Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの夕べ20161124_公開用.pdf
Search
FUJISAKI Masanori
November 24, 2016
Programming
0
120
セキュリティの夕べ20161124_公開用.pdf
「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。
https://walti.io
#さくらの夕べ
FUJISAKI Masanori
November 24, 2016
Tweet
Share
More Decks by FUJISAKI Masanori
See All by FUJISAKI Masanori
プロポーザル・アンチパターン
fujisaki_hb
12
3.5k
Site Reliability Engineeringとは。
fujisaki_hb
1
350
Other Decks in Programming
See All in Programming
watsonx.ai Dojo #2 生成AIを使ったアプリ開発入門編
oniak3ibm
PRO
0
220
私のEbitengineの第一歩
qt_luigi
0
450
Developer Joy == Developer Productivity (really!)
hollycummins
1
220
Ruby Parser progress report 2024
yui_knk
2
230
Desafios e Lições Aprendidas na Migração de Monólitos para Microsserviços em Java
jessilyneh
2
150
状態管理ライブラリZustandの導入から運用まで
k1tikurisu
3
470
Shinjuku.rb#95:心の技術書紹介
free_world21
1
110
LangGraphでのHuman-in-the-Loopの実装
os1ma
3
1.1k
Using Livebook to build and deploy internal tools @ ElixirConf 2024
hugobarauna
0
250
GraphQL あるいは React における自律的なデータ取得について
quramy
11
3k
What you can do with Ruby on WebAssembly
kateinoigakukun
0
170
Some more adventure of Happy Eyeballs
coe401_
2
190
Featured
See All Featured
How to Ace a Technical Interview
jacobian
274
23k
Practical Orchestrator
shlominoach
185
10k
How to name files
jennybc
75
98k
Imperfection Machines: The Place of Print at Facebook
scottboms
263
13k
Fontdeck: Realign not Redesign
paulrobertlloyd
80
5.1k
Rails Girls Zürich Keynote
gr2m
93
13k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
38
9.2k
Pencils Down: Stop Designing & Start Developing
hursman
119
11k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
663
120k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
123
18k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
36
2.1k
Mobile First: as difficult as doing things right
swwweet
221
8.8k
Transcript
8BMUJJPΛͬͯ ̋̋ͷηΩϡϦςΟஅ ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ
2016/11/24 © Walti, Inc. ࣗݾհ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ
දऔక גࣜձࣾΥϧςΟ දऔక ຊ.41ڠձ ཧࣄ • ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ݄ʹגࣜձࣾΥϧςΟΛઃཱ • ݄ʹຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢ΔΒɺຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛۙʹ ͢Δ׆ಈʯΛΥϧςΟͰ࣮ࢪதɻۀքஂମͰ .41ͷೝ্ʹΊΔɻ
2016/11/24 © Walti, Inc. ͯ͞
2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό
2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ ͲΕͰ͠ΐ͏ʁ ͘͞Βͷ౦ژΦϑΟε ͘͞ΒͷφϨοδ
ాத͞Μͷݸਓαʔό ਖ਼ղ˒
ηΩϡϦςΟͷ༦ גࣜձࣾΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ຊ.41ڠձ 8BMUJJPΛͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟஅ ͬͨͬͨʔʂ
2016/11/24 © Walti, Inc. ͡Ίʹ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ
͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.
ࣗ৴Λͬͯճ͢Δʹ ঢ়گΛѲ͍ͯ͠Δ͜ͱ͕େ ʢͰ༧ࢉͳ͍͜ͱଟ͍…ʣ
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭडֹ(¥9,788,100)ͷ 2ഒҎ্…
ଛഛঈͷྫʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛഛঈʹͭͳ͕Δ͜ͱɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$ྫθϛ ଛഛঈٻࣄ݅
౦ژํࡋॴܾฏ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭडֹ(¥9,788,100)ͷ 10ഒҎ্…
ʮใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ใॲཧਪਐػߏ ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM
ࣄۀΛܧଓʹ αʔόʔॏཁɻ
2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊͰ͢
2016/11/24 © Walti, Inc. ΈΜͳେ͖ ͘͞ΒͷφϨοδʂ
͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
؆୯ͳߏ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͪ͜Β ͘͞Β͞Μʹ ͓·͔ͤ
͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTTཧ͘͞Β͞
ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4ͷηΩϡϦςΟཧ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ
ϑΝΠΞΥʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ
wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙରԠ044εΩϟφΛՃ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹొͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯରʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
2016/11/24 © Walti, Inc. ·ͣ εΩϟϯ͠·͢
IUUQTXBMUJJPΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧϯτ࡞
ΞΧϯτొ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕
৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc.
ؔऀΛొ͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گѲ͢Δ͜ͱ͕ ରԠͷ༏ઌΛܾΊΔ্Ͱେ
࣍ʹ8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc.
8BMUJJPʹλʔήοτొ͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ
λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.
ॴ༗ऀ֬ೝྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ'SFFεΩϟϯ શແྉͰ͢ʂ
2016/11/24 © Walti, Inc. εΩϟϯத…
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.
εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚ͲɺޡݕɾରԠෆཁ ͋ΔͷͰ൵؍ෆཁ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ nikto
YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ QIQJOJͰ FYQPTF@QIQΛ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯάࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
ରԠ͠ͳ͚ΕͳΒͳ͍ͷ 2016/11/24 © Walti, Inc. छผ ߲ ରԠཁ൱ ରԠྫ wpscan
XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ SFBENFϑΝΠϧΛ আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT Λ༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
2016/11/24 © Walti, Inc. ରԠத… by
2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ରԠ༰
2016/11/24 © Walti, Inc. ࠶εΩϟϯத…
࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ
ରԠ࣌ؒ 2016/11/24 © Walti, Inc.
ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ
I ࡞ۀલόοΫΞοϓɺ εςʔδϯάڥ࡞ۀͳͲ ͍ΕΔͱͯ͢ͰEBZ I
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc.
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠάάΕ͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ
• ߲͑͞ग़ͯ͘Ε ΄΅͔͔࣌ؒΒͳ͍ • ࣗͷڥͩͬͨΒ ͔͔Βͳ͍ʂ
ରԠޙͷײͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ8BMUJJPͰɺ ରࡦαΫοͱάάͬͯͬͯ͠·͏ • εςʔδϯάڥΛৗʹ4ZOD͓ͯ͠
͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝
͞Βʹ 2016/11/24 © Walti, Inc.
8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ
2016/11/24 © Walti, Inc. কདྷʹ͚ͨ४උ
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.
εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTTແྉͳͷͰɺ ि̍ͷνΣοΫΛొͯ͠ ແྉʂ
2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ
·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛѲ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟཧΛߦ͍ͬͯ͜͏ʂ
ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ8BMUJJP͕͑ΔΑʂ 2016/11/24 © Walti, Inc.
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷཧਓ http://knowledge.sakura.ad.jp/ unimal
Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.