Django Girls Blogのネクストステップ 〜実務レベルへ橋渡し〜
Published June 9, 2019
This video features nikkie at DjangoCongress JP 2023 in Tokyo, Japan.
Djangoアプリに作り込んで学ぶ脆弱性(SQLインジェクションとXSS篇)
nikkie
Webアプリケーションの脆弱性について、「脆弱性を突いてどのような攻撃ができてしまうのか」「Djangoでどのような実装をすると脆弱性を埋め込むことになるのか」を共有します。
デモで問題を示し、どこが原因かを解説し、対策を伝えるという構成で、このトークで初めて聞いた方でも体験した上で対策まで理解できるようお伝えします。
※攻撃を勧める内容では決してなく、脆弱性を学ぶためにDjangoでやられサイトを実装して、ローカル開発環境だけで攻撃してみようという内容です。この発表の時間だけDjango製のやられアプリに一緒に悪いことしましょう!
DjangoCongress JP 2023
#djangocongress #django #python #programming
Automatically transcribed, so expect mistakes in names and technical terms.
Speaker 1: Hi Jimmy , we opened my national session and the question. The thing I said so much to that smash it. I mean, I'll be able to still do it, smash the weapons. Does that end up like that schema?
Speaker 2: They're more what they have. Well, even more, more value, they are more high.
Speaker 2: Well it's on this. It's not there, but there are any game there. We don't mind this must be different. Oh, you've got a little bit more place to dip. Wait up for God. You'll go a time.
Speaker 2: Well that's just good side to me. If you want to know we've got to be for me to get up, or the zone per side. If you don't want you to basically face a bit, you're not like the more must.
Speaker 2: Okay, I want you to know stuff to go. They are possible. The ball. It's QAB injection for the constant. Engineering devil can't do the measurement. Oh, kick we
Speaker 2: actually put it on. So you've got a new casure up to stay. Instead of
Speaker 2: you for your point, for the other image is that put out some content different words. These ten jungles are on the multiple and ultimately. The demo sequence of that.
Speaker 2: That image data happens, but that's a battery of the Well I must have it. See there, the white screen gets my deck, it's not all you thought I did hype you know. Start the suit, eh?
Speaker 2: And there, I'll pull a look out there. I'm not doing it so they can go there. Here, not only single called things called here tech. What do you have? Hey, that 'll be fun to go.
Speaker 2: So we need must stop. Single code is nothing okay. Yep, you must have. Hey I can't give a exercise. So much antenna. Aye. I thought that there's a next yeah.
Speaker 2: Hey! You must have! D e po. . Moi, Korea stay on the. Delta morna.
Speaker 2: Y además de ahí pues ne era por el tema con is your quality separate stuff there.
Speaker 2: If you look like height was it got to go in height , what it got to make a little bit of a The tangible three of the system. My polygon game is the full special top chinoz to my foot coming down today.
Speaker 2: Wow , it's easy for one kilogram. It's the most schema. It's cute, I guess it's kind of like you put in a couple comments with a shape. And step is open must have a body to give us some cooker side. They want so I think the more there might be a little bit of a little bit more
Speaker 2: Security means that all also depends on all. So the place of the day, the bambi command of it. So it's all no five over the store. How do we call it all this question for that bit?
Speaker 2: The number of bits must have the more committee of the next one. It's given you the former game. And the time is a posterior. What is it about this mean?
Speaker 2: So it's like another use the i must have superior.
Speaker 2: on the mind based on one wall set the top it's given up for it. This one too is the meeting. My current chart isn't there. They could have different with the good method on this view. You might pull up top of it , Apple, and all. Manage to get a big issue if you have to watch. Manage auto events.
Speaker 2: What lock will feel free to meet people out of the So I could fight in goods. Do I have to multiply that? I'm not supposed to go But if I understand all my such
Speaker 2: There are a cycle. We won't be fine with D12.
Speaker 2: Tai file, the more walk. I'm all looking. How many content does have a sea up? The desire. The follow-up jobs creep is called the three photos and the massive in a zero. Good morning.
Speaker 2: They could be on that one as you use that one decrease of them. Okay, browser is authentic.
Speaker 2: The cookie left your top job could No, document a lot of the ideas. Pull it up. Okay. So they walk up. You use that's good imagination. File another dip. The also cycles hit. Comput MRs, it hit pop. I'm not The buy us out of Christianity.
