現場で使える脆弱性検査サービス vaddy
TRANSCRIPT
Copyright (c) Bitforest Co., Ltd.
VAddy
1
#vaddy
Copyright (c) Bitforest Co., Ltd.2
• VAddy•
• VAddy
• PrivateNet VAddy
Copyright (c) Bitforest Co., Ltd.3
• VAddy
• Web•
•
Copyright (c) Bitforest Co., Ltd.4
• 2002
• ( ),
• Web ( )
• Scutum(WAF) 2009
• VAddy 2014
Copyright (c) Bitforest Co., Ltd.5
Copyright (c) Bitforest Co., Ltd.
•
•
•
•
6
Copyright (c) Bitforest Co., Ltd.7
Copyright (c) Bitforest Co., Ltd.8
Web
Vulnerability Assessment is your Buddy
Copyright (c) Bitforest Co., Ltd.9
Copyright (c) Bitforest Co., Ltd.
• as a Service
• SQLi, XSS, etc• Web
• WebAPI CI
10
Copyright (c) Bitforest Co., Ltd.
• http://example.com/show?id=1&name=foo• id=1’&name=foo• id=abs(“1”)&name=foo• id=1&name=foo’• id=1&name=abs(“1”)
11
POST PUT DELETE JSON
Copyright (c) Bitforest Co., Ltd.12
Copyright (c) Bitforest Co., Ltd.
VAddy
13
Copyright (c) Bitforest Co., Ltd.
VAddy
14
Copyright (c) Bitforest Co., Ltd.15
Copyright (c) Bitforest Co., Ltd.16
Copyright (c) Bitforest Co., Ltd.17
SQL
XSS
Copyright (c) Bitforest Co., Ltd.
• STEP1
• STEP2
• STEP3 / WebAPI)
18
Copyright (c) Bitforest Co., Ltd.19
Copyright (c) Bitforest Co., Ltd.20
(URL
ProxyVAddy Proxy
Web
Copyright (c) Bitforest Co., Ltd.
•
•
•
21
Copyright (c) Bitforest Co., Ltd.22
DEMO
Copyright (c) Bitforest Co., Ltd.23
PrivateNet
VAddy
Copyright (c) Bitforest Co., Ltd.24
OK NG
Copyright (c) Bitforest Co., Ltd.
•
•
•
• VM Vagrant Docker
• CI as a Service
25
Copyright (c) Bitforest Co., Ltd.26
ssh pfd.vaddy.net:22 (outbound)
WebPort 443
Copyright (c) Bitforest Co., Ltd.27
SSHLocal: 443Remote: 3210
Scan
WebPort 443
Sca
n
Copyright (c) Bitforest Co., Ltd.28
SSHLocal: 192.168.1.18: 8888Remote: 3210
Scan
Scan
Copyright (c) Bitforest Co., Ltd.
• PrivateNet
• WebAPI
•
•
• / WebAPI)
29
Copyright (c) Bitforest Co., Ltd.30
DEMO
Copyright (c) Bitforest Co., Ltd.
•
• Starter $60, Pro $190 19,800 )
•
•
• 2
31
Copyright (c) Bitforest Co., Ltd.33 @vaddynet