Bao Mat Nhap Mon

Bn quyn ti toidicodedao.
com
Bn mt nhp mn Phm Huy Hong
Li ta
Bo mt l mt vn rt tn km v phc tp. Gn nh h thng no cng c l hng (c
phn mm ln phn cng), cc hacker c th thng qua cc l hng ny tn cng h thng.
Vic m bo h thng bo mt l trch nhim ca rt nhiu bn: Sysadmin, network,
manager v developer. Trong phm vi sch, mnh s cng cc bn tip cn kha cnh bo
mt di gc nhn ca mt developer.
Nhng kin thc trong ebook ny c cng c bn, d hc, nhng chng s v cng hu ch,
gip bn trnh phi nhng sai lm bo mt ng ngn, c bn khi code. D cho bn code C
hay C++, Java C# hay PHP, bn cng s hc c vi iu b ch qua series ny.
Trch nhim ca developer l phi m bo rng code mnh vit ra s khng c li bo mt.
Trong ebook ny, chng ta ng vai hacker tn cng h thng mnh vit. Thng qua ,
chng ta s cng tm hiu v nhng l hng bo mt thng thy khi code v tm cch v li.
a phn cc li bo mt c bn c ngn chn trong cc framework. Tuy vy, nhiu trang
web vn b dinh mt s li v s ng ngn hoc s sut ca chnh developer. Do , hy c
k ebook v c gng p dng nhng kin thc ny vo code trnh dnh cc li ny nh.
y l series hng dn bo mt cho developer, khng phi l hng dn lm hacker. Kin
thc trong ebook gip bn code, gip bn v li ch khng gip bn tn cng h thng khc
hay la o ngi dng. Bn no nghim tc mun tm s hc o v bo mt c th tm
thnh bo mt Juno_okyo nh.
Cnh bo
Trc khi dy v, s ph lun dn cc rng: Hc v l cng thn kin th, hnh
hip gip i, khng phi i bt nt k yu. Trc khi bt u sch, mnh cng mun
khuyn cc bn iu tng t: Hc v security xy dng h thng bo mt tt hn,
gip h thng khc, ch khng phi i hack hay ph hoi.
V l do o c, nu pht hin li trong cc h thng khc, cc bn nn thng bo cho qun
tr ch ng nn ph hoi. Ranh gii gia tm hiu l hng v ph hoi h thng n mong
manh lm. Vi cc h thng quan trng. bn c th b truy t vo t bc lch cho l ass n
hoa ch chng chi.
Bn quyn ti toidicodedao.com
Bo mt nhp mn Phm Huy Hong
Mc lc
PHN 1 BO MT NHP MN .................................................................... 4

GIAO THC HTTP BO MT N MC NO? ............................................................. 5
n li v HTTP ....................................................................................................................5
S lc v Man-in-the-middle attack ................................................................................5
Cch phng chng ..............................................................................................................6
Lu ...................................................................................................................................7
Tng kt ...........................................................................................................................10
L HNG BO MT XSS NGUY HIM N MC NO?................................................. 11
Gii thiu v XSS ..............................................................................................................11
Nhng dng XSS ...............................................................................................................11
Cch phng trnh .............................................................................................................13
Li kt...............................................................................................................................14
LU TR COOKIE TNG KHNG HI AI NG HI KHNG TNG ......................... 15
Cookie Chic bnh qui v hi? ...................................................................................15
Bnh qui nho nh, y nhng l to to .............................................................................15
Cch phng chng ............................................................................................................16
SQL INJECTION L HNG BO MT THN THNH .................................................... 17
Ti sao SQL Injection li thn thnh? ...........................................................................17
Hu qu ca SQL Injection ...............................................................................................17
Tn cng SQL Injection nh th no? ..............................................................................18
Cch phng chng ............................................................................................................18
Kt lun ............................................................................................................................19
INSECURE DIRECT OBJECT REFERENCES GIU U LI UI ..................................... 20
Li g m tn di ra??.....................................................................................................20
Cch li dng l hng ......................................................................................................20
Cch phng chng ............................................................................................................22
CSRF NHNG C LA NGON MC ......................................................................... 23
C bn v CSRF ................................................................................................................23
Cc kiu tn cng thng gp .........................................................................................23
Lu .................................................................................................................................25
Phng chng cho website ................................................................................................26
Tng kt ...........................................................................................................................26
N GIU THNG TIN H THNG TRNH CON MT NGI I V K XU ............... 27
Thng tin h thng l g? .................................................................................................27
Chng ta thng tin h thng h hnh nh th no? ..............................................27
Nhng hu qu ca vic l hng ..................................................................................29
Giu nh th no cho ng? ...........................................................................................29
QUN L NGI DNG TNG D N M KHNG N GIN ................................ 30
i gii! ng k ng nhp c g kh? .............................................................................30
Quan trng nht Khng lu mt khu! .........................................................................30
Lm th no khi ngi dng qun mt khu? .................................................................31
Chng vic on m mt khu ........................................................................................31
Bn quyn thuc v http://toidicodedao.com/

Nhng bin php nho nh tng cng bo mt .............................................................32
PHN 2 CASE STUDY.................................................................................. 33

L HNG BO MT KHNG KHIP CA LOTTE CINEMA............................................... 34
ng nhp h? Ch cn mt bng User, hai ct Username v Password l xong............34
Vy m ha l c ch g, lm tr!! ..............................................................................34
i gii phc tp th, cng lm th l password trn trang ca mnh thi m ................35
L hng bo mt khng khip ca Lotte Cinema ............................................................36
TI A HACK TI TA WEB SITE CU A LOTTE CINEMA NH TH NA O? ........................ 37
Gi i thiu .........................................................................................................................37
Bt u cu ca ..............................................................................................................37
Cu nhm ca mp......................................................................................................39
Bonus thm ca voi ........................................................................................................39
Kt lun ............................................................................................................................41
Update (30/08/2016) .......................................................................................................42
LOZI.VN V L D LIU 2 TRIU NGI DNG NH TH NO?.................. 44
D tm t web ..................................................................................................................44
n app mobile ................................................................................................................45
Qu trnh x l li.............................................................................................................47
Nhn xt ...........................................................................................................................47
Thay li kt ................................................................................................................ 49
V tc gi .................................................................................................................... 50
Thng tin lin lc: ....................................................................................................... 50
PHN 1 BO MT NHP MN
Kin thc c bn v bo mt v mt s l hng bo mt thng gp
GIAO THC HTTP BO MT N MC NO?

n li v HTTP
HTTP l mt giao thc dng truyn nhn d liu (Xem thm y). Hin ti, phn ln d
liu trn Internet u c truyn thng qua giao thc HTTP. Cc ng dng Web hoc Mobile
cng gi Restful API thng qua giao thc HTTP.
Tuy nhin, nhc im ca HTTP l d liu c truyn di dng plain text, khng h c
m ho hay bo mt. iu ny dn n vic hacker c th d dng nghe ln, chm cha v
chnh sa d liu. Ngi ta gi kiu tn cng ny l Man-in-the-middle attack, vit tt l
MITM.
S lc v Man-in-the-middle attack
Hy tng tng bn ang tn tnh mt em gi d thng mt cute ngc to dnh khng tn
Linh. tng tnh lng mn, bn khng nhn tin m trc tip vit th gi cho nng. Lc ny,
bn l client, b Linh l server, vic gi th l giao thc HTTP.
ng nhin, hoa p th lm rui bu. C mt thng hacker xu xa b i tm cch ph ri bn,
ta tm gi thng ny l Hong c h.
Search Linh pht n ra con b Linh l clip 18+ lun.
Thng Hong c h c th ph ri bn bng nhng cch sau:

1. Sniff packet c ln d liu
Bn h hng b th vo hm th, ch bc th bay n ch Linh. Th ang trn ng ti,
thng Hong bt c, m bc th ra xem, bit c ht nhng li tm tnh m bn dc
cn tm lng ra vit.
Trong thc t, khi bn gi username, password qua HTTP, hacker c th d dng chm
username, password ny bng cch c ln cc packet trong mng. (Bn gi clip 18+ th n
cng chm c nt).
2. Sa i packet
Khng ch c trm, thng Hong c h kia cn c th sa th ca bn. Bn khen Linh p
nh Maria Ozawa th n sa thnh Happy Polla. Linh reply li, hn bn i nh ngh lc 5h th
n sa thnh 5h15.