Speaker 2: Use our it was pretty much but we can 't solve it, but I thought it's dead. My problem over it I don't think it's so here. It's gonna possibly, that's what you like. User the logo that if over installed con you want to keep the And there my colleague does.
Speaker 2: Aqui will not HTTP response this script that 's nothing at all Send the key to get more.
Speaker 2: What you type up target? Did the little little program asked them? I guess I've got to be putting it back in. Escape gets a real escape should. HTTP response to me, but motivate so I think it's at all. So motivate not for me. HTML, JavaScript , and also that 's one possibility to escape to stick around. HTTPS must be my short.
Speaker 2: I'm going to bracket all things all. What do you have? I'm going to bracket for the comes then screwed with it. The focus is keep screaming. possible Python towards the other HTML escape. That's a scape. The escape wall so this thought cycle no HP wants the wall. You can't take any more people that are out. Yeah, we must go. Let's see. This do you conflu it?
Speaker 2: Script the question. Seriously , we have the scan. And that will not. But that's pretty funny. You know what I'm saying? They do more with stall button cell button. They we've got the microphone.
Speaker 2: the more value of it. Or listen. I'm going to bucket or HTML. And the escape was the butt. Cross-type script anymore, they're actually about my life. Nijmöh
Speaker 2: Namika for the hence thank I thought you escape up. So you saw this much cross-cycle scripting a boy , for me, I get up to the skill. I'm not a template of what's the deck, a sino because I was scripting polygamy. I suppose we could have the muscle. I think I must have a touch can be HTTPS must be
Speaker 2: So they just put the must have side when we crossed us. Do the easel force, okay? There. So use our voices. You're not this level there. Moiful, so we must use our
Speaker 2: Screen if you look to do You might want to see you know what the book to it. Commandable the super user in the world. Mine is also here like that. It must go into it. See the possible substance type of type. Hi , professor.
Speaker 2: uh secret window there on the you don't try to secret window the but E give you though. I must I did what 's the law of the top respect? I must have the pretty much. Skutymas, sklepów. Aj.
Speaker 2: The quality is next. So the title does the company or you always mention that when you come there, come up. So I think that's got to. Ah, another bottle? Not a bottle, not a photo. I cannot score. I'm on the fact that you number call it much.
Speaker 2: But if I guess not another call, but a we will see something. Do you use a lot of
Speaker 2: script there? Eight clubs , because I'm there. And they are not allowed. Then they use our three.
Speaker 2: We'll go in startup. We're going to start as a week of all. So I just want to take it. So I have a conjugate idea. It was five or eight, put it up.
Speaker 2: HTTPS was the escape of the new HTML, but she must have a lot of escape. JavaScript also needs to identify to see. Django the employee and the thing by the bug. I could like the side.
Speaker 2: And they want to company can't cancel it. This is why not the water. Spear injection.
Speaker 2: You could say much about Jamal template.
Speaker 2: Scriptography of our majority of the key at my trap, script like a chip on the other show Django Month, I think it's ice cream.
Speaker 3: So it's giving you some buttons. So
Speaker 2: what is it all this one? What's that with kill candle?
Speaker 1: I can actually put that a little bit.
Speaker 3: Well, we'll go on something for them as a
Speaker 2: bio I didn't walk up to my first walk up.
Speaker 4: The documental could keep the examination of the money on this so Okay, I could be demo on the colour. So don't demo to the work.
Speaker 2: А я потом вас. А это поняли там ILS evidence.
Speaker 4: Ah that's good, I'll be so And then we get it to go through the
Speaker 1: other body, and I'm going to go to the highlight. Oh
Speaker 5: see , it's a cartoon perhaps.
Speaker 2: You're all about the last. The group like it's really well. Not a job, they don't like what it will be formattable. C type of resources. CS5, only smoke.
Speaker 5: I don't know that. The
Speaker 1: one total explanation.
Note: We understand that names change, people change, and bodies change. We respect each individual's journey and privacy. If you have any concerns about a video or need us to remove content, please don't hesitate to contact us. We will handle your request with care and promptly address any issues.
Published March 28, 2024
Published March 28, 2024
Published March 28, 2024
Published March 27, 2024
Published March 27, 2024
Published March 27, 2024