Makina osakira adapangidwa kuti alembe zomwe zili mkati. Komabe, owukira amagwiritsa ntchito kuti alembe zolakwika zanu. Funsoli ndilakuti mawu onse:login mtundu wa fayilo:log zingawoneke ngati zopanda vuto. Zoona zake n'zakuti, ndi njira imodzi yosavuta yopezera mafayilo obisika okhala ndi njira zotsimikizira, ziphaso, ma tokeni, ndi deta ya zomangamanga zamkati.
Ngati Google ingathe kuona zolemba zimenezo, owukira nawonso angathe kuziona. Akaziika pa index, kuziona kumakhala kosapeweka. Komanso, pamene ziyeneretso zikuwonekera mu fayilo yomwe anthu ambiri angapeze, kuphwanya malamulo kumayamba kale.
1. Chifukwa chiyani allintext:login filetype:log Ndi Yoopsa Kwambiri Kuposa Momwe Imawonekera
Google dork ndi funso lofufuzira lomwe limagwiritsa ntchito ma operators apamwamba kuti apeze zinthu zachinsinsi kapena zosasinthika bwino zomwe zalembedwa ndi injini zosakira. Sizimapezerapo mwayi pa Google. M'malo mwake, zimapezerapo mwayi pa zomwe mukuwona.
Funso ili limaphatikiza ogwira ntchito awiri:
- mawu onse: imabwezeretsa masamba omwe mawu onse amawonekera m'malemba a thupi
- mtundu wa fayilo:log amaletsa zotsatira ku
.logowona
Choncho:
Kutanthauza: “Ndiwonetseni mafayilo a log omwe ali ndi mawu login. "
Poyamba, zimenezo zimaoneka ngati zazing'ono. Komabe, m'zochita zake, nthawi zambiri zimabwereranso:
- Zolemba za seva ya pa intaneti zomwe zawonetsedwa poyera
- CI/CD zolemba zomwe zakwezedwa ngati zinthu zakale
- Kukonza zolakwika mwangozi commitkusungidwa m'malo osungiramo zinthu
- Zolemba za mapulogalamu okhala ndi zitsimikizo zosamveka bwino
Iyi si vuto la injini yosakira. M'malo mwake, ndi vuto kufooka kwa chidziwitso cha deta chifukwa cha kusasinthika bwino. Google inangolemba zomwe zinali zopezeka kwa anthu onse.
2. Zimene Oukira Amapezadi Mu Mafayilo Obisika
Pamene owukira akuthawa mawu onse:login mtundu wa fayilo:log, sakufufuza mwachisawawa. Akuyang'ana zizindikiro zotsimikizira.
2.1 Ziphaso Zosavuta
Zolemba nthawi zambiri zimakhala ndi zolemba monga:
or
Kapena ngakhale ziyeneretso za SMTP:
Kulemba zolemba zotsimikizira ndi njira imodzi yachangu kwambiri yodziwitsira ziphaso zopanga. Chifukwa chake, fayilo imodzi yowonekera ikhoza kusokoneza mtundu wanu wonse wowongolera mwayi.
2.2 Ma Session Token ndi ma JWT
Ngakhale mawu achinsinsi sanalembedwe, nthawi zambiri zizindikiro zimalembedwa.
Mwachitsanzo:
Cookie yovomerezeka ya JWT kapena gawo mkati mwa .log fayilo ikhoza kuyatsa:
- Kubera gawo
- Kukula kwa mwayi
- Kusuntha kwa mbali zonse m'machitidwe amkati
Mwa kuyankhula kwina, zizindikiro zomwe zili mu logs zimasandutsa zotsatira za debugging kukhala vector yotsimikizira.
2.3 CI/CD Zojambulajambula
Mitengo yomangira nyumba ndi yoopsa kwambiri. Ndipotu, CI/CD machitidwe nthawi zambiri amasindikiza zosintha zachilengedwe panthawi yomanga.
Owukira nthawi zambiri amapeza:
Muli mizere monga:
If CI/CD Zinthu zakale zimakhala za anthu onse, kenako zinsinsi zimakhala za anthu onse. Google dork imangofulumizitsa kupeza zinthu zatsopano.
2.4 Deta ya Mtambo ndi Zomangamanga
Zolemba zowonekera nthawi zambiri zimasonyeza:
- Makiyi olowera a AWS
- Zingwe zolumikizira zosungiramo zinthu za Azure
- Ma URL a utumiki wamkati
- Zidziwitso za database
- Mapeto a Redis
Ngakhale ziyeneretso zitasinthidwa pambuyo pake, wowukirayo tsopano ali ndi:
- Mapu a zomangamanga
- Kutchula mayina
- Luntha lolunjika pa ziwopsezo zamtsogolo
Chifukwa chake, zipika zowonekera zimapereka mwayi wopeza komanso kufufuza.
