2015.09.09 / 13:05

ťƽ WVS V5 -2

autodev
õ 75

Acunetix WVS V5 Review

Jason Lee

2007 6 15

Ʈ ̾ ťƽ 並 ϰ ü ϵ

ϰڽϴ. ŷӰ 䰡 ΰ Ǿ ֵںе鿡 ˼մϴ. ֵ ּ ϰڽϴ.

HTTP ǻ(HTTP Fuzzer):

׸ 15. HTTP ǻ ȭ

HTTP ǻ(Fuzzer) (Sniffer) Ͽ ̿ ְ, ϴٰ Դϴ. ǻ ̵ ̰ ִµ, ǻ Ŵ ƴ ڵ ִٶ Դϴ. ǻ¡(Fuzzing) ۿ÷ο(Buffer Overflow) Ʈ (Brute Force) ˻縦 ϰ մϴ. ǰ ̿Ǿ μ, ش ǻ¡ پ û ϸ, ǻ¡ ִ پ ڿ ij ġ ֵ մϴ. ڵȭ ǻ¡ ѹ õ ̶, ̽ ȥ ֽϴ. ̴ ̾߱ Ǿ κ, ̷ Ŵ ڽ Ͽ ׽ , ̿ ֽϴ. ۰ Բ ֱ , ǻ ִ ֽϴ.

4

˻絵(Authentication Tester):

׸ 16. ˻絵 ȭ

˻絵 ȣߴ Դϴ. ź մϴ. Ʈ ˻ ʾƼ , װ ̿ܿ, ش ϱ ܼ ֽϴ. ˻絵 HTTP (˾ڽ ) HTML Է, ˻ ֽϴ.

HTTP ˻ , ش Ȯϰ մϴ. ̸ ϰ ȣ ׸ з ǵ ֽϴ. ɼ Ž ִ ǥ ִ Ʈ ˻縦 ֵ ϱ⿡ ߿ϴٰ ֽϴ.

HTML Է¾ ٸϴ. ťƽ ִ ҷ̰, ʵ尡 ̸ ȣ Ư ֽϴ. ü ۵ Ư ֽϴ. ̴ ڵ尡 ťƽ ˷ν ְ, Ե ڿ ˻Ͽ ťƽ Ͽ ֽϴ. , ش п ؼ Login Failed Ѵٸ, ťƽ ϴ ڿ Ǵ Խ ˷ ֽϴ. ̴ ü ޽ ̿ϴ û Ž ֽϴ.

ش ˻絵 ǰ Ǹϴ ֽϴ. ̰Ͱ Ҿ ãƺ , ̵ ϴ ɵ Դϴ. , , ް Ǿϴ.

3.5

񱳵(Compare Results):

׸ 17. 񱳵 ȭ

񱳵 Ǿ Ͱ ̰ ϴ. Ǽ ̸, ˰ ο Ͽ ۾ ̷, ̷ ٸ, ߴ Ȯ ֵ Ȥ ڰ Ȯ ִ մϴ.

̽ մϴ. ٸ ҷ̰, ̵ ؼ Ȥ ϰ , ׷ ǥ ִ ֽϴ.

Ư ɻ ϼ Ȥ پ ʱ⿡, ū ߽ϴ.

3

ij(Web Services Scanner):

׸ 18. ij ʱ ȭ

ijʴ ̿ ͳ ϱ ؼ ̿ ϰ ִ Ե Դϴ. Ϲ ø̼ ijʸ , ش ġ̾ AppScan̳ ̴̳ͽ WebInspectó 񽺿 ĵ ߰Ͽϴ.

񽺴 ٸ ͳݿ ӵ ý۰ ο ǿ ʿ伺 ǰ ֽϴ. ̿ ijʴ 񽺿 ڵȭ ϰ, ϴ ֽϴ.

ϰ Ǿ ֽϴ.

1. ij

2. ο

3. Ǿְų ÿ ϴ WSDL ϰ

4. ϱ ϴ , Ʈ Ÿ ޼ҵ带

5. ȿ ijʿ ̿ ִ Է (ɼ)

6.

7.

׸ 19. ij ۾ ȭ

׸ 19ó, Ʈ ؼ ݴϴ. Ʈ带 ȮϿ, ʿ м Ȯϱ ؼ Ȯ Ʈ ŬϿ, â ڼ Ȯ , ̿ ʰ Ȯϰ, ش ̷ ִ , ش ȯ û Ȯ ְ, ȣϱ Ȯ ֽϴ.

ϰ ϴ ijʴ ó Ե ӿ ұϰ پ ̿뼺 ־ϴ.

4

(Web Services Editor)

׸ 20. ȭ

Ǵ WSDL ۼ ֵ մϴ. ý Ͽ ϰ, ̸ SOAP Ŵ ֵ մϴ.

