第0回ワススタ!! #wasbookを読もう

Inside Of Mbga Open Platform
Inside Of Mbga Open PlatformInside Of Mbga Open Platform
Inside Of Mbga Open Platform
Hideo Kimura
 
Aditya - Hacking Client Side Insecurities - ClubHack2008
Aditya - Hacking Client Side Insecurities - ClubHack2008Aditya - Hacking Client Side Insecurities - ClubHack2008
Aditya - Hacking Client Side Insecurities - ClubHack2008
ClubHack
 
Debugging applications with network security tools
Debugging applications with network security toolsDebugging applications with network security tools
Debugging applications with network security tools
ConFoo
 
How the SSL/TLS protocol works (very briefly) How to use HTTPS
How the SSL/TLS protocol works  (very briefly) How to use HTTPSHow the SSL/TLS protocol works  (very briefly) How to use HTTPS
How the SSL/TLS protocol works (very briefly) How to use HTTPS
whj76337
 
第5回SCDN - Things that become possible with HTML5
第5回SCDN - Things that become possible with HTML5第5回SCDN - Things that become possible with HTML5
第5回SCDN - Things that become possible with HTML5
scdn
 

Similaire à 第0回ワススタ!! #wasbookを読もう (20)

Web前端性能优化 2014
Web前端性能优化 2014Web前端性能优化 2014
Web前端性能优化 2014
 
Inside Of Mbga Open Platform
Inside Of Mbga Open PlatformInside Of Mbga Open Platform
Inside Of Mbga Open Platform
 
Aditya - Hacking Client Side Insecurities - ClubHack2008
Aditya - Hacking Client Side Insecurities - ClubHack2008Aditya - Hacking Client Side Insecurities - ClubHack2008
Aditya - Hacking Client Side Insecurities - ClubHack2008
 
JUDCon 2013- JBoss Data Grid and WebSockets: Delivering Real Time Push at Scale
JUDCon 2013- JBoss Data Grid and WebSockets: Delivering Real Time Push at ScaleJUDCon 2013- JBoss Data Grid and WebSockets: Delivering Real Time Push at Scale
JUDCon 2013- JBoss Data Grid and WebSockets: Delivering Real Time Push at Scale
 
Http - All you need to know
Http - All you need to knowHttp - All you need to know
Http - All you need to know
 
Building real time applications with Symfony2
Building real time applications with Symfony2Building real time applications with Symfony2
Building real time applications with Symfony2
 
Token Authentication for Java Applications
Token Authentication for Java ApplicationsToken Authentication for Java Applications
Token Authentication for Java Applications
 
Caching the Uncacheable [Long Version]
Caching the Uncacheable [Long Version]Caching the Uncacheable [Long Version]
Caching the Uncacheable [Long Version]
 
Http2 in practice
Http2 in practiceHttp2 in practice
Http2 in practice
 
www.ppt
www.pptwww.ppt
www.ppt
 
Debugging applications with network security tools
Debugging applications with network security toolsDebugging applications with network security tools
Debugging applications with network security tools
 
Realtime Web Apps: WebSockets & WebRTC
 Realtime Web Apps: WebSockets & WebRTC  Realtime Web Apps: WebSockets & WebRTC
Realtime Web Apps: WebSockets & WebRTC
 
NullMQ @ PDX
NullMQ @ PDXNullMQ @ PDX
NullMQ @ PDX
 
KSDG LT: 6分鐘node.JS就上手
KSDG LT: 6分鐘node.JS就上手KSDG LT: 6分鐘node.JS就上手
KSDG LT: 6分鐘node.JS就上手
 
How the SSL/TLS protocol works (very briefly) How to use HTTPS
How the SSL/TLS protocol works  (very briefly) How to use HTTPSHow the SSL/TLS protocol works  (very briefly) How to use HTTPS
How the SSL/TLS protocol works (very briefly) How to use HTTPS
 
XMPP/Jingle(VoIP)/Perl Ocean 2012/03
XMPP/Jingle(VoIP)/Perl Ocean 2012/03XMPP/Jingle(VoIP)/Perl Ocean 2012/03
XMPP/Jingle(VoIP)/Perl Ocean 2012/03
 
Extending Your Applications to the Edge with CDNs
Extending Your Applications to the Edge with CDNsExtending Your Applications to the Edge with CDNs
Extending Your Applications to the Edge with CDNs
 
idsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 networkidsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 network
 
y3dips hacking priv8 network
y3dips hacking priv8 networky3dips hacking priv8 network
y3dips hacking priv8 network
 
第5回SCDN - Things that become possible with HTML5
第5回SCDN - Things that become possible with HTML5第5回SCDN - Things that become possible with HTML5
第5回SCDN - Things that become possible with HTML5
 

Dernier

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Dernier (20)

From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 

第0回ワススタ!! #wasbookを読もう

Notes de l'éditeur

  1. \n
  2. \n
  3. \n
  4. \n
  5. \n
  6. \n
  7. \n
  8. \n
  9. \n
  10. \n
  11. \n
  12. \n
  13. \n
  14. \n
  15. \n
  16. \n
  17. \n
  18. \n
  19. \n
  20. \n
  21. \n
  22. \n
  23. \n
  24. \n
  25. \n
  26. \n
  27. \n
  28. \n
  29. \n
  30. \n
  31. \n
  32. \n
  33. \n
  34. \n
  35. \n
  36. \n
  37. \n
  38. \n
  39. \n
  40. \n
  41. \n
  42. \n
  43. \n
  44. \n
  45. \n
  46. \n
  47. \n
  48. \n
  49. \n
  50. \n
  51. \n
  52. \n
  53. \n
  54. \n
  55. \n
  56. \n
  57. \n
  58. \n
  59. \n
  60. \n
  61. \n
  62. \n
  63. \n
  64. \n
  65. \n
  66. \n
  67. \n
  68. \n
  69. \n
  70. \n
  71. \n
  72. \n
  73. \n
  74. \n
  75. \n
  76. \n
  77. \n
  78. \n
  79. \n
  80. \n
  81. \n
  82. \n
  83. \n
  84. \n
  85. \n
  86. \n
  87. \n
  88. \n
  89. \n
  90. \n
  91. \n
  92. \n
  93. \n
  94. \n
  95. \n
  96. \n
  97. \n
  98. \n
  99. \n
  100. \n
  101. \n
  102. \n
  103. \n
  104. \n
  105. \n
  106. \n
  107. \n
  108. \n
  109. \n
  110. \n
  111. \n
  112. \n
  113. \n
  114. \n
  115. \n
  116. \n
  117. \n
  118. \n