Bn vn khng hay bit th b tro g c. n lc c xong, 5h15 ra nh ngh th thy
thng c h v Linh tay trong tay dt nhau ra. (Thng H yu sinh l nn 15p l xong, cc bn
nn thng cm cho n).
Trong thc t, hacker c th thay i ni dung bn nhn c t server, lm thay i thng
tin hin th trn my bn. C 2 trng hp ny u kh nguy him v bn khng h bit mnh
b tn cng.
Kin thc ny thuc dng v cng c bn, nhiu ngi ni ri nn mnh s khng gii thch
k v kha cnh k thut. Cc bn c th t tm Google tm hiu them.
Cch phng chng

Cc gii php chng MITM trong mng LAN thng do SysAdmin hoc cc bn chuyn bo
mt lo, thng qua vic ci t thit lp h thng. L developer, cch phng chng c bn nht
chng ta c th lm l s dng giao thc HTTPS cho ng dng, bng cch thm SSL Certificate.
D liu giao tip qua HTTPS c m ho nn ngi ngoi khng th c trm hay chnh
sa c. Cch ny tng t nh vic bn v Linh vit mail cho nhau bng teencode, thng
Hong c h kia c c trm mail cng khng hiu hay sa th c.
Tuy bo mt ca HTTPS vn cha phi l tuyt i, n vn cao hn nhiu so vi ch dng
HTTP thun. Ngoi ra, nu trang web ca bn cha th tch hp https, bn c th tch hp
chc nng ng nhp thng qua Facebook, Google. Tuy hacker vn c th chm cookie ca
ngi dng, nhng t ra h khng b l username v password.
Lu
Hin ti nhiu trang web vn s dng https gi cy ch s dng https nhng trang login v nhng trang c d liu nhy cm. Cch lm ny vn tn ti kh nhiu nguy him. Hin
ti, mnh s dng Fiddler demo local. Tuy nhin, hacker c th lm cc tr ny khi dng
chung LAN/WLAN vi bn. Do , cn ht sc cn thn khi dng wifi cha/wifi cng cng nh.
V d 1 Lazada
Phn ng nhp ca trang ny dng https, do vy mnh khng th sniff c username,
password.
D liu truyn qua SSL b m ho nn khng th c ln c

Tuy nhin, cc trang khc ca lazada vn dng http. Khi ngi dng vo cc trang ny mnh
c th chm c cookie, s dng cookie ny ng nhp nh thng.
Dng Fiddler c ln cookie
Dng EditThisCookie dump cookie v ng nhp nh thng
Ngy xa, khi Facebook cha dng https, ti mnh cng dng cch ny sniff v ng nhp
account facebook ca ngi khc.

V d 2 Ngn hng ACB
Ln ny mnh s ly trang web ca Ngn hng ACB ra lm v d. Trang ny c s dng HTTPS
cho trang giao dch, nhng trang ch vn l HTTP.
Link ngn hng trc tuyn dn n online.acb.com.vn
Mnh c th sa packet dn ngi dng ti trang la o.
on code ny i ni dung HTML m client nhn c
ng link b nh tro m client khng hay bi t g
Mt s trng hp khc, trang web dng HTTPS nhng vn ti hnh nh, javascript, css qua
http. Hacker vn c th d dng sa ni dung javascript, trm cookie nh thng. Do ,
Google khuyn co s dng https cho ton b cc trang v cc link ch ng kiu gi cy
nh th ny nh.
Tng kt
Hin ti Chrome cng ang c k hoch th cc trang HTTP l khng an ton cnh bo cho
ngi dng. nhng phin bn sau, bn s thy ch Not secure trn thanh a ch nu
trang web ch s dng HTTP.
Hai iu quan trng nht v HTTP rt ra t bi vit:
HTTP khng an ton hay bo mt. Tuyt i khng bao gi submit thng tin quan trng
(mt khu, s th ngn hng) qua HTTP!
S dng http d duyt web cng ging nh nn gi m khng cn BCS. Nhiu khi dnh
bnh cht lc no chng bit y!
10
L HNG BO MT XSS NGUY HIM N

MC NO?
Gii thiu v XSS
XSS (Cross Site Scripting) l mt li bo mt cho php hacker nhng m c (javascript) vo
mt trang web khc. Hacker c th li dng m c ny deface trang web, ci keylog,
chim quyn iu khin ca ngi dng, d d ngi dng ti virus v my. Cc bn c th
xem thm demo trong v hack Lotte Cinema trc y.
y l mt trong nhng li bo mt thng gp nht trn cc trang Web. Cc h thng t ln
n nh nh Facebook, Twitter, mt s forum Vit Nam, u tng dnh phi li ny. Do
mc ph bin v nguy him ca n, XSS lun c vinh d c nm trong top 10 li
bo mt nghim trng nht trn OWASP (Open Web Application Security Project).
tm tt, xin trch dn vi cu ca thnh bo mt Juno_okyo, ngi va hack 3 triu ti

khon ca server X no .
" th nghe cng c v nguy him y, nhng sao ti thy ng hay vit v
XSS th? Rnh qu h!?"
... mt li va ph bin, nm top 10 OWASP, li va nguy him, c th kt
hp tt vi cc li khc. Nhng d tm, d fix, th cn c tnh bug
bounty na.
Nhng dng XSS

Trc y, XSS thng nhm vo code render HTML t pha Server, ta gi l Server XSS. Hai
dng Server XSS thng gp l Persistent XSS v Reflected XSS. y, mnh s ly mt thanh
nin tn Khoa ra lm v d. Khoa l mt sinh vin H FPT, l fan ca blog ti i code do, thch
ln thi*ndia tm a im mtxa.
1. Persistent XSS
Trn forum thi*ndia, khi bn post mt comment vo topic, server s lu comment bn post
v hin th di dng HTML. Khi Khoa post Em mun tm JAV, server s lu li v hin th
nh sau:
11
Tuy nhin, Khoa li khng hin lnh nh th. Do mi hc v XSS, Khoa khng nhp text m
nhp nguyn on script alert(XXX) vo khung comment. Lc ny, HTML ca trang web s
tr thnh:
Trnh duyt s chy on script ny, hin th ca s alert ln. Khoa chn c m c vo
thi*ndia, thc hin tn cng XSS thnh cng. (Lu : Mnh ch v d thi, thi*ndia khng b li
XSS u nh, cc bn khng nn th).
Trong kiu tn cng ny, m c c lu trong database trn server, hin th ra vi ton b
ngi dng, do ta gi n l Persistance XSS. Bt k ai thy comment ca Khoa u b dnh
m c ny, do kiu tn cng ny c tm nh hng ln, kh nguy him.
2. Reflected XSS
Vi cch tn cng ny, hacker chn m c vo URL di dng query string. Khi ngi dng
ngo ng nhp vo URL ny, trang web s c query string, render m c vo HTML v ngi
dng dnh by.
Quay li vi Khoa. Do xin a ch mt xa hoi nhng khng c share, Khoa cay c, quyt
nh tr th cc n anh. Khoa bn gi ng mt ng link gi JAV vo mail cc n anh.
Ni dung ng link: http://thi*ndia.com?q=<script>deleteAccount();</script>. Khi cc n
anh click link ny, h s vo trang thiendia. Sau server s render <script>deleteAccount();
</script>, gi hm deleteAccount trong JavaScript xo account ca h.
Tm nh hng ca ReflectedXSS khng rng bng Persistance XSS, nhng mc nguy him
l tng ng. Hacker thng gi link c m c qua email, tin nhn, v d d ngi
dng click vo. Do cc bn ng v ham JAV m click link by b nh,
3. Client XSS
Gn y, khi JavaScript dn c s dng nhiu hn, cc li Client XSS cng b li dng nhiu
hn. Do JavaScript c s dng x l DOM, m c c chn thng vo trong JavaScript.
12

Cc l hng dng ny kh tm v pht hin hn Server XSS nhiu (Xem v
d: http://kipalog.com/posts/To-da-hack-trang-SinhVienIT-net-nhu-the-nao).
Cch phng trnh

Tn ch ca series Bo mt nhp mn l: Hack hc, ch ng hc hack. Mc tiu ca
mnh khng phi l hng dn cc bn i hack v quy ph cc site khc, m l dy bn bit
v phng chng nhng n tn cng ny.
V XSS l mt dng tn cng hay gp, d gy hu qu cao nn hu nh cc Web Framework
ni ting (Spring, Django, ASP.NET MVC) u tch hp sn cch phng chng. D bn l dn
ngoi o, khng bit g v XSS, ch cn s dng framework bn mi nht l phng c
kha kh li ri.
Li XSS ny cng kh d fix, quan trng l li ny thng gp nhiu trang, d st, do sau
khi fix ta phi verify cn thn. C 3 phng php thng dng fix li ny:
1. Encoding
Khng c tin tng bt k th g ngi dng nhp vo!! Hy s dng hm encode c sn
trong ngn ng/framework chuyn cc k t < > thnh < %gt;.
13

2. Validation/Sanitize
Mt cch chng XSS khc l validation: loi b hon ton cc k t kh nghi trong input ca
ngi dng, hoc thng bo li nu trong input c cc k t ny.
Ngoi ra, nu mun cho php ngi dng nhp vo HTML, hy s dng cc th vin sanitize.
Cc th vin ny s lc cc th HTML, CSS, JS nguy him chng XSS. Ngi dng vn c th
s dng cc th <p>, <span>, <ul> trnh by vn bn.
Lm n, xin nhc li, lm n dng cc th vin sn c ch ng h bo vit li th hin
trnh . c rt nhiu trng hp dnh li XSS v developer t tin v t vit code loi b
k t c bit v st.
3. CSP (Content Security Policy)
Hin ti, ta c th dng chun CSP chng XSS. Vi CSP, trnh duyt ch chy JavaScript t
nhng domain c ch nh. Gi s thiendia.com c s dng CSP, ch chy JavaScript c
ngun gc thiendia.com. V Khoa m c trn khoatran.com nn on JavaScipt sau s
khng c thc thi.
s dng CSP, server ch cn thm header Content-Security-Policy vo mi response. Ni

dung header cha nhng domain m ta tin tng.
Li kt
Ni hi ch quan t (do mnh ko a PHP), s lng trang web xy dng bng PHP b li XSS l
nhiu nht. L do th nht l do s lng web vit bng PHP cc nhiu. L do th hai l mc
nh PHP khng encode cc k t l. Cc CMS ca PHP nh WordPress, Joomla rt mnh vi
v s plug-in. Tuy nhin nhiu plug-in vit u l nguyn nhn dn n li bo mt ny.
Hin ti, s lng website b li XSS l kh nhiu, cc bn ch cn lang thang trn mng l s
gp. Nh mnh ni, XSS l mt li rt c bn, hu nh hacker no cng bit. Trang web b
li ny rt d thnh mi ngon cho hacker. Do vy, cc bn developer nh cn thn, ng
web ca mnh b dnh li ny.
Mt s link tham kho:
http://excess-xss.com/
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
14
LU TR COOKIE TNG KHNG HI AI

NG HI KHNG TNG
Cookie l mt khi nim ht sc c bn m ta c hc khi mi lp trnh web. Tuy nhin, nu
s dng khng ng cch, n s thnh mi ngon cho v s hacker. Bi vit ny s cp
n nhng cch hacker m c th li dng cookie chim quyn ngi dng, tn cng h
thng, cng vi phng php s dng cookie ng cch ngn chn nhng l hng ny
nh.
Cookie Chic bnh qui v hi?

