Lee-GyuHyeok

I study security and share my knowledge.

Recent posts

Vulnerable Activity Components

Vulnerable Activity Components์ด๋ž€? ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜ ๊ตฌ์„ฑ์š”์†Œ์ค‘ ๊ธฐ๋ณธ์ ์ธ ๊ตฌ์„ฑ ๋‹จ์œ„์ค‘ ํ•˜๋‚˜๋กœ, ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜๊ณผ ์‚ฌ์šฉ์ž๊ฐ„์˜ ์ƒํ˜ธ ์ž‘์šฉ์— ํ•„์š”ํ•œ ๊ธฐ๋Šฅ์„ ์ œ๊ณตํ•˜๋Š” ๊ฒƒ์„ ์•กํ‹ฐ๋น„ํ‹ฐ ๋ผ๊ณ  ํ•œ๋‹ค. ์ด๋Ÿฌํ•œ ์•กํ‹ฐ๋น„ํ‹ฐ๋Š” AndroidManfiest.xml ํŒŒ์ผ์— ํƒœ๊ทธ๋กœ ์„ ์–ธ...

Encoding Obfuscation

๐Ÿ’ก ํ•ด๋‹น ๋‹ค์–‘ํ•œ ์ธ์ฝ”๋”ฉ์„ ํ†ตํ•œ ๋‚œ๋…ํ™” ๊ธฐ๋ฒ•์€ portswigger์„ ์ƒ๋‹น๋ถ€๋ถ„ ์ฐธ๊ณ ํ•˜์˜€์Šต๋‹ˆ๋‹ค. ๋‹ค์–‘ํ•œ ์ทจ์•ฝ์ ์„ ์‹๋ณ„ํ•˜์—ฌ ํ•ด๋‹น ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ Exploit์„ ์ง„ํ–‰ ํ•  ๋•Œ Payload์—์„œ ๋ฌธ์ž์—ด ํ˜น์€ dot(.), / ๋“ฑ์ด ํ•„ํ„ฐ๋ง ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ๊ณ  ์ข…์ข… ๋‹ค์ˆ˜ ์กด์žฌํ•œ๋‹ค. ์ด ๋•Œ ...

Servcer Side Requests Forgery (SSRF)

SSRF ์ทจ์•ฝ์ ์ด๋ž€? SSRF๋Š” ํด๋ผ์ด์–ธํŠธ์ธก์˜ ์ž…๋ ฅ๊ฐ’์„ ์œ„์กฐ์‹œ์ผœ ์œ„์กฐ๋œ HTTP ์š”์ฒญ์„ ๋ณด๋‚ด, ์ผ๋ฐ˜์ ์œผ๋กœ ์™ธ๋ถ€์—์„œ ์ ‘๊ทผ์ด ๋ถˆ๊ฐ€๋Šฅํ•œ ์„œ๋ฒ„ ๋‚ด๋ถ€๋ง์— ์ ‘๊ทผ(Access) ํ•˜์—ฌ, ๋ฐ์ดํ„ฐ ์œ ์ถœ ๋ฐ ์„œ๋ฒ„์˜ ๊ธฐ๋ฐ€์„ฑ, ๊ฐ€์šฉ์„ฑ, ๋ฌด๊ฒฐ์„ฑ์„ ํŒŒ๊ดดํ•œ๋‹ค. SSRF ์˜ ๊ฒฝ์šฐ CSRF ๊ณต๊ฒฉ๊ณผ ์œ ์‚ฌํ•˜์ง€...

SMTP Injection(Email injection)

SMTP๋ž€ ๋ฌด์—‡์ผ๊นŒ? SMTP๋ž€ ๋‹จ์ˆœ ์ „์ž์šฐํŽธ ์ „์†ก ํ”„๋กœํ† ์ฝœ๋กœ์„œ ๋Œ€๋ถ€๋ถ„์˜ Email ์†Œํ”„ํŠธ์›จ์–ด ๋“ค์ด ์‚ฌ์šฉํ•˜๋Š” ํ”„๋กœํ† ์ฝœ์ด๋‹ค. ๋ณดํ†ต ์›น ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ ๋ฉ”์ผ์ „์†ก๊ณผ ๊ด€๋ จ๋œ ๊ธฐ๋Šฅ ๋ฐ API ๋Š” SMTP ํ”„๋กœํ† ์ฝœ์„ ํ†ตํ•ด ์ด๋ฃจ์–ด์ง„๋‹ค. SMTP ๋ฅผ ํ†ตํ•œ Injection?? ์›นํŽ˜์ด์ง€...

File Inclusion (LFI/RFI)

File Inclusion ์ทจ์•ฝ์ ์ด๋ž€? ํ•ด๋‹น ์ทจ์•ฝ์ ์€ ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ์—์„œ File์„ ๋ถˆ๋Ÿฌ ์˜ฌ ๋•Œ include๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์ฝ”๋“œ๋‚ด์— Built ํ•˜๊ฑฐ๋‚˜ ๋™์ ์œผ๋กœ ํŒŒ์ผ์„ ํฌํ•จํ•˜๋Š” ๋กœ์ง์ด ๊ตฌํ˜„๋˜์–ด์žˆ์„๊ฒฝ์šฐ ์ผ๋ฐ˜์ ์œผ๋กœ ๋‚˜ํƒ€๋‚˜๋ฉฐ, ๋‹ค๋ฅธ Path Traversal ๊ณผ ๊ฐ™์€ ํƒ€ ์ทจ์•ฝ์ €๋ฏˆ๊ณผ ์—ฐ...