본문 바로가기
SW Dev Portfolio

2023년 홈페이지 취약점 점검 문제점 및 핵심사항 해결 방법

이준호 2024. 1. 17. 15:11
반응형

 

Missing HTTP Strict Transport Security (HSTS)

Description (됨)

The server didn't return a Strict-Transport-Security header as part of its HTTPS response, which should be enabled to prevent Man-in-The-Middle (MiTM) attacks.

Solution

Set the Strict-Transport-Security header with "max-age=63072000; includeSubDomains" as value and configure your server to redirect HTTP requests to HTTPS.

 

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

 

해결방안

이 경고는 홈페이지의 보안을 강화하기 위한 HTTPS 관련 설정에 대한 내용입니다. 아래는 해당 내용을 자세히 설명하고, 해결책에 대한 내용입니다.

Strict-Transport-Security (HSTS) 헤더란?
Strict-Transport-Security (HSTS)는 웹 브라우저에게 해당 웹 사이트를 반드시 안전한 HTTPS 연결을 통해서만 접속하도록 강제하는 보안 메커니즘입니다. 이 헤더를 사용하면 중간자 공격(Man-in-The-Middle, MiTM)과 같은 보안 위협으로부터 사용자를 보호할 수 있습니다.

경고 내용 해석:
Strict-Transport-Security 헤더 미포함: 현재 서버 응답에는 Strict-Transport-Security 헤더가 포함되어 있지 않습니다.
해결책:
Strict-Transport-Security 헤더 추가:

서버 응답에 Strict-Transport-Security 헤더를 추가하세요.
값은 "max-age=63072000; includeSubDomains"로 설정합니다.
이는 브라우저에게 해당 도메인과 모든 하위 도메인에 대해 최소한 2년간 HSTS를 적용하라고 알려주는 것입니다.
HTTP 요청을 HTTPS로 리다이렉트:

서버를 구성하여 HTTP 요청이 들어왔을 때 HTTPS로 리다이렉트하도록 설정하세요.
이를 통해 사용자가 브라우저에서 "http://"로 시작하는 주소로 액세스할 때 자동으로 "https://"로 리다이렉션됩니다.
재시작 및 테스트:

서버 구성 변경 후에는 서버를 재시작하여 변경 사항을 적용하세요.
브라우저에서 해당 웹 사이트에 접속하여 Strict-Transport-Security 헤더가 적용되는지 확인하세요.
주의사항:
설정 변경 전에 백업을 수행하고, 변경 사항이 적용된 후에는 서버의 동작을 확인하세요.
HSTS를 사용하면 해당 도메인에 대한 모든 HTTP 트래픽이 HTTPS로 강제되므로, HTTPS가 올바르게 구성되었는지 확인해야 합니다.
이 조치를 통해 브라우저와 웹 서버 간의 통신이 안전하게 유지되며, 중간자 공격에 대한 보호가 강화됩니다.

 

Tomcat에서 Strict-Transport-Security 헤더를 설정하려면, 일반적으로 web.xml 파일에 필터를 추가하거나, Tomcat의 server.xml 파일에 직접 설정을 추가해야 합니다. 아래는 두 가지 방법에 대한 간단한 예시입니다.

방법 1: web.xml 파일에 필터 추가


web.xml 파일 수정:

웹 애플리케이션의 WEB-INF 디렉토리에 있는 web.xml 파일에 아래와 같이 필터를 추가합니다.

 <!-- HSTS 설정 -->
    <filter>
        <filter-name>Strict-Transport-Security</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
            <param-name>hstsEnabled</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>hstsMaxAgeSeconds</param-name>
            <param-value>63072000</param-value>
        </init-param>
        <init-param>
            <param-name>hstsIncludeSubDomains</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>Strict-Transport-Security</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>



필터 구현:

package your.package.name;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.IOException;

public class StrictTransportSecurityFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 필요한 초기화 작업
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Strict-Transport-Security 헤더를 설정
        response.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        // 필터 파괴 시의 작업
    }
}


패키지에 StrictTransportSecurityFilter라는 이름의 필터를 구현합니다.