Server v client giao tip vi nhau thng qua giao thc HTTP. c im ca giao thc ny l
stateless. Server khng th bit c 2 request c ti t cng 1 client hay khng. V t im
ny, cookie ra i. V bn cht, cookie l mt file text nh c server gi v client, sau
browser lu vo my ngi dng. Khi client gi request ti server, n s gi km cookie.
Server da vo cookie ny nhn ra ngi dng.
Cookie thng c name, value, domain v expiration:
Name, i km vi value: Tn cookie v gi tr ca cookie

Domain: Domain m cookie c gi ln. Nh hnh di, cookies ch c gi khi
client truy cp wordpress.com.
Expiration: Thi gian cookie tn ti my client. Qu thi gian ny, cookie s b xo.
Bnh qui nho nh, y nhng l to to

Sau khi tm hiu c bn v cookie, ta s tm hiu nhng li bo mt m cookie c th gy ra
nh. V cookie c gi km theo mi request ln server. Server da theo cookie nhn
dng ngi dng. Do vy, nu c th chm cookie ca ngi khc, ta c th mo danh
ngi .
Cookie c th b chm theo cc con ng sau:
Sniff cookie qua mng: S dng 1 s tool n gin sniff nh Fiddler, Wireshark, ta c th
chm cookie ca ngi dng cng mng. Sau , s dng EditThisCookie dump cookie
ny vo trnh duyt mo danh ngi dng. (Xem demo phn HTTP).
15

Chm cookie (Cookie thief) bng XSS: Vi l hng XSS, hacker c th chy m c (JavaScript)
pha ngi dng. JS c th c gi tr t cookie vi hm document.cookie. Hacker c th gi
cookie ny ti server ca mnh. Cookie ny s c dng mo danh ngi dng.
Thc hin tn cng kiu CSRF (Cross-site request forgery). Hacker c th post mt link nh
nh sau:
<img src="http://bank.example.com/withdraw?account=bob&amount=1000000&for=mallory">
Trnh duyt s t ng load link trong nh, d nhin l c km theo cookie. ng link trong
nh s c cookie t request, xc nhn ngi dng, rt sch tin m ngi dng khng h
hay bit. Cch tn cng ny c rt nhiu bin th, mnh s ni r phn sau.
Cch phng chng

C th p dng mt s phng php sau:
Set Expired v Max-Age: gim thiu thit hi khi cookie b trm, ta khng nn
cookie sng qu lu. Nn set thi gian sng ca cookie trong khong 1 ngy ti 3
thng, tu theo yu cu ca application.
S dng Flag HTTP Only: Cookie c flag ny s khng th truy cp thng qua
hm document.cookie. Do , d web c b li XSS th hacker khng th nh cp c
n.
S dng Flag Secure: Cookie c flag ny ch c gi qua giao thc HTTPS, hacker s
khng th sniff c.
V cookie d b tn cng, tuyt i khng cha nhng thng tin quan trng trong cookie (Mt
khu, s ti khon, ). Nu bt buc phi lu th cn m ho cn thn.
Lu : Nu website ca bn s dng RESTful API, ng s dng cookie authorize ngi
dng m hy dng OAuth hoc WebToken. Token ny c vo Header ca mi request nn
s khng b dnh li CSRF.
Cc bn c th tm hiu thm v cookie v cc li bo mt lin quan y:
http://resources.infosecinstitute.com/securing-cookies-httponly-secure-flags/
http://www.ibm.com/support/knowledgecenter/SSZLC2_7.0.0/com.ibm.commerce.
admin.doc/concepts/csesmsession_mgmt.htm
https://www.nczonline.net/blog/2009/05/05/http-cookies-explained/
https://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly
http://programmers.stackexchange.com/questions/298973/rest-api-security-storedtoken-vs-jwt-vs-oauth
16
SQL INJECTION L HNG BO MT THN

THNH
Trong chng ny, cc bn s c tm hiu thc h v l hng bo mt SQL Injection thn
thnh, mt trong nhng l hng bo mt ph bin v nguy him nht mi thi i.
Ti sao SQL Injection li thn thnh?

Nhng l do sau to nn tn tui lng ly ca SQL Injection:
Cc k nguy him C th gy ra nhng thit hi khng l. Vi SQL Injection, hacker

c th truy cp mt phn hoc ton b d liu trong h thng.
Rt ph bin v d thc hin L hng ny rt ni ting, t developer n hacker gn
nh ai cng bit. Ngoi ra, cn c 1 s tool tn cng SQL Injection cho dn ngoi o,
nhng ngi khng bit g v lp trnh.
Rt nhiu ng ln tng b dnh Sony, Microsoft UK. Mi v lm xm lin quan ti l
d liu ngi dng t nhiu u dnh dng ti SQL Injection.
D tn cng, ph bin, gy ra hu qu nghim trng, l l d Inject (Khng ch SQL m OS

v LDAP) nm chm ch v tr u bng trong top 10 l hng bo mt ca OWASP. Tt nhin
l XSS, CSRF, v khng m ho d liu cng nm trong list ny nt.
Hu qu ca SQL Injection
Hu qu ln nht m SQL Injection gy ra l: Lm l d liu trong database. Tu vo tm quan
trng ca d liu m hu qu dao ng mc nh cho n v cng nghim trng. Nu l d
liu credit card, hacker c th dng credit card mua sm h hoc chm tin ca ngi
dng.
Hng triu Credit Card cha tn ti trn mng, do hacker chm t cc trang bn hng thng
qua SQL Injection. L d liu khch hng c th nh hng rt nghim trng n cng ty.
Hnh nh cng ty c th b nh hng, khch hng chuyn qua s dng dch v khc, dn n
ph sn vv
L hng ny cng nh hng ln n khch hng. Do h thng dng chung mt mt khu
cho nhiu ti khon, ch cn l mt khu mt ti khon th cc ti khon khc cng l theo.
y cng l l do mnh nhc nh phi m ho mt khu, nu database c b tn cng th ngi
17

dng cng khng b mt mt khu. (y l l do va ri vietnamwork b n chi v khng m
ho mt khu).
Trong nhiu trng hp, hacker khng ch c c d liu m cn c th chnh sa d liu.
Lc ny hacker c th ng nhp di vai tr admin, li dng h thng, hoc xo ton b d
liu h thng ngng hot ng.
Tn cng SQL Injection nh th no?

C ch SQL Injection v cng n gin. Ta thng s dng cu lnh SQL truy cp d liu.
Gi s, mun tm ng nhp user, ta thng vit code nh sau:
on code trn c thng tin nhp vo t user v cng chui thnh cu lnh SQL. thc
hin tn cng, Hacker c th thay i thng tin nhp vo, t thay i cu lnh SQL.
Hoc nu ght, hacker c th drop lun table Users, xo ton b ngi dng trong database.
ng s cha no?
n cc m bm sa cn bit cch dng SQL Injection
Hacker c th thng qua SQL Injection d tm cu trc d liu (Gm nhng table no, c
nhng column g), sau bt u khai thc d liu bng cch s dng cc cu lnh
nh UNION, SELECT TOP 1
Nh mnh ni SQL Injection rt ph bin, bn c th d dng google tm kim nhng
bi vit lin quan ti n. Do vy, mnh ch tm tt s v c ch tn cng. Cc bn t tm hiu
thm qua cc v d bi vit ny nh: http://expressmagazine.net/development/1512/tancong-kieu-sql-injection-va-cac-phong-chong-trong-aspnet.
Cch phng chng

May thay, mc d SQL rt nguy hi nhng cng d phng chng. Gn y, hu nh chng ta
t vit SQL thun m ton s dng ORM (Object-Relational Mapping) framework. Cc
framework web ny s t to cu lnh SQL nn hacker cng kh tn cng hn.
18