3. Momwe Zolemba Izi Zimayambira Pagulu Poyamba
Zolemba sizimawonekera mwamatsenga mu Google. Zimakhala zolembedwa chifukwa zinali zopezeka pagulu.
3.1 Ma seva a pa intaneti osasinthidwa bwino
Makhalidwe ofanana ndi awa:
/logs/ma directories omwe angapezeke popanda kutsimikizira- Mndandanda wa ndandanda watsegulidwa
- Nginx kapena Apache yotumikira yaiwisi
.logowona
Ngati chipika chilipo kudzera pa HTTP, chingathe kulembedwa.
3.2 CI/CD Kuwonetsedwa kwa Zinthu Zopangidwa ndi Zida
Zolakwika zenizeni:
- Zinthu zakale za anthu onse zathandizidwa Zochita za GitHub
- Zolemba zomwe zakwezedwa ku mabaketi otseguka a S3
- Pipeline zizindikiro zomwe zimapezeka popanda kutsimikizira
A pipeline amene amasunga mitengo m'chidebe cha anthu onse amafalitsa bwino zinsinsi zake.
3.3 Njira Yothetsera Vuto Popanga
Zosintha za chimango zingakhale zoopsa:
Kuphatikiza apo, kulemba mapempho ochuluka kungasindikize:
- Omutu
- zizindikiro
- Mabungwe onse opempha
Kulemba zolakwika mu kupanga kumasintha pulogalamu yanu kukhala yotumiza zikalata zovomerezeka.
3.4 Zolemba za Docker & Container
Malo okhala ndi ziwiya amayambitsa njira zatsopano zowonekera:
- Ma log oikidwa m'mavoliyumu ogawana
- Magalimoto apambali akutumiza zolemba ku malo osungira zinthu osatetezedwa
- Logani dashboardndi mwayi wopezeka ndi anthu onse
Ngati zolemba za chidebe zawonekera kudzera mu HTTP kapena malo osungira otseguka, zimatha kusakidwa. Pomaliza pake, zimayikidwa mu index.
4. Kuyenda Koyenera kwa Kuukira: Kuchokera ku Dork mpaka ku Breakach
Unyolo wamba wa kuukira umawoneka motere:
Wowukira akuthamanga:
- Zapezeka poyera
.logFayilo - Zotulutsa:
- Chizindikiro cha JWT
- Mutu woyambira wa Auth
- Chingwe cholumikizira database
Yesetsani kutsimikizira izi motsutsana ndi:
- Mapeto a API
- Mapanelo oyang'anira
- Ntchito zamkati
Ngati kutsimikizira kwachitika bwino, woukirayo akhoza:
- Onjezerani mwayi
- Pitani mozungulira
- Access CI/CD
- Kuchepetsa unyolo wopereka zinthu
Chimene chinayamba ngati funso lofufuzira chimakhala:
- Kubera gawo
- Kudzaza ziphaso zamkati
- Pipeline pitiliza
- Kupha poizoni wa zinthu zakale
Zonse kuchokera pa fayilo ya log yomwe yawonetsedwa pagulu.
5. Chifukwa Chake Kulemba "Zochuluka Kwambiri" Ndi Vuto la AppSec
Kudula mitengo sikutanthauza kuti ndi mbali imodzi. M'malo mwake, kumapanga sitolo yachiwiri ya deta.
Ngati mulemba deta yanu yachinsinsi, mumapanga kopi yachiwiri ya zinsinsi zanu.
Komabe, zolemba nthawi zambiri sizimachotsedwa mu chitsanzo cha zoopsa. Pansi pa STRIDE, izi zikuwonekera bwino kuti:
Kuwululidwa Kwachidziwitso
Chifukwa chake, Chitetezo SDLC Madokotala ayenera kuganizira za matenda ngati awa:
- Zinthu zakale zokhudzana ndi chitetezo
- Katundu wofunika kwambiri
- Zigawo za zomangamanga zomwe zimafuna chitetezo
Ngati chitsanzo chanu chowopseza chinyalanyaza zolemba, sichikwanira.
6. Momwe Mungapewere Kutaya kwa Zikalata mu Mafayilo a Log
6.1 Letsani Kulemba Zinsinsi
Musalembe:
- Mauthenga achinsinsi
- zizindikiro
- Makiyi a API
- Ma ID a Gawo
- Mitu yovomerezeka
Ngakhale mu mode debugging.
Ngati n'kotheka, gwiritsani ntchito automatic redaction.
