摘要
Cenzic於《2009年1～2季度web應用安全趨勢報告》中評估，9成的網頁應用程式皆有資料外洩、跨站攻擊等弱點，並指出，2009年上半年發現3,100多個安全弱點，其中有78％屬於網頁應用程式弱點，較2008年下半年發現的弱點數量增加了10%以上。依目前網頁應用程式安全現況，一旦遭惡意攻擊，必然造成影響，而事後處理，往往可能造成資訊外洩等嚴重損害。因此本研究針對淡江大學網頁應用程式，透過弱點掃瞄工具偵測應用程式潛在之弱點後，以駭客角度進行入侵滲透測試，驗證弱點是否確實存在或存在其它潛在弱點，最後彙總出11種攻擊手法，以供網頁應用程式維護者檢測參考之用。瞭解網頁應用程式安全現況，以事前洞悉網頁應用程式潛在之弱點。研究發現，淡江大學之網頁應用程式弱點分佈為：資訊揭露與不適當的錯誤處置，佔23.26％；不安全的物件參考，佔15.95％；疏於限制URL存取，佔14.95％及其他，佔45.84％，而入侵滲透測試結果，實際造成瀏覽者、後端資料庫、管理者等密碼遭竊取與網頁資料遭修改之嚴重威脅，佔21.05％，共取得3個網頁應用程式之相關重要帳號、密碼；修改5個網頁應用程式內容。期望透過網頁應用程式弱點分析及11種攻擊手法，供網頁應用程式維護者及未來開發者較駭客早一步發現問題。
並列摘要
Cenzic's ”Web Application Security Trends Report Q1-Q2, 2009” point to the 90 percent of Web applications include data leakage, cross-site attacks, and that the first half of 2009 found that the total number of reported vulnerabilities went up to almost 3100, and the percentage of Web vulnerabilities continued to be dominate at around 78 percent, compared with the weaknesses found in the second half of 2008 increased by 10%. According to the present status of web application security, once the malicious attacks, the post-processing, often cause serious damage. For the reason above, we study Tamkang University web application vulnerability, through scanning tools to detect the potential weakness of web application. The final summary of the 11 methods of attack for testing web applications. Study web application security condition in order to insight into the potential vulnerabilities of web application. Found, Tamkang University of distribution of Web applications vulnerabilities: Information leakage and improper error handling 23.26%; Insecure direct object reference 15.95%; Failure to restrict URL access 14.95% and other 45.84%. The test results, the actual cause viewers, back-end database, administrator password was stolen and other information was to edit, about 21.05%. Stole three important web applications related account and password; modify the content of 5 web applications. Hoped that through the web application vulnerability analysis, and 11 kinds of methods of attack for the defenders and future web applications developers find problems far earlier than the hackers.