Tuy nhin, c rt nhiu site vn s dng SQL thun truy cp d liu. y chnh l mi ngon
cho hacker. bo v bn thn trc SQL Injection, ta c th thc hin cc bin php sau.
Lc d liu t ngi dng: Cch phng chng ny tng t nh XSS. Ta s dng filter
lc cc k t c bit (; ) hoc cc t kho (SELECT, UNION) do ngi dng nhp
vo. Nn s dng th vin/function c cung cp bi framework. Vit li t u va
tn thi gian va d s st.
Khng cng chui to SQL: S dng parameter thay v cng chui. Nu d liu
truyn vo khng hp php, SQL Engine s t ng bo li, ta khng cn dng code
check.
Khng hin th exception, message li: Hacker da vo message li tm ra cu trc
database. Khi c li, ta ch hin thng bo li ch ng hin th y thng tin v
li, trnh hacker li dng.
Phn quyn r rng trong DB: Nu ch truy cp d liu t mt s bng, hy to mt
account trong DB, gn quyn truy cp cho account ch ng dng account root
hay sa. Lc ny, d hacker c inject c sql cng khng th c d liu t cc bng
chnh, sa hay xo d liu.
Backup d liu thng xuyn: Cc c c cu cn tc v y ny. D liu phi thng
xuyn c backup nu c b hacker xo th ta vn c th khi phc c. Cn nu
c d liu backup cng b xo lun th chc mng bn, update CV ri tm cch chuyn
cng ty thi!
Kt lun
D liu l mt trong nhng th ng tin nht trong website ca bn. Sau khi c xong
chng ny, hy kim tra li xem trang ca mnh c th b tn cng SQL Injection hay khng,
sau p dng nhng phng php mnh hng dn fix.
Ngun tham kho thm
http://www.w3schools.com/sql/sql_injection.asp
http://expressmagazine.net/development/1512/tan-cong-kieu-sql-injection-va-cacphong-chong-trong-aspnet
http://freetuts.net/ky-thuat-tan-cong-sql-injection-va-cach-phong-chong-trong-php107.html
http://kienthucweb.net/sql-injection-la-gi.html
19
INSECURE DIRECT OBJECT REFERENCES

GIU U LI UI
chng ny, mnh s gii thiu mt l hng bo mt kh l mang ci tn di long ngong
kh c: Insecure Direct Object References.
Li g m tn di ra??
Li ny l ch n nm trong top 4 OWASP nhng li c rt t ti liu v n. N cng khng
ni ting nh XSS hay CSRF hay SQL Injection (D rank OWASP ca n cao hn XSS hay CSRF
nhiu). Bn thn mnh trc y cng cha h nghe bo ch hay tin tc g nhc ti li ny. C
th l do cha c v n ni ting no lin quan n n, hoc do li ny c nhiu bin th phc
tp chng?
Nguyn nhn chnh gy ra l hng ny l s bt cn ca developer hoc sysadmin (Gp li ny
l phi li thng dev ra chm trc, sau chm tester). L hng ny xy ra khi chng trnh
cho php ngi dng truy cp ti nguyn (d liu, file, th mc, database) mt cch bt hp
php, thng qua d liu do ngi dng cung cp. d hiu hn, hy c v d pha di
nh.
Cch li dng l hng

Rt tnh c, mnh pht hin li ny khi ang gip mt thng em test n web bn hng.
Trong mc Qun l n hng, URL ca mt n hng s c dng nh
sau: http://shop.com/user/order/1230. Server s c ID 1230 t URL, sau tm n hng c
ID 1230 trong database v d liu vo HTML.
Bt chc hacker, mnh nghch ngm mt t, thay 1230 bng cc gi tr t 1 ti 2000. H
thng c th m c v hin th cho mnh ton b cc n hng c ID t 1 ti 2000 (k c n
hng ca cc khch hng khc). Tai hi cha!
20

L hng y chnh l: chng trnh cho php mnh truy cp ti nguyn (n hng ca ngi
khc) bt hp php, thng qua d liu (ID) m mnh cung cp qua URL. L ra, chng trnh
phi check xem mnh c quyn truy cp cc d liu ny hay khng.
Trong thc t, hacker c th dng nhiu chiu tr nh: thay i URL, thay i param trong
API, s dng tool scan nhng ti nguyn khng c bo mt. Chiu hack lotte
cinema ngy xa ca mnh cng na n nh th, thay id trong URL bng username trong
cookie.
Cch y khong 1-2 thng, c 1 v lm xm lin quan ti cng ty X (Hnh nh l CGV), l ti
khon ca 3 triu ngi dng. Chnh l hng Insecure Direct Object References ny gip
hacker ( y l thnh bo mt Juno_okyo) li dng v d ra thng tin ca 3 triu ngi dng
.
(Bi vit gc kh hay y: https://junookyo.blogspot.com/2016/10/ro-ri-3-trieu-thong-tinca-nhan.html).

C mt vi v vic hi hu, hacker scan c git repository nm trn server. Truy cp git, hn
ly c username, password ca database v cc thng tin quan trng khc. Bn ng ngh
l mnh h cu. Cch y vi hm, git ca vietnamwork vn nm public chm ch ti
vietnamwork.com/.git/, khng bo mt g! May m gp hacker c tm i ngang qua nn
cha c g ng tic xy ra.
21
Cch phng chng

Mt s bin php phng chng:
Test cn thn Nguyn nhn gy ra li thng l do s bt cn ca developer. Tuy nhin, nu
sn phm b li th y l li ca tester. y l li nm trong code, do tester phi chu
trch nhim nu li ny xy n vi ngi dng.
Bo v d liu nhy cm Vi nhng d liu nhy cm nh source code, config, database
key, cn hn ch truy cp. Cch tt nht l ch cho php cc IP ni b truy cp cc d liu ny,
hacker khi ty my.
Kim tra cht ch quyn truy cp ca user Hy th xem tiki gii quyt vn ny nh th
no? n hng trn tiki.vn c dng: https://tiki.vn/sales/order/view?code=33598178
D thy, tiki id ca n hng trong URL. tuy nhin, khi mnh th thay i id ca n hng
th tiki redirect mnh li trang https://tiki.vn/sales/order/history. Bo mt c tm l phi nh
th!
Trnh l key ca i tng Trong cc trng hp nu, id ca i tng l s int, do
hacker c th on ra id ca cc i tng khc. Nhm phng trnh vit ny, ta c th m
ho id, dng GUID lm id. Hacker khng th no d ra ID ca i tng khc c.
Lotte Cinema gi m ho username trong cookie, kh i nghch ngm nh
Mt s ngun tham kho thm:
https://www.owasp.org/index.php/Top_10_2013-A4Insecure_Direct_Object_References
http://lockmedown.com/secure-from-insecure-direct-object-reference/
https://codedx.com/insecure-direct-object-references/
22
CSRF NHNG C LA NGON MC

Trong Tam Quc, cc bc qun s ti nng c ti iu binh khin tng, ngi trong trng
bng quyt thng cch hng ngn dm. Trong Tu Chn, cc cao th c chiu Cch Khng
Th Vt iu khin vt t xa, hoc Ng Kim Phi Hnh, dng chn kh iu ng phi
kim hay php bo.
Ngy nay, hacker cng c chiu thc tng t gi l CRSF. Hacker c th ngi ti website
A m d d ngi dng tn cng site B v site C khc. Chng ny s gii thch cch hacker
tn cng, ng thi hng dn cch phng chng cho cc bn lp trnh vin nh.
C bn v CSRF
CSRF c tn y l Cross Site Request Forgery (Tn khc l XSRF). L hng ny kh ph
bin, Netflix v Youtube cng tng l nn nhn ca l hng n. Hu qu do n gy ra cng
hi nghim trng nn CRSF hn hnh c nm trong top 10 l hng bo mt ca OWASP.
Nguyn tc hot ng ca CRSF rt n gin. bi trc, chng ta bit rng server s lu tr
cookie pha ngi dng phn bit ngi dng. Mi khi ngi dng gi mt request ti
mt domain no , cookie s c gi km theo.
u tin, ngi dng phi ng nhp vo trang mnh cn (Tm gi l trang A).
d d ngi dng, hacker s to ra mt trang web c.
Khi ngi dng truy cp vo web c ny, mt request s c gi n trang A m
hacker mun tn cng (thng qua form, img, ).
Do trong request ny c nh km cookie ca ngi dng, trang web A ch s nhm
rng y l request do ngi dng thc hin.
Hacker c th mo danh ngi dng lm cc hnh ng nh i mt khu, chuyn
tin, .
d hiu hn, bn hy c phn v d pha di nh.
Cc kiu tn cng thng gp

Kiu 1. Dng form
Ngy xa ngy xa, c hai anh em nh n tn l Tng v Tn. Tng, ngi anh, chm lo hc
hnh, ch th lm n nui v con. Ngi em, Tn th ngi li, sut ngy ln thin a share
hng v tm a im mt xa.
23

