|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/directory-traversal-best-course/
课程评论：没有评论
课程名称：OWASP TOP 10：目录遍历 课程概述：目录遍历漏洞是一种可以让攻击者访问本不应有权限访问的文件的安全漏洞。攻击者通过欺骗网络服务器或运行在其上的网络应用程序，使其返回位于网络根目录之外的文件。OWASP Top 10 旨在对前十名最关键的网络应用程序安全风险进行排名和提供修复指导。该报告基于全球安全专家的共识，充分利用了OWASP开放社区贡献者的丰富知识和经验。 目录遍历是什么？目录遍历是一种网络安全漏洞，允许攻击者读取在运行应用程序的服务器上的任意文件。这可能包括应用代码、数据、后端系统的凭证以及敏感的操作系统文件。在某些情况下，攻击者甚至可以写入服务器上的任意文件，从而修改应用数据或行为，最终完全控制服务器。根据OWASP "Top 10" 列表，路径遍历攻击（即目录遍历）是第二大普遍且影响深远的漏洞。 目录遍历与路径遍历有什么区别？目录路径遍历与文件包含漏洞的主要区别在于执行那些不是保存在可解释文件（如 .php 或 .asp 等）中的源代码的能力。 学习目录遍历漏洞的必要性：拥有目录遍历漏洞的系统，攻击者可以利用这一漏洞越过根目录，访问文件系统的其他部分。这可能使攻击者能够查看受限文件，从而获取更多信息以进一步破坏系统。具体取决于网站访问的设置，攻击者将通过假冒与“网站”相关联的用户来执行命令。因此，最终取决于网站用户在系统中的权限。 如何防止目录遍历攻击：在调用文件系统时，避免依赖用户输入的路径的任何部分。如果不能避免依赖用户输入，则在使用路径之前对其进行规范化处理，并检查其前缀是否匹配用户被允许访问的目录。处理不会导致文件请求的URI请求，并确保将Web服务器操作系统和关键应用程序文件彼此分开。不要使用管理员或超级用户帐户来运行权限仅允许读取其运行所需文件的Web服务器。 加入我们，轻松愉快地学习如何防范目录遍历攻击。
A path traversal vulnerability allows an attacker to access files on your web server to which they should not have access. They do this by tricking either the web server or the web application running on it into returning files that exist outside of the web root folder.The OWASP Top 10 provides rankings of-and remediation guidance for-the top 10 most critical web application security risks. Leveraging the extensive knowledge and experience of the OWASP's open community contributors, the report is based on a consensus among security experts from around the world.What is Directory traversal?Directory traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. In some cases, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data or behavior, and ultimately take full control of the server.A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.It is the second most prevalent and impactful vulnerability as per the OWASP "Top 10" list.What is the difference between directory traversal and path traversal?The main difference between a Directory path traversal and the file inclusion vulnerabilities is the ability to execute the source codes that are not saved in interpretable files (like. php or. asp and others)why need to learn Directory traversal vulnerabilities?With a system vulnerable to directory traversal, an attacker can make use of this vulnerability to step out of the root directory and access other parts of the file system. This might give the attacker the ability to view restricted files, which could provide the attacker with more information required to further compromise the system.Depending on how the website access is set up, the attacker will execute commands by impersonating himself as the user which is associated with "the website". Therefore it all depends on what the website user has been given access to in the systemHow to prevent Directory traversal attacksWhen making calls to the filesystem, you should avoid relying on user input for any part of the path.If you really can't avoid relying on user input, normalize the information or the path before using it. Then, check that its prefix matches the directory that users are permitted to access.Process URI requests that do not result in a file requestEnsure that your web server operating system and critical application files are kept separate from each otherDo not use administrator or superuser accounts to run web servers whose permissions only allow them to read only the files it needs to runSo, Join Now to learn with fun way.
