BEZBEDNOST WEB APLIKACIJA
Autor:
Stevan Džigurski Novi Sad, 2003.
S A D R Ž A J
1. UVOD ...........................................................................................................................................................4
................................................................................................................51.2. W
.......................................................................................................................................61.3. HTTP
........................................................................................................7
2. AUTENTIFIKACIJA .................................................................................................................................8
.....................................................................................................................8
2.1.1. HTTP Basic ...................................................................................................................................82.1.2. HTTP Digest .................................................................................................................................92.1.3. Autentifikacija na osnovu formi ..................................................................................................102.1.4. Digitalni sertifikati (SSL i TLS) ..................................................................................................11
....................................................................................................................11
2.2.1. Autentifikacija infrastrukture ......................................................................................................11
3. UPRAVLJANJE KORISNIČKIM SESIJAMA .....................................................................................14
................................................................................................................................................143.2. S
) ...........................................................................................................153.3. SSL
TLS ...........................................................................................................................................16
.................................................................................................................17 3.3.2. SSL pregovaranje sa autentifikacijom samo servera .................................................................17 3.3.3. SSL sa klijentskom i serverskom autentifikacijom ......................................................................18
4. KONTROLA PRISTUPA I AUTORIZACIJA .......................................................................................19
................................................................................................................194.2. O
5. PRAĆENJE RADA - EVENT LOGGING .............................................................................................22
............................................................................................................................225.2. O
................................................................................................................................23
6. VALIDACIJA PODATAKA .....................................................................................................................24
.............................................................................................................................24
6.1.1. Prihvati samo poznate validne podatke ......................................................................................246.1.2. Odbaci podatke za koje se zna da nisu validni ...........................................................................256.1.3. Saniraj sve podatke .....................................................................................................................25
7. BEZBEDNOSNI PROBLEMI PRI RADU WEB APLIKACIJA ........................................................26
..............................................................................................................................26
7.1.1. Cross-site scripting .....................................................................................................................26
...................................................................................................................................28
7.2.1. Direktne SQL naredbe ................................................................................................................287.2.2. Direktne OS naredbe ...................................................................................................................307.2.3. Otkrivanje putanje dokumenta ....................................................................................................317.2.4. Uključivanje udaljenih datoteka .................................................................................................317.2.5. Nulti bajtovi ................................................................................................................................327.2.6. URL kodiranje .............................................................................................................................33
....................................................................................................................35
7.3.1. Manipulacija Cookie-a ...............................................................................................................35
2
7.3.2. Manipulacija HTTP zaglavljima ................................................................................................36 7.3.3. Manipulacija poljima HTML formi ............................................................................................37 7.3.4. URL manipulacija .......................................................................................................................38
....................................................................................................................40
7.4.1. Konfiguracija sistema .................................................................................................................407.4.2. Komentari u HTML .....................................................................................................................407.4.3. Stari, bekapovani i fajlovi bez reference .....................................................................................417.4.4. Debug naredbe ............................................................................................................................427.4.5. Default (inicijalni) nalozi ...........................................................................................................43
8. PROBLEMI PRIVATNOSTI ...................................................................................................................44
.....................................................................................................................448.3. O
» ...................................................................................................................44
9. ZAKLJUČAK ..........................................................................................................................................4510. LITERATURA .......................................................................................................................................46REČNIK .......................................................................................................................................................47
3
Search History:
Result 00 of 00
00 results for result for
p.
3.3.3.SSL sa klijentskom i serverskom autentifikacijom for Bezbednost Web Aplikacija
8.0K
Reads
48
Readcasts
2
Embed Views
Get Scribd Mobile
To get Scribd mobile enter your number and we'll send you a link to the Scribd app for iPhone & Android.We've sent a link to the Scribd app. If you didn't receive it, try again.
We'll never share your phone number.
Recommended
Notes
Load more