Mt hm n, ci nhau vi v, Tng bun qu mun b i mt xa. Tic thay, ln thiendia hi
a ch khng ai cho v Tng tn dng qu thp. Bit Tn l thnh vin cm cn, Tng bn
nn n Tn cho mn acc nhng v s anh h hng nn Tn khng cho. ng l anh em
tt!! Phn ch, Tng quyt nh dng li CSRF chm account ca Tn.
Ta hy quan st HTML ca form i mt khu thin a. Form ny gm 2 field
l password v password_confirm, submit ti http://thi*ndia.com/account/security-save
Tng lm gi mt trang web JAV, gi v gi cho thng em xu s. Trong trang web c mt

form n vi cc gi tr tng t form trn (Cc ng d*m vui lng form HTML bn tri v
button bn phi).
Thanh nin Tn ngy th m IT, l tay vo link v bm vo button. Mt request i password

c gi n thiendia, km theo cookie account ca Tn. Th l xong! Tng ch cn dng
email + mt khu mi l 123456 ng nhp vo account ca thng em xu s.
Kiu 2. Dng th img
Chuyn ti y cha ht. C a im mt xa, nhng tin bc do v nm c, Tng khng c
tin i mt xa. Tng quyt nh hack lun ti khon ngn hng ca Tn. Tn s dng
JAVBank (Japan America Vietnam Bank).
Mi ln chuyn khon, ngn hng s to 1 URL. Gi s ngi A mun chuyn 1000 cho ngi
B, url c to ra s c dng http://jav.bank?from=Person1&to=Person2&amount=1000.
24

Tng b url ny vo 1 th img. Khi Tn truy cp trang, trnh duyt s t gi GET request, gn
km vi cookie trn JAVBank ca Tng. Thng qua cookie, ngn hng xc nhn l Tn,
chuyn tin qua cho Tng.
C tin li c a im, Tng di v ln ng mt xa. Chuyn v sau c ni dung 18+ nn

mnh khng k na.
Lu
Tt nhin, trong bi ch l v d. Theo nguyn tc, request GET ch c dng truy cp d
liu, khng c dng thc hin cc hot ng thay i d liu nh edit/delete. Cc ngn
hng thng bo mt rt k bng cch set cookie c thi gian sng kh ngn, khng cho php
chuyn tin m khng c code OTP vv.
Ngoi ra, thi*ndia cng c cc bin php bo mt kh tt (xem pha di) nn cc bn khng
dng cch ny chm account ca bn b c u, ng th nh!
nh minh ho t thin a, trang ny c CSRF token
Tuy nhin, ngy xa, khi cc l hng bo mt cn cha ph bin th y l chnh l cch m
hacker s dng. Ch cn post 1 tm nh cha ng dn nh trn ln 1 forum no , s
c v s ngi dnh by khi truy cp vo forum .
25
Phng chng cho website

Di y l mt s cch phng chng CSRF c bn:
S dng CSRF Token: Trong mi form hay request, ta nh km mt CSRF token. Token
ny c to ra da theo session ca user. Khi gi v server, ta kim tra xc thc
ca session ny. Do token ny c to ngu nhin da theo session nn hacker
khng th lm gi c (Cc framework nh RoR, CodeIgniter, ASP.NET MVC u h
tr CSRF token).
Kim tra gi tr Referer v Origin trong header: Origin cho ta bit trang web gi
request ny. Gi tr ny c nh km trong mi request, hacker khng chnh sa
c. Kim tra gi tr ny, nu n l trang l th khng x l request.
Kim tra header X-Requested-With: Request cha header ny l request an ton, v
header ny ngn khng cho ta gi request n domain khc (chi tit).
Cn cn thn phng li XSS: Vi XSS, hacker c th ci m c trn chnh trang
web cn tn cng. Lc ny, mi phng php phng chng CSRF nh token,
referrer u b v hiu ho. Bn thn bc juno_okyo tng p dng li CSS kt hp
CSRF tn cng sinhvienit.net (Chi tit).
Tng kt
Ngy trc li ny kh nghim trng v ph bin. Gn y cc framework hu nh u mc
nh chng li ny nn tn sut gp cng t i. Tuy vy ta vn phi phng, nht l cc
website t code nh (c bit l code bng PHP, ahihi).
Ngoi ra, l mt user, bn cn bit t bo v mnh theo nhiu cch sau:
ng xut khi account sau khi s dng trnh lu cookie.

Khng click qung co hay button lung tung.
Khng gh thm cc trang by b, nguy him. Nh ni pha trn, nhiu khi ta khng
bm nt g, ch cn truy cp trang, trnh duyt cng t ng post da
trn javascript hoc th img. (Nu bt buc, hy s dng ch n danh trong
Chrome).
Ngun tham kho thm:
https://en.wikipedia.org/wiki/Cross-site_request_forgery
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
http://stackoverflow.com/questions/17478731/whats-the-point-of-the-x-requestedwith-header
https://www.youtube.com/watch?v=m0EHlfTgGUU
26
N GIU THNG TIN H THNG TRNH

CON MT NGI I V K XU
Chng ny cp ti mt phng php bo mt v cng n gin, hiu qu nhng li c
t ngi bit v p dng. l phng php: Giu thng tin h thng.
Thng tin h thng l g?

C th tm hiu thng tin h thng l nhng thng tin v cu to v hot ng ca h
thng . Ly lottecinema ra lm v d: Thng tin v hot ng l file log, error page hin th
khi b li. Thng tin v cu to ca trang ny nh sau (L do lm sao mnh bit c th cc
bn theo di phn sau):
Trang chnh s dng KenticoCMS. Phin bn s dng l ASP.NET WebForm 2.0

Theo d on th do dng ASP.NET nn database s l MS SQL Server
Trang web c s dng jQuery v jQueryUI
Trang web c deploy trn Server ISS7
Chc bn ang t hi: a, nu h thng ca mnh khng lm g m m th sao phi giu?

nh! Hy tng tng nh bn l tim vng c rt nhiu tin v vng bc. Liu bn c treo
bin Gc di hng ro c l hng, kt st nh tao lu 3, kt hiu Vit Tin, mt khu 4
ch s khng?
D nhin, bn khng bao gi thng tin nh ca h hnh cho n trm bit. iu ny ging
nh mi trm vo nh vy. Tuy nhin, a phn chng ta li h hnh thng tin h thng
cho hacker thy. Th c khc g mi hacker tn cng khng c ch!!
Chng ta thng tin h thng h hnh nh th no?

Chng ta thng l thng tin h thng mt cch rt h hnh, khng thua g cch em
Linh Miu khoe thn trong my b thiu vi (in hnh l v l vu ni nh ni m gn
y). Di y l mt s kiu l thng tin thng gp:
Hin th chnh nh trn trang s ngi khc khng nhn thy
27
Hin th r phin bn .NET, Exception khi b li. y l mi ngon cho tn cng SQL
Injection
trong header tr v t server
h hnh trong code
28

Tt c nhng thng tin ny u c th d dng truy ra bng buildwith.com. Trang ny hot
ng trn nguyn l c cc header tr v t server, xem HTML include cc th vin no.
Nhng hu qu ca vic l hng

Nhng thng tin v hi ny cng v tnh gip hacker tn cng h thng ca bn d
dng hn bng nhng cch sau:
Bit c phin bn th vin/framework s dng, phin bn server, phin bn

database, hacker c th tm ra l hng bo mt (CVE) ca h thng. Vic tra cu rt
d dng, ch cn vo nvd.nist.gov. Da theo phin bn framework/server/database,
hacker c th thy c nhng l hng bo mt ca cc phin bn ny. T cc l hng
ny, hacker c th tm cch tn cng h thng.
Ngoi ra, khi bit c framework ang s dng, hacker c th m ra ng dn ti
trang admin (Vi wordpress l /wp-admin, vi joomla l /administrator, vi
phpmyadmin l /phpmyadmin). Tip theo, hacker c th th nhp
username/password admin mc nh ng nhp vo h thng. ng s cha??
Vi mobile app hoc phn mm, hacker c th decompile chm API hoc security
key. Chng giu g cc bn, mnh cng tng decompile file API ca Simsimi ly Key
v API min ph gn vo chat bot facebook y
Giu nh th no cho ng?

Cnh gii cao nht ca vic giu hng l hacker khng th bit c h thng ca bn c
vit ngn ng/framework g, dng database g, deploy u. iu ny lm cng vic ca
hacker tr nn kh khn hn rt nhiu. Tht ra, vic giu thng tin h thng cng khng qu
kh khn hay mt thi gian. Ch cn bn v cn trng l c.
Mt s phng php giu thng tin hay dng:
Config server hoc vit code loi b nhng HTTP header d tha.
Khi deploy, ta obfustace hoc uglify code code tr nn kh c. trnh vic
hacker bit cc th vin JS s dng th ta c th bundle ton b th vin v code thnh
1 file lun.
Khi h thng b thng, hin th custom Error Page. Li trong trang ny nn gii thch r
rng cho ngi dng hiu. Nhng tuyt i khng hin th trc tip
error/exception trnh hacker tn cng.
Thng xuyn cp nht/nng cp framework ln phin bn mi nht v cc l
hng, trnh vic hacker li dng nhng l hng pht hin phin bn c.
29
QUN L NGI DNG TNG D N M

KHNG N GIN
Website c to ra l phc v ngi dng. C ngi s dng th website v doanh nghip
mi c thu nhp. Mt trong nhng vic rc ri nht chnh l qun l v bo mt thng tin
ngi dng.
Trong bi ny, mnh chia s nhng iu cn lu khi thc hin tnh nng ny. Kh nhiu kh
v phc tp y, cc bn chu kh c k nh!
i gii! ng k ng nhp c g kh?

