https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/Recent content in WEB安全 on ClearSec WikiHugozh-cnFri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.1_web%E5%AE%89%E5%85%A8_%E5%A8%81%E8%83%81%E4%B8%8E%E9%9C%80%E6%B1%82%E5%88%86%E6%9E%90/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.1_web%E5%AE%89%E5%85%A8_%E5%A8%81%E8%83%81%E4%B8%8E%E9%9C%80%E6%B1%82%E5%88%86%E6%9E%90/<p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.1_WEB%E5%AE%89%E5%85%A8_%E5%A8%81%E8%83%81%E4%B8%8E%E9%9C%80%E6%B1%82%E5%88%86%E6%9E%90/a58dc0eb28047ce092194a8bde284de1_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.1_WEB%E5%AE%89%E5%85%A8_%E5%A8%81%E8%83%81%E4%B8%8E%E9%9C%80%E6%B1%82%E5%88%86%E6%9E%90/587ef4592d5d7e13c2723262e31eb87b_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.2_apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.2_apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/<p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/701a987beb9ce289cffd161d04418214_MD5.png" alt=""></p> <h3 id="概述">概述</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/25f7fc8abf774b38f39492fc1a96b9ee_MD5.png" alt=""></p> <h3 id="安全威胁">安全威胁</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/35d03831823f39296e66864af6f1fe9e_MD5.png" alt=""></p> <p>开发隐患-配置管理隐患-安全配置隐患-黑客攻击威胁-网络通信威胁-内容威胁-可用性威胁</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/71888d0b24c16b6a8cb949a08e703875_MD5.png" alt=""></p> <h3 id="安全机制">安全机制</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/3593e6f45b81b23f1908f89986dd2d42_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/090994c5381fbbf2fa950d6b905efde4_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/8fdfcc4d8b7d1c75311f012df2131d37_MD5.png" alt=""></p> <h3 id="加固">加固</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.2_Apache%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/f05135e3d0f3a983642258fc17828ab1_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.3_iis%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.3_iis%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/<p>IIS可以提供WEB（80、443）、SMTP（25）、FTP（21、20 | TCP端口）服务，</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.3_IIS%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/5bfb2831092a6476fbae9fd9a6496905_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.3_IIS%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/aa2c465669e6dd500403f5e236794904_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.3_IIS%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/9aeaa140e50383a2d0f130629182ac69_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.3_IIS%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E4%B8%8E%E5%8A%A0%E5%9B%BA/4a826acbb230d5f8380012e499b86e5a_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.4_web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.4_web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/<p>技术漏洞、业务逻辑漏洞</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/4b9e6c3e44c29134696169c5f5304300_MD5.png" alt=""></p> <p>② 用户找回密码缺陷，例如，用户找回密码，需要输入手机号接收验证码，而没有校验这个手机号，随便输入一个手机号就能改密码。 恶意访问、黑灰产等威胁……</p> <h3 id="dwasp-top10">DWASP TOP10</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/4a382e4f1247d33f11198456416acf21_MD5.png" alt=""></p> <p>隐藏详细的错误信息，禁用目录列表，隐藏版本号，尽量少的暴露安全策略信息。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/e21968c4de16fe983e95a3601f19cd36_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/db935856f3bf203a2375106e37832d01_MD5.png" alt=""></p> <h3 id="sql注入">SQL注入</h3> <p>给应用程序最小化权限，对用户输入内容进行过滤。</p> <p>部署数据库审计系统。屏蔽掉错误信息的详细内容。对开源程序进行改造，避免默认的表结构被攻击。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/272c5ad34cd129a96597d9513beab4db_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/d214a150f8a8236327e8064014d1e078_MD5.png" alt=""></p> <h3 id="文件上传漏洞">文件上传漏洞</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/8970da9d9276b09f8cfaf3d1b3b3e60e_MD5.png" alt=""></p> <h3 id="跨站脚本攻击xss">跨站脚本攻击XSS</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/ae857356a5367a18f711ba65af4567db_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.4_WEB%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E_%E5%88%86%E6%9E%90%E4%B8%8E%E9%98%B2%E6%8A%A4/4ad27cab91c67b1170fb36bee032bc64_MD5.png" alt=""></p> <p>解决跨站：检查用户输入、</p>https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/22_web%E5%AE%89%E5%85%A8/22.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/<h3 id="机制与技术解决方案">机制与技术解决方案</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/1876ae7663e0f8fc6523eb012f6dd2b3_MD5.png" alt=""></p> <p>WAF</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/4dd7cad81d0f138a9f816236b08e6e0b_MD5.png" alt=""></p> <h3 id="网站加固">网站加固</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/53c86c57a7b807826d8960d65716b957_MD5.png" alt=""></p> <p>WAF、漏扫、hash校验</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/925a3c51d05487f7c54de4e27a8f0c85_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/a23e5d2f575ad7d06cb9e23777aeb6b1_MD5.png" alt=""></p> <h3 id="案例">案例</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/c8af33897e1b78ff9ea2babb0135c031_MD5.png" alt=""></p> <p>⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A722.5_%E7%BD%91%E7%AB%99%E5%AE%89%E5%85%A8%E4%BF%9D%E6%8A%A4%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%8A%A0%E5%9B%BA/7555a5794fec3af46ea7556f789ff2cd_MD5.png" alt=""></p>