방법 2: server.xml 파일에 직접 설정


server.xml 파일을 수정하여 특정 웹 애플리케이션에 대한 Context 엘리먼트에 직접 설정을 추가할 수 있습니다.

server.xml 수정: 

<Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">
    <!-- 다른 설정들... -->

    <Context docBase="your-web-app" path="/your-web-app" reloadable="true">
        <!-- Strict-Transport-Security 헤더 설정 -->
        <Valve className="org.apache.catalina.valves.RemoteIpValve" />
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log." suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b" />
        <Loader className="org.apache.catalina.loader.WebappLoader"  directory="webapps/your-web-app" />
        <JarScanner scanClassPath="false"/>
        <JarScanner scanAllDirectories="false"/>
    </Context>

</Host>


위에서 "your-web-app"을 실제 웹 애플리케이션의 디렉토리로 변경해야 합니다.

톰캣 재시작:

설정을 변경한 후 톰캣 서버를 재시작하여 적용합니다.

이러한 방법 중 하나를 선택하여 Strict-Transport-Security 헤더를 적용할 수 있습니다.

 

Use of Insecure TLS 1.0 Protocol (됨)

 

Description

The web server is using TLS 1.0, an old deprecated protocol with known vulnerabilities and weaknesses.

Solution

Disable TLS version 1.0 and replace it with TLS 1.2 or a higher version.



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

해결방안

이 취약점 메시지는 TLS 1.0 프로토콜을 사용하는 보안 결함에 관한 내용입니다. TLS 1.0은 오래되어 취약점이 발견되어 높은 보안 수준을 필요로 하는 요즘 시대에는 권장되지 않습니다. 브라우저 및 웹 서버 간의 통신에서 안전한 연결을 유지하기 위해 최신 및 안전한 프로토콜로 업그레이드해야 합니다.

해결 방법:
TLS 업그레이드:

TLS 1.0을 비활성화하고 TLS 1.2 이상을 사용하도록 웹 서버를 구성하세요.
TLS 1.2는 현재의 보안 표준이며, 최신의 브라우저들이 지원합니다.
웹 서버 설정 변경:

웹 서버 (예: Apache, Nginx, 등)의 SSL/TLS 설정에서 TLS 1.0을 비활성화하고 TLS 1.2로 설정합니다.
웹 서버 재시작:

설정 변경 후에는 웹 서버를 재시작하여 변경 사항을 적용하세요.

server.xml

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
                         certificateFile="conf/localhost-rsa-cert.pem"
                         certificateChainFile="conf/localhost-rsa-chain.pem"
                         type="RSA" />
        </SSLHostConfig>
		 <!-- TLS 1.0을 비활성화하고 TLS 1.2 및 1.3 사용 -->
		<SSLHostConfig protocols="TLSv1.2,TLSv1.3">
        <!-- 다른 SSL/TLS 설정들 -->
		</SSLHostConfig>
    </Connector>

주석 처리 되어있던 내용을 활성화 하고 적용하였는데 맞는지 모르겠다... 

다시 적용한 내용

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
		maxThreads="150" SSLEnabled="true"
		sslEnabledProtocols="TLSv1.2,TLSv1.3">
		<!-- other SSL configuration -->
	</Connector>

Missing Clickjacking Protection Header(됨)

 

 

Description

The server didn't return a X-Frame-Options header as part of its HTTP response, which enables clickjacking attacks against it since its content is allowed to be embedded into other sites.

Solution

Enable the special header as explained at: X-Frame-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

 

해결방안

캣 서버에서 X-Frame-Options 헤더를 설정하려면 server.xml 파일의 <Host> 엘리먼트 내에 <Valve>를 추가하면 됩니다. 아래는 이를 수행하는 예시입니다:

<Host name="localhost"  appBase="D:\home\example" unpackWARs="true" autoDeploy="true">
    <!-- 기존 설정들... -->
    
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log" suffix=".txt"
           pattern="combined" />

    <!-- Strict-Transport-Security 및 X-Frame-Options 헤더 설정 -->
    <Valve className="org.apache.catalina.valves.RemoteIpValve" />
    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
    <Valve className="org.apache.catalina.filters.HttpHeaderSecurityFilter" />
</Host>
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           addHeader="X-Frame-Options: SAMEORIGIN" />

web.xml

  <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>



위 설정에서 org.apache.catalina.filters.HttpHeaderSecurityFilter 클래스를 사용하여 X-Frame-Options 헤더를 추가할 수 있습니다.

주의사항:

위의 예시에서는 HttpHeaderSecurityFilter를 사용하여 X-Frame-Options 헤더를 추가하고 있습니다. 이 클래스는 톰캣 8.5 이상에서 사용 가능합니다. 톰캣 버전에 따라 클래스 이름이나 기능이 다를 수 있습니다. 톰캣 버전에 맞는 설정을 확인하십시오.

