Lee-GyuHyeok

I study security and share my knowledge.

Recent posts

(bWAPP)Broken Auth. - Password Attacks

Level - Low ๋กœ๊ทธ์ธ ๊ธฐ๋Šฅ์ด ๊ตฌํ˜„๋˜์–ด ์žˆ์œผ๋ฉฐ, ํ•ด๋‹น ์‹œ๋‚˜๋ฆฌ์˜ค๋Š” ๋ถ€๋ฅดํŠธํฌ์Šค ๋ฐ ์‚ฌ์ „๋Œ€์ž…๊ณต๊ฒฉ์„ ์‚ฌ์šฉํ•˜๋Š” ์‹œ๋‚˜๋ฆฌ์˜ค์ธ๋“ฏ ํ•จ ๋กœ๊ทธ์ธ ์‹คํŒจ์‹œ ์œ„ ๊ทธ๋ฆผ1-2์™€ ๊ฐ™์€ ๋ฌธ์ž๊ฐ€ ์ถœ๋ ฅ๋จ ๋กœ๊ทธ์ธ ์‹œ์ ์—์„œ Intercept ๋ฅผ ํ†ตํ•ด ํŒจํ‚ท์„ ์žก์€ ํ›„ Intruder...

(bWAPP)Broken Auth. - Logout Management

Level - Low ๊ฐ„๋‹จํ•œ ๋กœ๊ทธ์•„์›ƒ ๊ธฐ๋Šฅ์ด ๊ตฌํ˜„๋˜์–ด ์žˆ์Œ ํ•ด๋‹น ์‹œ๋‚˜๋ฆฌ์˜ค์˜ ๊ฒฝ์šฐ โ€œ๋’ค๋กœ๊ฐ€๊ธฐโ€ ๊ธฐ๋Šฅ์„ ํ†ตํ•ด ์ด์ „ ์‚ฌ์šฉ์ž์˜ ์„ธ์…˜์„ ๊ฐ€์ง€๊ณ  ๋‹ค์‹œ๊ธˆ ๋กœ๊ทธ์ธ ์ƒํƒœ๋กœ ๋Œ์•„๊ฐˆ ์ˆ˜ ์žˆ์Œ. ์„ฑ๊ณต์ ์œผ๋กœ ๋กœ๊ทธ ์•„์›ƒ๋˜์–ด BWAPP ์ดˆ๊ธฐ ํ™”๋ฉด์œผ๋กœ ๋Œ์•„์™”๋‹ค. โ€œ๋’ค๋กœ๊ฐ€๊ธฐโ€...

(bWAPP)Session Mgmt. - Cookies (Secure)

Level - Low ์ด์ „ ๋ฌธ์ œ์˜ Http Only ์™€ ๋ฌธ์ œ ์ž์ฒด๋Š” ๋™์ผํ•˜์ง€๋งŒ, Http Only ํ—ค๋”๊ฐ€ ์•„๋‹Œ Secure ํ—ค๋”์— ๋Œ€ํ•œ ํ•™์Šต์„ ์œ„ํ•œ ๋ฌธ์ œ์ด๋‹ค. Secure ํ—ค๋”๋ž€ SSL/TLS ์„ ์‚ฌ์šฉํ•œ HTTPS ํ”„๋กœํ† ์ฝœ์„ ํ†ตํ•ด ์ „์†ก๋˜๋Š” ์‘๋‹ต์—๋งŒ ์ฟ ํ‚ค๋ฅผ ํฌํ•จ...

(bWAPP)Session Mgmt. - Cookies (HTTPOnly)

Level - Low Cookies ๋ฒ„ํŠผ์„ ํด๋ฆญ์‹œ ์•„๋ž˜ ํ‘œ์— ์ฟ ํ‚ค ๊ฐ’์ด ์ถœ๋ ฅ ๋˜๋ฉฐ, here ๋ฒ„ํŠผ ํด๋ฆญ์‹œ alert ์ฐฝ์„ ํ†ตํ•ด ์ฟ ํ‚ค ๊ฐ’์ด ์ถœ๋ ฅ ๋œ๋‹ค. ์„ธ์…˜ ๊ฐ’๊ณผ ๊ฐ๊ฐ์˜ ์ฟ ํ‚ค๊ฐ’์„ ๋ณด์—ฌ์ค€๋‹ค. ํ•ด๋‹น ์‹œ๋‚˜๋ฆฌ์˜ค๋Š” ์„ธ์…˜๊ฐ’์„ ํƒˆ์ทจํ•˜๋Š” ์‹œ๋‚˜๋ฆฌ์˜ค๋กœ ์˜ˆ์ƒ๋˜๋ฉฐ, tes...

(bWAPP)Broken Auth. - Insecure Login Forms

Level - Low ๋กœ๊ทธ์ธ ๊ธฐ๋Šฅ์ด ๊ตฌํ˜„๋˜์–ด ์žˆ์Œ ํ•ด๋‹น ์‹œ๋‚˜๋ฆฌ์˜ค์˜ ๊ฒฝ์šฐ DB๊ฐ€ ๊ตฌ์„ฑ๋˜์–ด ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜, ์›น ํŽ˜์ด์ง€ ์†Œ์Šค์ƒ์— ๋กœ๊ทธ์ธ ์ •๋ณด๊ฐ€ ๊ณ ์Šค๋ž€ํžˆ ํ•˜๋“œ์ฝ”๋”ฉ ๋˜์–ด์žˆ๋Š” ๊ฒฝ์šฐ๋ฅผ ๋‚˜ํƒ€๋ƒ„ ๊ฐœ๋ฐœ์ž์˜ ์‹ค์ˆ˜๋ฅผ ํ†ตํ•ด ์ผ์–ด๋‚  ์ˆ˜ ์žˆ์Œ ํ•ด๋‹น ๋ถ€๋ถ„์„ ๋งˆ์šฐ์Šค๋ฅผ ํ†ตํ•ด ๋“œ๋ž˜๊ทธํ•˜๊ฑฐ๋‚˜ ...