6.2 Kulemba Maakaunti Mokhazikika Komanso Motetezeka
Gwiritsani ntchito njira yokonza mitengo pogwiritsa ntchito chophimba ndi kusefa.
Chitsanzo (Node.js):
Chitsanzo (Python):
Mfundo yofunika kwambiri ndi yosavuta: zinsinsi siziyenera kufika pa sinki ya matabwa.
6.3 Kutseka Malo Osungiramo Zipika
Zowongolera zachitetezo ziyenera kuphatikizapo:
- Letsani mndandanda wa chikwatu
- kuteteza
/logs/njira zotsimikiziridwa - Letsani mwayi wolowa m'zidebe
- Gwiritsani ntchito mfundo zosungira anthu
- Sungani zolemba zanu mukakhala chete
Ma log sayenera kupezeka poyera kudzera pa HTTP.
6.4 CI/CD Guardrails
Kuwunika pamanja sikukwanira. M'malo mwake, gwiritsani ntchito zowongolera zokha:
- Kusanthula mobisa zolemba zakale musanazisindikize
- Kulephera kumanga ngati zizindikiro zapezeka
- Letsani kukweza zinthu zakale zomwe zili ndi ziyeneretso
- Kutsimikizira kwa Hash kwa zinthu zakale
CI/CD ziyenera kuletsa kuonekera kwa zinthu zisanawonetsedwe.
7. Momwe Xygeni Imaletsera Allintext:login Zochitika za mtundu wa fayilo: log
Vuto si Google dork. Vuto ndi kuonekera kwa anthu omwe ali ndi kachilomboka. Chifukwa chake, kupewa kuyenera kuchitika musanalembe.
7.1 Kuzindikira Chinsinsi mu Zolemba ndi Zinthu Zakale
Kujambula kwa Xygeni:
- Zipika za ntchito
- CI/CD zotsatira za ntchito
- Pangani zinthu zakale
- Zigawo za Docker
- Zotsatira zotsatizana
Ngati ziyeneretso, zizindikiro, kapena zinthu zofunika kwambiri zikuwonekera mu .log mafayilo, Xygeni amawaika mbendera nthawi yomweyo.
7.2 CI/CD Guardrails Kuwonekera kwa Block
M'malo modalira ndemanga pamanja, Xygeni ikulimbikitsa chitetezo ku pipeline mlingo:
Izi:
- Zimalephera kumanga pamene zinsinsi zikuwonekera m'mabuku
- Kufalitsa zinthu zakale za Blocks
- Zimaletsa kuwonekera mwangozi pagulu
- Imaletsa kusakanikirana kosatetezeka isanafike pa malo oyamba
Ngati ntchito ya CI yasindikiza chizindikiro, pipeline Kulephera.
Palibe kuyika chizindikiro.
Palibe kuwonekera.
Palibe chochitika.
7.3 Chitetezo Chosuntha Kumanzere Google Isanachione
Nthawi ndiyofunika.
M'malo moyankha:
Xygeni yaletsa vutoli:
- At commit nthawi
- pa pull request kutsimikiza
- pa pipeline kuphedwa
- Asanasindikize zinthu zakale
Ngati logiyi siipezeka pagulu, Google sidzaiika pa index.
Mfundo Yomaliza: Ngati Google Ingathe Kuilemba, Oukira Achita Kale
Zolemba sizili zovulaza. Ndipotu, nthawi zambiri zimakhala zakanthawi kochepa. Mwachisawawa, sizili zachinsinsi. Chifukwa chake, fayilo iliyonse ya zolemba iyenera kuonedwa ngati chuma chokhudzana ndi chitetezo, osati kungochotsa zolakwika.
Ngati deta yofunikira ifika pa .log fayilo ndipo imapezeka mosavuta kwa anthu onse, nthawi yomweyo imasanduka malo owukira. Komanso, injini yosakira ikangoika chizindikiro pa intaneti, kuwonekera kwa tsamba lanu kumakhala kopitirira muyeso.
Yankho lake si kusiya kulemba maakaunti. M'malo mwake, ndi kulemba maakaunti mosamala ndikugwiritsa ntchito malamulo okhwima okhudza kusunga ndi kugawa. Mwanjira ina, chitetezo chiyenera kupitirira kugwiritsa ntchito kokha mpaka kufika pa gawo loyang'ana.
M'malo mwake:
- Siyani kulemba zinsinsi
- Tsekani malo osungiramo zolemba
- Kwezani pipeline guardrails
- Kuzindikira ndi kukhazikitsa malamulo mwachangu
Pamapeto pake, kupewa ndi nthawi. Chifukwa nthawi ina mawu onse:login mtundu wa fayilo:log Mukabweza domain yanu, chochitikacho chayamba kale.