톰캣의 설정 파일이나 라이브러리 등이 다를 수 있으므로 정확한 구성을 확인하기 위해 톰캣의 공식 문서를 참조하는 것이 좋습니다.

설정 변경 후에는 톰캣 서버를 다시 시작하여 변경 사항을 적용하세요. 이후에는 취약성 스캔 도구 또는 브라우저 개발자 도구를 사용하여 X-Frame-Options 헤더가 올바르게 설정되었는지 확인할 수 있습니다.

 

Missing Content Sniffing XSS Protection (동일적용)

 

 

Description

The server didn't return a X-Content-Type-Options header as part of its HTTP response, which enables content sniffing XSS attacks.

Solution

Make sure you send the X-Content-Type-Options header with "nosniff" as value.



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

해결방안

X-Content-Type-Options 헤더를 톰캣 서버에 적용하려면 server.xml 파일의 <Host> 엘리먼트 내에 <Valve>를 추가하면 됩니다. 아래는 이를 수행하는 예시입니다:

xml

<Host name="localhost"  appBase="D:\home\example" unpackWARs="true" autoDeploy="true">
    <!-- 기존 설정들... -->
    
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log" suffix=".txt"
           pattern="combined" />

    <!-- Strict-Transport-Security, X-Frame-Options 및 X-Content-Type-Options 헤더 설정 -->
    <Valve className="org.apache.catalina.valves.RemoteIpValve" />
    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
    <Valve className="org.apache.catalina.filters.HttpHeaderSecurityFilter" />

    <!-- X-Content-Type-Options 헤더 추가 -->
    <Valve className="org.apache.catalina.filters.AddDefaultCharsetFilter"
           defaultCharset="UTF-8" />
    <Valve className="org.apache.catalina.filters.SetCharacterEncodingFilter"
           encoding="UTF-8" />
</Host>


위 설정에서 org.apache.catalina.filters.HttpHeaderSecurityFilter 클래스를 사용하여 X-Content-Type-Options 헤더를 추가할 수 있습니다.

주의사항:

위의 예시에서는 HttpHeaderSecurityFilter를 사용하여 X-Content-Type-Options 헤더를 추가하고 있습니다. 이 클래스는 톰캣 8.5 이상에서 사용 가능합니다. 톰캣 버전에 따라 클래스 이름이나 기능이 다를 수 있습니다. 톰캣 버전에 맞는 설정을 확인하십시오.

톰캣의 설정 파일이나 라이브러리 등이 다를 수 있으므로 정확한 구성을 확인하기 위해 톰캣의 공식 문서를 참조하는 것이 좋습니다.

설정 변경 후에는 톰캣 서버를 다시 시작하여 변경 사항을 적용하세요. 이후에는 취약성 스캔 도구 또는 브라우저 개발자 도구를 사용하여 X-Content-Type-Options 헤더가 올바르게 설정되었는지 확인할 수 있습니다.

 

Missing Certificate Transparency Header (적용- 안됨)

 

 

Description

The server didn't return a Expect-CT header as part of its HTTPS response, which should be enabled to prevent the use of misissued certificates.

Solution

Enable the special header as explained at: Expect-CT (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT)



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

해결방안

톰캣 서버에 Expect-CT 헤더를 추가하려면 server.xml 파일에 적절한 설정을 추가하면 됩니다. 이를 위해 org.apache.catalina.valves.RemoteIpValve를 사용하여 헤더를 추가할 수 있습니다.

xml

<Host name="localhost" appBase="D:\home\example" unpackWARs="true" autoDeploy="true">
    <!-- 기존 설정들... -->

    <!-- Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options 및 Expect-CT 헤더 설정 -->
    <Valve className="org.apache.catalina.valves.RemoteIpValve" />
    <Valve className="org.apache.catalina.filters.HttpHeaderSecurityFilter" />

    <!-- Expect-CT 헤더 추가 -->
    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve">
        <Prepend>  
            <!-- RewriteValve를 사용하여 Expect-CT 헤더를 추가합니다. -->
            <Header name="Expect-CT" value="enforce, max-age=30" />
        </Prepend>
    </Valve>
</Host>
<!-- Expect-CT 필터 설정 -->
    <filter>
        <filter-name>ExpectCTFilter</filter-name>
        <filter-class>your.package.ExpectCTFilter</filter-class>
        <init-param>
            <param-name>max-age</param-name>
            <param-value>86400</param-value>
        </init-param>
        <!-- 다른 init-param 설정들 -->
    </filter>

