常見 Web 系統攻擊及防範

常見 Web 攻擊及防範
主講人｜Rainmaker
日期｜2021/04/23
www.gss.com.tw

2
Introduction
何金鎮 Rainmaker Ho
現職經歷專長證照
叡揚資訊經理 • Microsoft MVP Reconnect
• Microsoft C# MVP
（2012 ~ 2016）
• .NET
• Node JS
• MS SQL
• Azure Developer Associate
• Azure Administrator Associate
• Azure Database Administrator
Associate
• MCSD: App Builder

3
Agenda
大綱 ❯ SQL Injection
❯ Cross-site Scripting (XSS)
❯Cross Site Request Forgery (CSRF)
❯ Broken Access Control
❯ Insecure Deserialization

問題
❯ 想要買 Mac Pro ，但是 $$ 不夠
❯ … 找漏洞，改價格 ?
❯ http://localhost:44375/Product/Detail?ProductID=13&orderBy=UserID
❯ http://localhost:44375/Product/Detail?ProductID=13&orderBy=UserIa
❯ http://localhost:44375/Product/Detail?ProductID=13&orderBy=UserID,1
❯ http://localhost:44375/Product/Detail?ProductID=13&orderBy=UserID,a
5

SQL Injection 手法 – WaitFor Delay ‘時:分:秒’
6

SQL Injection 手法 – 依序取得一筆資料
❯ 翻轉吧! 資料
7

SQL Injection 手法 – 讓 SQL 發生錯誤
8

Understanding SQL injection
9
http://www.mysite.com/product?id=1
SELECT * FROM Product WHERE Id = 1
可信任
不可信任

問題是?
❯ 不信任的地方
10
/product?id=1 or 1=1
SELECT * FROM Product WHERE
Id = 1 or 1=1

Types of SQL injection attack
❯ Explicit
❯ Union-based: append a result set that’s render to the markup
❯ Error-base: disclose information in an unhandled exception
❯ Implicit(blind)
❯ Boolean-base: test if a particular condition is true
❯ Time-base: cause the response to be delayed in response to a
test
11

利用漏洞，改價格
;WaitFor Delay '00:00:05’;--
,case when (SELECT Top 1 substring(A2.name, 1, 1) From
( SELECT Top 1 A1.name FROM sys.tables A1 Order By A1.name )
A2 Order By A2.name Desc) = 'a' then 1 else convert(int, 'x') end;
12

取得 Email 帳號
❯ SQL Injection
13

修正 SQL Injection - Parameter
14

修正 SQL Injection - LINQ
15

Reflected XSS
16
1234
http://web.site/vulnerable.asp?arg=1234
<html><body>1234</body></html>
1234
http://web.site/vulnerable.asp?arg=<script>...</script>
<html><body><script>…</script></body></html>

stored
Stored XSS
17
<script>
...
</script>
Usernam
e
Note Time
john hello …
allen
<script>
…
</script>
…
bill … …
hello
Submit
Post
<script>…</script>
Attack

Encoder
Encoding Method Example/Pattern
HtmlEncode <a href="http://www.contoso.com">Click Here [Untrusted input]</a>
HtmlAttributeEncode <hr noshade size=[Untrusted input]>
JavaScriptEncode
<script type="text/javascript"> …
[Untrusted input]
…
</script>
UrlEncode <a href="http://search.msn.com/results.aspx?q=[Untrusted-input]">Click Here!</a>
VisualBasicScriptEncode
<script type="text/vbscript" language="vbscript"> …
[Untrusted input]
…
</script>
XmlEncode <xml_tag>[Untrusted input]</xml_tag>
XmlAttributeEncode <xml_tag attribute=[Untrusted input]>Some Text</xml_tag>
18
https://docs.microsoft.com/en-us/previous-versions/dotnet/articles/aa973813(v=msdn.10)?redirectedfrom=MSDN

提供免費 Wi-Fi ，使用中間人攻擊，Key Logger
19
偷聽，竄改

Cross Site Request Forgery(跨站請求偽造)
20

Direct Obj-Ref: Upload File
23
upload
Select a file to upload
D:Documentsabc.txt
http://web.site/upload/abc.txt
upload
Select a file to upload
D:Malwareevil.exe
http://web.site/upload/evil.exe

攻擊練習 – 新增產品
24

攻擊練習 – 新增產品
25

攻擊練習 – 新增/修改產品
26

序列化及反序列化
27
Object
序列化
Stream
Of
Bytes
File
Data
Base
Remote Web
Application
Server
反序列化
Stream
Of
Bytes
Object

這 MyStore 是 Open Source
28

多段攻擊
❯ 上傳 KeyLogger.exe
❯ 執行 KeyLogger.exe
❯ 下載 KeyLogger.log
31

感謝聆聽
www.gss.com.tw
Vital 雲端服務家族
GSS 叡揚資訊
國家產業創新獎
卓越中堅企業獎
股票代號｜6752

常見 Web 系統攻擊及防範

Recommended

Recommended

More Related Content

What's hot

What's hot (9)

Similar to 常見 Web 系統攻擊及防範

Similar to 常見 Web 系統攻擊及防範 (20)

More from Rainmaker Ho

More from Rainmaker Ho (9)

常見 Web 系統攻擊及防範

Editor's Notes