Khng nh bn tng tng, vic ng k/ng nhp v qun l ngi dng tht ra khng h
n gin. N c th tr nn kh long ngong vi nhng tnh nng sau:
Cho php ngi dng ng k, ng nhp bng email

Phn quyn ngi dng
Tch hp vi Gmail, Facebook
Tch hp vi h thng ngi dng c sn trong doanh nghip
Reset mt khu khi ngi dng qun
Block account khi ngi dng nhp sai pass nhiu ln
Bo mt cho API vi app di ng
Bo mt 2 lp (Two factor authentication) vi cc account quan trng
Qun l: Thm bt xo sa ngi dng
Khi tnh nng ny hot ng n nh, khng ai khen n ly mt cu. Tuy nhin, ch cn n gp
phi cht vn , cam oan bn s hng chu v s cn thnh n t khch hng.
Quan trng nht Khng lu mt khu!

Developer phi thuc nm lng cu ni sau: Tuyt i khng bao gi lu mt khu khch
hng, d sp c ni g i na! L mt developer c tm, bn khng bao gi c lu mt khu
ca khch hng vo database (nhc li ln th ba cho nh).
30

n c web ln l vietnamwork m cng tc trch n mc khng dng https khi ng nhp,
khng bo mt d liu n ni lm l mt khu ca ngi dng:
http://nghenhinvietnam.vn/tin-tuc/web-tim-viec-vietnamwork-bi-tan-cong-23535.html. Hu
qu ca vic ny cng khng c g nghim trng, cng lm l mt mt cng ty, mt account
khch hng v lm khch hng chuyn qua dng dch v khc thi.
Lm th no khi ngi dng qun mt khu?

Do khng lu mt khu trong database, ta khng th gi mt khu v mail cho ngi dng
khi h qun mt khu. y ta c 2 cch gii quyt.
Cch 1: Reset mt khu mi ngu nhin ri gi cho ngi dng
Cch ny c th lm l mt khu v email c th b c trm. Ngoi ra, nu nh bit a ch
mail, hacker c th li dng n reset mt khu hng lot ngi dng, nhm ngn cn h
ng nhp vo h thng.
Cch 2: Gi link ngi dng reset
Da
theo
ti
khon,
ta
to
reset
token
ri
gn
n
link: http://shop.com/resetpass?token=32343, gi link ny vo mail cho ngi dng.
vo
Ngi dng s dng link ny reset mt khu. Vi cch ny, d hacker c request reset th
mt khu ngi dng vn gi nguyn, khng b nh hng. Nh ni pha trn, do email
khng an ton nn token ny nn c expired ngay sau khi dng, hoc sau 24-48 ting ng
h sau khi email c gi i.
Gi email c link Reset Password v cho ngi dng
Chng vic on m mt khu

d mt khu, hacker c th vit mt con bot, ln lt submit username v password cho
ti khi ng nhp c. phng trnh vic ny, ta p dng nhng phng php sau:
Khi ngi dng ng nhp sai, ng bo l sai username hay sai password. Ch cn
bo username hay password khng match, hacker s gp kh khn hn.
Hacker li dng chc nng reset mt khu d xem ngi dng c email trn trang
hay khng. D account c tn ti hay khng, ta vn ch hin thng bo: gi
message.
31
Hn ch s ln ng nhp khi nhp mt khu sai. V d sau 3 ln nhp pass sai th kho
account trong 10 pht. Hacker c th dng cch ny kho ti khon ngi dng,
nn cn thn. C th kt hp thm capcha.
Lu : Nhng cch cch ny c th gy kh chu cho ngi dng, nu d liu khng qu quan
trng (game, web hi p, giao lu, gii tr ) th c th ni lng mt s yu t.
Facebook tm kho ti khon khi hacker c tnh ng nhp nhiu ln
Nhng bin php nho nh tng cng bo mt

Mt s im cn lu khc:
Vi cc thao tc quan trng nh i email, i pass, xo nick, cn bt ngi dng nhp

li password. L do l i khi ngi dng b chm cookie, hoc l l qun kho
my. Hy nhn Facebook v Google, c 2 trang ny u bt ta phi nhp li mt
khu khi mun i pass.
Vi cc ng dng cn bo mt cao, phi c Two-factor verification (Gi tin nhn,
device to authentication token). Mnh hin ti cng ang dng n, d cc bn c bit
mt khu Gmail hay WordPress ca mnh cng o th no ng nhp c.
Nn khuyn khch (hoc bt buc) ngi dng s dng mt khu di, i km ch v
s, vit hoa vit thng v k t c bit. My mc rt hin i khi crack mt khu, c
th vo y test xem my mt bao lu m ra mt khu ca bn.
Nu site ca bn khng c HTTPS, hoc team khng c kinh nghim lm bo mt, c
cho bn khc lo. Bn c th dng OAuth, cho php ngi dng ng nhp t
Google, Facebook.
Lc ny Google, Facebook s chu trch nhim qun l mt khu v d liu ca ngi
dng. Ngi dng th khng cn phi ng k nhiu ti khon, mt cng i vic. Tm
hiu thm ti https://oauth.io/ hoc https://auth0.com/.
32
PHN 2 CASE STUDY

Mt s li bo mt ca cc trang web ln ti Vit Nam
33
L HNG BO MT KHNG KHIP CA

LOTTE CINEMA
ng nhp l mt chc nng n gin nht m hn 90% cc ng dng web cn phi c. Tuy
nhin, i khi ta li khng c hng dn cch thc hin chc nng ng nhp mt cch
ng n, bi bn, dn n nhng li d khc d ci, hoc nhng l hng bo mt khng
khip. n c Lotte Cinema, mt trang web c kh nhiu ngi dng cn mc li s ng
ny.
ng nhp h? Ch cn mt bng User, hai ct Username v Password l xong

K cng bun ci. Ngy xa khi i hc, mnh c hng dn cch lm chc nng ng
nhp nh th ny:
1. Ngi dng nhp tn ti khon (email) v mt khu.
2. So snh tn ti khon v mt khu vi thng tin trong database.
3. Nu ng, cho ngi dng ng nhp, lu thng tin vo session hoc cookies.
Bc 1 v 3 khng c g ng bn, nhng bc 2 mi l iu ng ni. a phn ti mnh
u lu trc tip tn ti khon v mt khu vo database, sau em ra so snh.
y l cch c chui nht v ngu nht. Database l mt trong nhng ni hay b tn cng, d
lm tht thot d liu. Trong qu kh, li SQL Injection tng lm tht thot hng triu thng
tin khch hng v thng tin credit card. Cha tnh n chuyn hacker bn ngoi, nhiu khi
thng Database Admin hng ln, n c th m c mt khu ca khch hng, ln chuyn
cha?
Cch lu tr mt khu ng phi l lm sao ch ngi dng mi bit c mt khu ca
h. Lm sao ? Hy c phn di nh.
Vy m ha l c ch g, lm tr!!
, cch gii quyt cng kh n gin. Bn c th dng hm hash m ha mt khu nh
sau:
1. S dng hm hash (hm bm) m ha mt khu ca ngi dng.
2. Lu tr mt khu ny di database.
3. Khi ngi dng ng nhp, hash mt khu nhp, so snh vi mt khu lu di
database.
Hm hash ny phi l hm hash mt chiu, khng th da theo mt khu hash suy
ngc ra u vo.
34
Cch ny m bo ch ngi dng bit mt khu ca h, d l lp trnh vin hay database

admin, c nm c c code ln database cng khng ti no m ra mt khu. Tuy nhin,
cch ny c mt vn : Hai mt khu ging nhau khi hash s c kt qu ging nhau. Hacker
c th m ra mt khu bng cch dng dictionary attack hash ton b cc mt khu c th
trong t in, ri so snh kt qu vi mt khu hash di database.
Th nhng, v qut dy c mng tay nhn. y l cch lu tr mt khu ng m hin nay
cc framework u p dng:
1.
2.
3.
4.
Khi to mt khu, to random mt chui k t gi l salt.

Salt s c cng vo sau mt khu, ton b chui mt khu v salt s b bm (hash).
Lu salt v gi tr bm xung database (Mt ngi dng s c 1 salt ring).
Khi ngi dng ng nhp, ly salt ca ngi dng, cng n vi mt khu h nhp
vo, hash ra ri so vi gi tr trong database.
Vi cch ny, khi ngi dng qun mt khu, h thng khng ti no m ra mt khu gi
cho h. Cch gii quyt duy nht l reset mt khu, random ra mt mt khu mi ri gi cho
ngi dng.
i gii phc tp th, cng lm th l password trn trang ca mnh thi m

Ni nh mt b mt (m chc ai cng bit) cho cc bn nghe n: Hu nh ngi dng ch s
dng 1 username/mt khu duy nht cho ton b cc ti khon trn mng. Nu hacker tm
c mt khu t trang ca bn, chng s th vi cc account facebook, gmail, ti khon
ngn hng, ca ngi .
35

Mt 1 account l xem nh mt sch snh sanh. Kinh khng cha! Khng tin , bn th ngm
li xem, bn c dng chung 1 email/mt khu cho Gmail, Facebook, Evernote, v nhiu
trang khc khng?
L hng bo mt khng khip ca Lotte Cinema

Mt ngy p tri n, mnh nh dn gu i xem phim, n ung ri *beep*. nh t v online
m qun mt mt khu lottecinema.com, mnh m mm phn ng nhp, tm hoi mi thy
mc Qun mt khu. Nhp a ch mail v chng minh nhn dn, mnh mau chng nhn
c mt email gi t lottecinema, trong c c username v mt khu ca mnh.
Tht l tin qu i mt, khi phi reset mt khu. Khoan, c ci g sai sai y!! Vy l bn
lotte lu thng mt khu ca mnh thng di database . L database b tht thot d liu
l ton b cc ti khon khc ca mnh (V cc thnh vin lotte cinema khc) cng i tong
theo.
Tht l ng s!! Li ny mnh pht hin nm ngoi, n cch y my ngy vn cn y nguyn.
Th mi bit b phn IT ca lottecinema gii giang th no. Cc bn c ti khon lotte cinema
th nh cn thn nghe.
36
TI A HACK TI TA WEB SITE CUA

LOTTE CINEMA NH TH NAO?
Lam m t developer co tm, chu ng ta khng chi phai am bao code chay c, ma co n phai
bao am v bao mt (v i cac h thng quan tro ng). Co nhiu lu c, li bao mt n t chi nh s
u ta cua developer. Trong chng ny minh se li trang web ca Lotte Cinema ra la m mu
giai thi ch cho cac ban.