    <filter-mapping>
        <filter-name>ExpectCTFilter</filter-name>
        <url-pattern>/secure/*</url-pattern> <!-- 원하는 URL 패턴 지정 -->
    </filter-mapping>
<filter>
    <filter-name>AddExpectCTHeaderFilter</filter-name>
    <filter-class>org.apache.catalina.filters.AddExpectCTHeaderFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>AddExpectCTHeaderFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>


위 설정에서 org.apache.catalina.filters.HttpHeaderSecurityFilter 클래스를 사용하여 Expect-CT 헤더를 추가하고 있습니다. 이 클래스는 톰캣 8.5 이상에서 사용 가능합니다. 톰캣 버전에 따라 클래스 이름이나 기능이 다를 수 있으므로 톰캣 버전에 맞는 설정을 확인하십시오.

설정 변경 후에는 톰캣 서버를 다시 시작하여 변경 사항을 적용하세요. 이후에는 취약성 스캔 도구 또는 브라우저 개발자 도구를 사용하여 Expect-CT 헤더가 올바르게 설정되었는지 확인할 수 있습니다.

Missing Cache-Control Header(됨)

 

Description

The server didn't return a Cache-Control header as part of its HTTP response, which may enable sensitive information exposure due to browser cache weakness.

Solution

Make sure you send the Cache-Control header with an appropriate value. Use the value "no-cache, no-store" if the page contains sensitive information (such as password, credit card, etc) and, in addition to this, send the Pragma header with "no-cache" as value.



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

해결방안


톰캣 서버에 Cache-Control 헤더를 추가하려면 server.xml 파일에 적절한 설정을 추가하면 됩니다. 이를 위해 org.apache.catalina.filters.HttpHeaderSecurityFilter를 사용하여 헤더를 추가할 수 있습니다.

xml

Copy code
<Host name="localhost" appBase="D:\home\example" unpackWARs="true" autoDeploy="true">
    <!-- 기존 설정들... -->

    <!-- Cache-Control 및 Pragma 헤더 설정 -->
    <Valve className="org.apache.catalina.valves.RemoteIpValve" />
    <Valve className="org.apache.catalina.filters.HttpHeaderSecurityFilter" />

    <!-- Cache-Control 및 Pragma 헤더 추가 -->
    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve">
        <Prepend>  
            <!-- RewriteValve를 사용하여 Cache-Control 및 Pragma 헤더를 추가합니다. -->
            <Header name="Cache-Control" value="no-cache, no-store" />
            <Header name="Pragma" value="no-cache" />
        </Prepend>
    </Valve>
</Host>

 

위 설정에서 org.apache.catalina.filters.HttpHeaderSecurityFilter 클래스를 사용하여 Cache-Control 및 Pragma 헤더를 추가하고 있습니다. 이 클래스는 톰캣 8.5 이상에서 사용 가능합니다. 톰캣 버전에 따라 클래스 이름이나 기능이 다를 수 있으므로 톰캣 버전에 맞는 설정을 확인하십시오.

설정 변경 후에는 톰캣 서버를 다시 시작하여 변경 사항을 적용하세요. 이후에는 취약성 스캔 도구 또는 브라우저 개발자 도구를 사용하여 Cache-Control 및 Pragma 헤더가 올바르게 설정되었는지 확인할 수 있습니다.

INFO

Web Technology Disclosure ( 됨)

 

Description

The application discloses the use of a web technology as part of the HTTP response header (see the matched signature). An attacker may use this information to harvest specific vulnerabilities for the technology identified.

Solution

Configure the application or the web server to prevent this information leakage as part of its HTTP response header.



Request:

GET / HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

해결방안

톰캣 서버에서 x-aspnet-version와 같은 기술 정보를 HTTP 응답 헤더에서 노출하지 않도록 설정하는 방법은 톰캣의 설정 파일을 수정하는 것입니다. 기본적으로 톰캣은 ASP.NET과 관련된 헤더를 생성하지 않지만, 명시적으로 설정할 수 있습니다.