SOAP ޽ Ϲ HTTP Ϲ û ۾ մϴ.

׸ 21. WSDL ȭ

׸ 22. WSDL XML

׸ 23. ȭ

޸ ø̼ ˴ϴ. ˵ ŭ ˴ϴ. Ǿ ְ, , ߿ ʾҽϴ. ٸ ˵ ߿ ո ൿ ŭ Ϲ ó ϴ. HTML θ ־µ, ο ٸ (PDF, TXT, WORD, BMP) ϴ ϵ ֽϴ.

ƴ, AVDL(Application Vulnerability Description Language) XML ־, ٸ ΰ ۾ Էµ ͸ Ȯ ٸ ϴ. , ťƽ ͸ MS Access ͺ̽ ֽϴ. Ȥ ũμƮ ׼ ̿ ִٸ, ٸ · ֽϴ.

Ǵ ɵ ߰Ǿ ֽϴ. Ʒ Ǵ Դϴ.

1. ̸

2.

3. ø ̿

A.

B.

C.

4. ö̾()

A. HIPPA(The Health Insurance Portability and Accountability Act

B. OWASP TOP 10 2004

C. OWASP Top 10 2007

D. PCI(Payment Card Industry Data Security Standard)

E. Sarbanes-Oxley Act of 2002

F. WASC(Web Application Security Consortium) Threat Classification

5.

6.

̷ ø ̿ܿ, ̽ Ȯ ְ, ɼ ؼ, ԵǴ ΰ , ڰ ֵ Ǿ ֽϴ.

پ ø Ǿ Ŭ ִ Ǽ ϰ ֽϴ.

ȭ Դϴ.

׸ 24. Ϲ

׸ 25.

׸ 26.

׸ 27.

׸ 28. ö̾()

׸ 29.

׸ 30.

ťƽ WVS V5 ٸ ǰ Ͽ ջ ų ǰ κ ϴ. ʴ ڰ ִ ǰ ߰Ǿ ִ ־ϴ.

4.5

ǰ

پ , Ǽ ׸ óɷ ťƽ 4 ü ޾, ش پ ߰ ұϰ 3.6 Ϲ ǰ ް Ǿϴ.

:

l ü ۵ Ư

l ϳ ø̼ǿ յ Ǽ ϴ

l Ž

l ߿ з

l پ ø

l 񽺸 ̿

:

l ִ

l ӵ

l Է

l پ , ĶͿ

l ӿ ұϰ ̼

ťƽ ٲ ǰ Ȯ ִ ó ϴ. ̴ ش Ʈ Ϻϰ ã ֵ Ǵ پ ϳ ø̼μ ֵ ְ մϴ. ťƽ ̷ ǥ ޷ ̵ ϰ , ش ̷ ǥ ̷ ؼ ǰ ߿ ɿ ֵ ֱ⸦ ٶϴ.

ťƽ ش ̸ ٸ ǰ ص ʴ ǰ ɰ پ ϴ ǰ̶ ֵ ϰ ְ, ߿ ΰ ɰ ̿ Ǹ ϰ ֽϴ.

ؼ ڴ ťƽ ٶ ϴ ߽߰ϴ. ̽ ģ ̰, ̿ Կ ұϰ, ̽ պ ʿ䰡 ִ ϴ. Ư ǻ(fuzzer) ǥԴϴ. ˻絵 HTML Ʈ ϴ ̸ ȣ Ǿ־ϴ. ̴ ̵ ȣ 䱸Ǵ ڿ Ȥ Խǿ غ , ش Ʈ ã ϰ ϴ. ŸӾƿ ó ٲٴ ϰ Ǿ־, ʾ Ȯ ־, ȯ ִ ٲ ֱ⸦ ϰ ֽϴ. ̷ κ ӵ ̷ ϴ. ȯ ٸ Ǵ ũ depth ֵ Ͽ, ɼ ؼ ũ ߿ Ͱ ֵ Ǵٰ̾ ְ ̾ϴ. ̷ κ ѷ ߻ϴ ߰ ֽϴ.

ťƽ м ()̽ť ǰ ǸŸ ϰ ֽϴ. Jason Lee پ м м ϰ , ̾߱ پ ڵ ãư ȹԴϴ.

޿ 5 ׷̵尡 ťƽ, 1 ׷̵尡 ̷ϴ. ٸ 6 ֿ ׷̵带 ϴ Ϳ ؼ ƽ , 4 5 ׷̵ DZ ؼ 6̶ ؼ ߰ ٸ Ǵ 0.5 ׷̵带 ϴ Ͱ Ͽ ̰ Ƿ, ϴ ٷ Ŷ ϴ. ؼ, ɰ Ȯ ׸ ̷ ̶ ťƽ WVS 5. ο ٰ ˴ϴ.

ñϽ ôٸ, jaisonyi@hotmail.com ֽñ ٶϴ