Lu y: Bai vit mang ti nh cht ho c thut, binh lun v ki thut. Minh khng ung h , cu ng
khng chi u trach nhim nu ban mang kin th c cp trong ba i ra la m chuyn trai phap
lut! Thn.
Gi i thi u
,
Tai sao minh lai cho n Lotte Cinema? n gian la cach y my thang, khi nhc n mt khu
minh a nu ra m t l hng bao mt khu ng khip cua Lotte Cinema: Lu mt khu d i dang
text.
n nay, l hng na y vn cha c s a, iu na y ch ng to hai chuyn: i ngu lp trinh
web lotte cinema thiu kin th c c ban v lp trinh va cu ng khng the m quan tm gi n
vic bao tri s a li. iu ny ng ngha vi vic website s c nhiu l hng khai thc.
Vi logic , minh bt u tim l hng cu a lotte v i tm th ho c hoi. Tht khng ng , minh
tim c khng chi mt, ma n tn va i l hng c c ki cht ng i, co th la m toa n b h
thng ng ng hoat ng.
Bt u cu ca
u tin, hay nhin go c trn bn trai trinh duyt. M t website khng co https, ng nghi a v i
vic toan b thng tin ban in vao (username, password) hoa n toa n co th bi hacker
tr m nu ban du ng chung ng dy mang/chung wifi v i hacker o (Xem thm v sniffing).
o la ly do cac trang ngn hang, facebook, gmail, thanh toan in t u o i ho i phai
du ng https.
Tip theo, ta bt u v i vic kim tra cookie. Cac ban tai addon EditThisCookie v la m
vic nhe. Th ng nhp va xem lotte cinema lu gi trong cookie na o.
37
Cac ban khng nhin lm u, chi nh la username cu a cac ban y? Thi, chu ng ta c cu tr i
la ho lu username nhc ban khi ban cn ng nhp lai thui ha. Th i sang gia tri khac
ri refresh trang xem no.
CA I L GI THN!!! Minh bi chuyn sang nick khac mt ri. Tht khng th tin ni. Mt li bao
mt to nh banh xe bo a bi l chi sau 5p nghin c u. 1-0 cho Lotte Cinema. (Li ny c tn
gi l impersonation).
38
Cu nhm ca mp
Nh i cookie, minh a hack c vao ta i khoan ng i khac. Ok ngon, co thng tin ng i
du ng lun! Gi minh th i thng tin xem nao, c lun. Th t ve xem na o, cu ng c
nt!
cho minh khng nh? Th xem na o, i email ca

Co th du d Lotte Cinema g i mt khu
. Va o email xem sao?
user ny sang sang email minh, sau o bao mt mt khu
, nhn c mt khu hin ti lun, mail ca Lotte nhanh tht! Vi m t user th ng tai s
nhiu trang, minh co th th dng username va mt khu na y m t s
du ng mt khu
trang khac m account. Thy cht ng i cha??
Th i mt khu hin ti xem, c lun. Gi minh a co th ng nhp v i mt khu m i
i. y la li th 2: Khi thay i mt khu, bt bu c ng i du ng phai i mt khu cu . Ti s
gi a la 2-0 cho Lotte Cinema.
Bonus thm ca voi

Hai li trn u lam ti ta toan b h thng. Chi cn vit mt con bot nho nho , ln l t thay
gia tri membername trong cookie (t a t i zzzzzzz) la co th ly gn nh toan b thng tin
khach hang, hoc i ton b password lm ngi dng khng ng nhp c. (Cc bn
khc dng username di qu th chu).
Th nhng mo i chuyn cha d ng y. Minh tip tu c th nghim in tin va o khung H
tn. Lotte tip tc lo i ra li XSS (Tn cng bng cch chn script vo trang chnh).
39
Kha may mn Lotte la a ct chui thanh 30 ki t nn khng th in JavaScript da i. Tuy nhin,

iu ny vn khng th lam kho c minh khi vit file javascript ni khac, sau o embed
script vao (Up file js ln dropbox ri ly shortlink la xong).
40

Li XSS nay chi hin ra mi trang cu a user nn khng th du ng deface website. Tuy nhin,
minh vn co th hin pop-up gia mao ng i du ng tai virus nh hinh d i. Dng JS, mnh c
th ly s th, s CMND ngi dng tin tng rng message l ca lotte.
Kt h p vi con bot a no i phi a trn, minh hoan toan co th du d rt nhiu ng i du ng

Lotte tai virus khi ho ng nhp vao h thng. Khng co n l i na o noi, 3-0 cho Lotte Cinema!
Kt lun
Nh ng li bao mt minh chi ra khng co gi cao siu! Do minh khng phai dn chuyn v bao
cu a
mt nn nh ng ki thut tn cng cu a minh cu ng chi dng m c v cu ng c ban. Vn
Lotte Cinema la ch ho khng bit ti gi v bao mt, dn n chuyn h thng bao mt qua
kem.
Nh cac ban a thy, hanh vi nay la s thiu tn tro ng khach ha ng v co n co th gy nguy hai
cho ng i du ng. Tuy nhin, co ve Lotte Cinema a rt khn ngoan trong khu phap ly khi ru
bo mo i trach nhim trong phn Tho a Thun. Tuy thua 3-0 nhng vn khng phai chi u trach
nhim gi, hoan h Lotte Cinema.
Vi ly do ao c, minh a g i n i dung ba i vit cho nh ng ng i co trach nhim trn Lotte

Cinema m t khoang th i gian kha lu tr c khi cng b. Tuy vy, ho vn la m ng va khng
the m quan tm. RIP cac ban va cac khach ha ng cua Lotte Cinema. Du vy, minh vn khuyn
cac ban khng nn th pha hoai h thng. Minh khng mun nga y mai ln Mng 14 lai thy
tin: [Hacker tre tui bi Lotte Cinema bt . Tt ca la do em l xem Ti i code dao] u.
41

L i khuyn cui cu ng: cac ban vn co th xem phim Lotte, nhng ng in bt ki thng tin
ca nhn gi vao cai h thng tr i anh cua no nhe! Thn chao.
Cc
bn
c
th
xem
video
tm
tt
bi
vit
y:
https://www.youtube.com/watch?v=CtnfOZmKR3A. Nh like v subscribe trong link ny
nh: https://www.youtube.com/c/toidicodedaoblog?sub_confirmation=1. Mnh ang cn
100 sub xin Custom URL cho Channel Ti i Code do.
Update (30/08/2016)
Sau khi bai vit c cng b r ng rai trn MXH thi bn chi u trach nhim xy d ng website
cho Lotte Cinema a lin h tr c tip v i minh minh. n nga y 1/9/2016 thi cac li bao mt
trong bai a tam c fix ri nhe.
42
43
LOZI.VN V L D LIU 2 TRIU

NGI DNG NH TH NO?
Trong qu trnh vit series Bo mt nhp mn, mnh vn hay i nghch do, tm li bo mt
do theo tinh thn code do ca blog. L tt nhin, tm li th phi tm cc trang to to,
nhiu ngi dng mt t, ch trang nho nh th ai quan tm.
L developer, mnh khng gii v mng hay h tng c th tn cng server hay DDOS g
g . V vy, mnh quyt nh ch kim tra web v app, hai th mnh rnh nht. Vit Nam ni
l lm, mnh bt u truy cp website ca app ca 1 s ng ln nh tiki, lazada, foody.
Vic d li cng ging nh cu c vy, i khi cu c c b, i khi cu c bui khng c

con no. K ny, mnh cu c mt con c nho nh m nguy him ca lozi.vn.
D tm t web
Khi vo giao din lozi.vn, p vo mt mnh l li b nht: khng c HTTPS! Ni n gin, lt
web c thng tin quan trng m khng c HTTP cng ging nh cc bn i mt xa, nhm, i
chch m khng dng BCS vy. Hacker c th chm d liu ca bn trong nhy mt khi bn
khng hay bit g. (Xem thm v bo mt ca giao thc HTTP).
Tip theo, mnh bt u nghch ngm bng cch m Chrome Developer Tool. ng coi
thng n nh, cng c ny b o lm y. Ch, th xem ta c g no?
Mnh bit mnh p trai, nhng cc bn ng nhn mnh m hy nhn vng khoanh
44