톰캣에서는 web.xml 파일에 security-constraint를 추가하여 특정 헤더를 노출하지 않도록 제어할 수 있습니다. 아래는 특정 헤더를 비활성화하는 web.xml 파일의 예시입니다.

web.xml 파일 수정:

web.xml 파일을 열고 아래와 같이 <security-constraint>를 추가합니다.

xml 

    <!-- 기존 설정 -->

    <!-- Disable X-AspNet-Version Header -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Restricted resources</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <http-method>TRACE</http-method>
        <http-method>OPTIONS</http-method>
        <http-method>HEAD</http-method>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
        <http-method>CONNECT</http-method>
        <http-method>TRACK</http-method>
        <http-method>MOVE</http-method>
        <http-method>COPY</http-method>
        <http-method>PROPFIND</http-method>
        <http-method>PROPPATCH</http-method>
        <http-method>MKCOL</http-method>
        <http-method>LOCK</http-method>
        <http-method>UNLOCK</http-method>
    </security-constraint>

</web-app>


이렇게 설정하면 TRACE, OPTIONS, HEAD, GET, POST, PUT, DELETE, CONNECT, TRACK, MOVE, COPY, PROPFIND, PROPPATCH, MKCOL, LOCK, UNLOCK 메서드를 사용하는 경우 해당 헤더가 노출되지 않습니다.

톰캣 재시작:

설정을 변경한 후에는 톰캣 서버를 재시작하여 변경 사항이 적용되도록 합니다.

위의 설정은 특정 헤더를 비활성화하는 예시이며, 실제로는 보안 정책에 따라 필요한 설정을 추가하거나 수정할 수 있습니다. 특히 헤더를 변경하는 것은 보안적인 측면에서 주의 깊게 처리해야 합니다.

 

Suspicious HTML Comment

 

 

Description

This page contains suspicious HTML comments (search for the matched signatures below).

Solution

Review and, if necessary, remove the comments from the page.



Request:

GET /bbs/notice01_view.338%3B%2338%3Bamp%3Bpage%3D1 HTTP/1.1
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
Cookie: JSESSIONID=057FF8DAF7F6DE241A092DEB1212090A.worker1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip

 

해결방안

 

Suspicious HTML Comment

 

 

Description

This page contains suspicious HTML comments (search for the matched signatures below).

Solution

Review and, if necessary, remove the comments from the page.



Request:

GET
Host: www.example.or.kr
Keep-Alive: 300
Connection: keep-alive
Cookie: JSESSIONID=057FF8DAF7F6DE241A092DEB1212090A.worker1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Accept-Encoding: gzip
Referer: https://www.koddi.or.kr/

해결방안

  1. 주석 검토:
    • 해당 페이지의 소스 코드를 검토하여 의심스러운 주석을 찾습니다.
    • 코드의 주석 부분에서 보안과 관련된 키워드가 포함되었는지 확인합니다.
  2. 주석 제거:
    • 의심스러운 주석을 확인한 경우, 해당 주석을 안전하게 제거합니다.
    • 서버 측 코드에서 해당 주석이 동적으로 생성되는 경우에는 해당 코드를 수정하여 보안에 취약하지 않도록 합니다.
  3. 코드 검토:
    • 웹 페이지와 관련된 서버 측 및 클라이언트 측 코드를 전반적으로 검토하여 다른 보안 취약점이나 이슈가 있는지 확인합니다.
    • 특히 사용자 입력 및 외부 데이터의 처리 방법을 신중하게 검토합니다.
  4. 보안 정책 강화:
    • 웹 애플리케이션에서는 적절한 보안 정책을 설정하고 운영해야 합니다.
    • 보안 감사 로그를 모니터링하여 의심스러운 활동을 감지하고 대응할 수 있는 프로세스를 설정합니다.
  5. 웹 방화벽 적용:
    • 웹 애플리케이션에는 웹 방화벽을 적용하여 악성 트래픽이나 공격을 차단할 수 있도록 합니다.

 

반응형
저작자표시

'SW Dev Portfolio' 카테고리의 다른 글

IT 경력 개발자 이직 면접 예상 질문 및 답변  (3) 2024.01.09
React 기반 MERN 웹 로그인 할 때 firebase Authentication 사용법 자세히 알려드립니다. (회원가입 , 로그인 코드)  (4) 2023.11.04
[JAVA]대한민국 법정동 코드 reg-code-api 조회 API 사용방법 알려드리오  (0) 2023.11.04
Content-Security-Policy (CSP) 헤더 관하여 알아보았다  (2) 2023.10.26
지도 api (네이버,카카오) + 공공데이터 활용 앱 개발 Test 영상  (3) 2023.10.20
DBever를 사용하여 MySQL를 PostgreSQL로 마이그레션 하는 방법  (1) 2023.10.18

'SW Dev Portfolio' Related Articles

티스토리툴바