yapc8oji: セキュリティテストサービスを開発運営してきた2年
TRANSCRIPT
Copyright (c) Bitforest Co., Ltd.
2
@vaddynet
2016/7/3 YAPC::ASIA HACHIOJI
#yapc8ojiC
Copyright (c) Bitforest Co., Ltd.
• 市川 @cakephper
• VAddyプロダクトマネージャ、開発者
• PHPカンファレンス福岡、Fukuoka.php
• http://blog.ichikaway.com
Copyright (c) Bitforest Co., Ltd.
•
•
• VAddy
• VAddy
Copyright (c) Bitforest Co., Ltd.
Web
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
• Web•
•
• VAddy, OWASP ZAP, BurpSuite• OS•
Copyright (c) Bitforest Co., Ltd.
•http://example.com/show?id=1&name=foo•id=1’&name=foo•id=abs(“1”)&name=foo•id=1&name=foo’•id=1&name=abs(“1”)
Copyright (c) Bitforest Co., Ltd.
•POST http://example.com/edit•id=1’&name=foo•{id=‘abs(“1”)’ , name=‘foo’} //JSON
Copyright (c) Bitforest Co., Ltd.
•••
•CSRF
VAddy
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
•
• http://blog.sei.cmu.edu/post.cfm/security-continuous-integration-338
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
•
•CI••
•
•Web
Copyright (c) Bitforest Co., Ltd.
•
•DevSecOps•••
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
2014Web
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
CI
Copyright (c) Bitforest Co., Ltd.
Vulnerability Assessment is your Buddy
Copyright (c) Bitforest Co., Ltd.
• Web• (SaaS)•CI WebAPI•
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
VAddy
Copyright (c) Bitforest Co., Ltd.
DEMO
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
main.php name2 XSS
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
htmlXSS
Copyright (c) Bitforest Co., Ltd.
2
Copyright (c) Bitforest Co., Ltd.
•2014 1 •2014 10 •2015 4 •2015 10 • 3
Copyright (c) Bitforest Co., Ltd.
• ($0)• ($100/ )• ($300/ )
Copyright (c) Bitforest Co., Ltd.
• ($0)• 1 5 )•CI
VAddy CI
Copyright (c) Bitforest Co., Ltd.
•SQL•XSS•••
Copyright (c) Bitforest Co., Ltd.
•
• :)• by @hsmt
Copyright (c) Bitforest Co., Ltd.
•••
•
•UTF8, UTC
Copyright (c) Bitforest Co., Ltd.
•
• URL Reddit, hackernews•
•stackshare•devopsbookmark.com
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
•VAddy•VAddy
OK••
••
http://blog-ja.vaddy.net/post/114552491146/vaddy-stance
Copyright (c) Bitforest Co., Ltd.
Copyright (c) Bitforest Co., Ltd.
• :(•••
http://blog-ja.vaddy.net/post/114552491146/vaddy-stance
Copyright (c) Bitforest Co., Ltd.
• Web••
http://blog-ja.vaddy.net/post/114552491146/vaddy-stance
Copyright (c) Bitforest Co., Ltd.
•
•99 Designs•Intercom•Sendgrid
•VAddy VAddy•
Copyright (c) Bitforest Co., Ltd.
•••
Copyright (c) Bitforest Co., Ltd.
••
• vs •
Copyright (c) Bitforest Co., Ltd.
@cakephper
••
•SaaS
#yapc8ojiC