2
3
4
5
6
7
8
9
: 10
( ) E-mail rdec@rdec.gov.tw 11
(PATCH) 12
( ) 13
cookie 14
1. 2. 3. 4. 15
cookie Cookie Netscape IE Internet cookie cookie cookie cookie 16
MS Internet Explorer 6.x-> -> 17
cookie cookie 1. cookie 2. 18
1. 2. 3. 19
(rdec@rdec.gov.tw) 20
BBB Online Privacy Program http://www.bbbonline.org/ Better Business Bureau ( ) BBBOnLine Truste http://www.truste.org/ 21
SOSA : 1. 2. 3. 4. 5. 6. 22
SOSA SOSA... SOSA SOSA SOSA SOSA SOSA 23
,,?,? Cookie? 24
25
SSL,,? 26
(Information Gathering Attacks) (Buffer Overflows) 27
?? (integrity) PKI (code signing) (Authentication):. : 28
29
(1) 30
(2) 31
32
Web Server www.nessus.org Nessus www.iss.net ISS www.intrusion.com Security Analyst iplanet http://developer.iplanet.com/tech/security/ Apache Tutorials: http://httpd.apache.org/docs/misc/tutorials.html Security Tips: http://httpd.apache.org/docs/misc/security_tips.html 33
IUSR_computername IIS (%Systemroot%\System32\LogFiles) W3C IP URI HTTP Win32 IP 34
ACL CGI (.exe.dll.cmd.pl) (X) ( ) ( ) (.asp) (X) ( ) ( ) Include (.inc.shtm.shtml) (X) ( ) ( ) (.txt.gif.jpg.html) (R) ( ) ( ) 35
ACL C:\Inetpub\Wwwroot\Myserver\Static (.html) C:\Inetpub\Wwwroot\Myserver\Include (.inc) C:\Inetpub\Wwwroot\Myserver\Script (.asp) C:\Inetpub\Wwwroot\Myserver\Executable (.dll) C:\Inetpub\Wwwroot\Myserver\Images (.gif,.jpeg) C:\Inetpub\Ftproot (FTP ) C:\Inetpub\Mailroot (SMTP ) 36
IIS 37
IISADMPWD 38
IIS \IISSamples C:\ Inetpub\Iissamples IIS \IISHelp C:\Winnt\Help\iishelp \MSADC C:\Program files\common files\system\msadc 39
Web.htr.idc Include.stm.shtm.shtml.printer.htw.ida.idq 40
41
1 2 3 4 5 6 7 http://www.securityfocus.com/bid https:// assandra.cerias.purdue.edu/main/index.html 42
1 2 3 4 5 6 (ACLs) IIS Log Logging IISADMPWD script mappings 43
1 2 3 4 (Comments) Meta tags HTTP Server Header (X-) (URLs) (authentication credentials) Java applets? robots.txt 44
1 2 3 4 ( SSL ) 45
1 2? 3 4 (anti-caching) 46
1 2 3 4 : PKI Enabled Form-Based: HTTP Basic Auth: 47
1 2 (,warning banner) 3 4 5 6 (credentials) 48
1 (Sign-off) 2 3 (anti-caching) (Session)? 49
1 2 Form post encryption (SSL frames ) 50
1 2 form element -- permutation list -- verbose HTTP -- permutation list 51