Mt lot hm AJAX dng get, truyn vo username v ly thng tin user. c bit hn, trong
JSON hm ny tr v bao gm c thng tin nhy cm nh a ch c nhn, ngy thng nm
sinh, e-mail.
Hm GET ny khng c authentication, nn mnh hon ton c th ln lt thay username
vo v ly thng tin ca ton b user. Tuy nhin, vic test ln lt tng username kh lu,
nn cch ny khng kh thi lm.
Lm sao tip tc? Mnh bt u chuyn qua nghch ng dng mobile ca lozi.
n app mobile
C mt s tht nho nh m t bn bit l: Mc d mnh hay vit bi v C# v JavaScript
nhng tht ra mnh cng kh rnh Java v Android y nh. Thi khng khoe na, quay li
ch chnh no. Vic nghch ng dng cng khng qu phc tp. Mnh ch cn
ln apkpure.com ti file apk, sau dng tool decompile l c source code ng dng
android ca lozi ri.
C v lc publish, team lozi cha obfuscate code nn code vn y nguyn. Do team code rt
ng chun OOP v SOLID nn cng khng qu kh khn mnh lc tm on code gi API
ca lozi. on code khin mnh ch chnh l on gi API SearchUser.
45

API ny c dng GET nn mnh khng cn thm thng tin g. Bt Postman ln, nhp url ca
API vo v bingo. Thng tin 2 triu ngi dng y ri.
C c link paging nh
Bao gm cc thng tin nhy cm nh email, s in thoi, ngy sinh
46
Qu trnh x l li
Ti th 4 ngy 16/11, mnh tm ra li ny, bt u lin h vi lozi.vn.
Chiu th 6 ngy 18/11, mnh nhn c reply t fanpage ca lozi. Khong 5 pht sau khi
mnh gi mail cho team lozi th li c fix ngay lp tc.
Ngay sng th 7 ngy 19/11, mnh nhn c mail reply rt tn tnh ca ngi chu trch
nhim d ang l th 7. Hoan h lozi. Thi lm vic khc hn vi bn lotte cinema, b
mnh hn na thng tri.
Khong 4,5 ngy sau khi mnh bo co li th lozi cng cp nht https v thm token cho
cc API ri nh.
Nhn xt
Trong suy ngh chung ca developer, cc RestAPI ny thng b n i, ngi dng khng
thy nn khng th nghch c. Tic thay, developer v hacker c th d dng decompiler
app v nghch ngm cc API ny.
Tht ra, khng ch c team lozi m a phn cc team khc cng kh thiu cnh gic v vic
bo mt API. in hnh l v CGV l 3 triu ngi dng cng do API mobile. Tuy nhin, team
Foody v Lozi bo mt API kh tt, mnh nghch th m khng thu c kt qu g.
47

iu ng ni qua s vic ny l: cc l hng bo mt ny thuc loi v cng c bn, mnh l
dn tay ngang c th khai thc m khng cn tool chuyn dng (Kali Linux, Tool Penetration
Test), ch cn Chrome v SublimeText.
Cc h thng ln m i khi cn lng lo kiu ny, liu d liu ca chng ta c an ton khi cc
hacker chuyn nghip ra tay??
Vi ci tm ca ngi developer, mnh lin lc ngay vi bn lozi x l. iu g s xy ra
nu ngi tm ra li ny khng phi l mnh m l mt hacker c tm, sn sng co ht d
liu v ri chia s hoc bn cho cc cng ty khc, hoc cc cng ty i th cnh tranh vi lozi?
48
Thay li kt
y cng l phn cui cng ca cun sch. Chn thnh cm n cc bn b thi gian c v
ng h!
Mt iu mnh s nhc i nhc li trong sut series l: ng bao gi tin tng ngi dng!!
ng bao gi tin tng nhng th ngi dng nhp vo, ng ngh ng ngi dng khng
bit sa javascript, khng bit nghch lung tung. Di danh ngha ngi dng, hacker c
mi phng cch tn cng h thng. Nh y nh!
Vic post bi ca mnh cng ch mang tnh cht v cnh tnh ch khng c khoe khoang hy
g khc. Vi cc hacker "c tm", h phi ln k hoch tn cng, hoc phi tn cng sc nghin
cu tm c l hng cha ai tm ra. Hnh ng ca mnh ch l i my m, nghch ngm
cc li s ng ca developer, tnh ra cng chng c g t ho phi khoe c ;)). Bt k mt
hnh ng tn cng, ph hoi h thng no nhm "th hin" u l nhng hnh ng tr
tru, thiu suy ngh, c th dn n "tnh tin t ti". Cc bn nh suy ngh cn thn trc khi
hnh ng.
Mnh ch c mt hi vng nh nhoi l cun ebook ny c nhiu ngi bit ti hn. Nu
lp trnh vin no cng bit nhng li bo mt c bn th ny, ta s khng phi gp nhng l
hng ng ngn kiu lottecinema hay vietnamwork na. Cng gip mnh chia s n ti nhiu
bn c hn nh!
Hy nh rng, bo mt l mt chuyn ngnh rt ln, th gii bo mt rt bao la. Nhng li
bo mt mi xut hin tng ngy, khng thua g cng ngh mi trong lp trnh. Quyn ebook
nhp mn ny ch cover c mt phn rt nh trong y (Cn v s iu hay ho nh: social
engineering, row hammering khng c nhc ti trong sch). Do vy, ng ngh rng c
xong series l mnh bit tut tun tut nhng iu cn bit v bo mt. Hy t trau di
thm kin thc bo mt, p dng vo code v thit k nh.
Ni dung sch tham kho theo course Hack Yourself First, Web Security OWASP Top 10 trn
pluralsight v mt s ngun khc. Series ny c ph nn kh d hc, cc bn kh ting Anh
c th hc th.
49
V tc gi
Anh Phm Huy Hong hin ang theo hc ti Thc s v Khoa
Hc My Tnh (Computer Science) ti i hc Lancaster, Anh. Ti
Anh, Hong cng lm Full-stack Developer cho trng. Anh tng
pht hin v cng b l hng bo mt ca Lotte Cinema v
Lozi.vn
Hong cng l ch blog Ti i Code Do kh ni ting ti Vit
Nam. Anh c hn 4 nm kinh nghim trong lnh vc phn mm
v rt am m nghin cu v bo mt, cng ngh web, cc cng
ngh mi nh Machine Learning, Cognitive.
Gii thiu sch mi

Trong thi gian sp ti, mnh d nh s xut bn mt cun sch
mang tn: Code do k s - Lp trnh vin u phi ch bit code.
Sch vit v nhng k nng mm v cng m lp trnh vin no
cng cn bit, di khong 200-250 trang.
Liu bn c th b cht thi gian cho vo link ny v cho mnh
cht
nhn
xt
v
sch
c
khng:
https://goo.gl/forms/z56ptOE7RZXL6cFU2. Cc bn s c
hng c mt s u i nho nh (gim gi, k tng, v...v) khi
sch ra mt y.
Thng tin lin lc:

Email: huyhoang8a5@gmail.com
Blog: https://toidicodedao.com
Linkedin: https://www.linkedin.com/in/huyhoangpham92
CV: http://cv.toidicodedao.com
50

Bao Mat Nhap Mon

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Bao Mat Nhap Mon

Hochgeladen von

Copyright:

Verfügbare Formate

Bn quyn ti toidicodedao.

Bn mt nhp mn Phm Huy Hong

Bo mt nhp mn Phm Huy Hong

PHN 1 BO MT NHP MN .................................................................... 4

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

PHN 2 CASE STUDY.................................................................................. 33

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

GIAO THC HTTP BO MT N MC NO?

Search Linh pht n ra con b Linh l clip 18+ lun.

Thng Hong c h c th ph ri bn bng nhng cch sau:

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Cch phng chng

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

D liu truyn qua SSL b m ho nn khng th c ln c

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Dng Fiddler c ln cookie

Dng EditThisCookie dump cookie v ng nhp nh thng

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Link ngn hng trc tuyn dn n online.acb.com.vn

Mnh c th sa packet dn ngi dng ti trang la o.

on code ny i ni dung HTML m client nhn c

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

ng link b nh tro m client khng hay bi t g

Hai iu quan trng nht v HTTP rt ra t bi vit:

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

L HNG BO MT XSS NGUY HIM N

tm tt, xin trch dn vi cu ca thnh bo mt Juno_okyo, ngi va hack 3 triu ti

Nhng dng XSS

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Cch phng trnh

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

s dng CSP, server ch cn thm header Content-Security-Policy vo mi response. Ni

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

LU TR COOKIE TNG KHNG HI AI

Cookie Chic bnh qui v hi?

Name, i km vi value: Tn cookie v gi tr ca cookie

Bnh qui nho nh, y nhng l to to

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Cch phng chng

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

SQL INJECTION L HNG BO MT THN

Ti sao SQL Injection li thn thnh?

Cc k nguy him C th gy ra nhng thit hi khng l. Vi SQL Injection, hacker

D tn cng, ph bin, gy ra hu qu nghim trng, l l d Inject (Khng ch SQL m OS

Bn quyn thuc v http://toidicodedao.com/

Bo mt nhp mn Phm Huy Hong

Tn cng SQL Injection nh th no?