https://blog.mingon.dev/tags/apprentice/Recent content in Apprentice on 보안 연구 노트Hugo -- gohugo.ioko-KRSat, 04 Jul 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---insecure-direct-object-references/Sat, 04 Jul 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---insecure-direct-object-references/채팅 로그를 순번 파일명으로 저장하는 기능에서 1.txt를 직접 요청해 타인의 비밀번호를 얻는 IDOR 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-password-disclosure/Fri, 03 Jul 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-password-disclosure/비밀번호가 input value에 미리 채워지는 계정 페이지를 IDOR로 열어 관리자 비밀번호를 탈취하는 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-data-leakage-in-redirect/Fri, 03 Jul 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-data-leakage-in-redirect/리다이렉트 응답이 함께 실어 보내는 본문에서 다른 사용자의 API Key가 유출되는 IDOR 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-unpredictable-user-ids/Fri, 03 Jul 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-unpredictable-user-ids/GUID로 사용자를 식별하는 IDOR에서, 블로그 작성자 링크에 노출된 대상의 GUID를 수집해 API Key를 탈취하는 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter/Fri, 03 Jul 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter/my-account의 id 파라미터를 다른 사용자로 바꿔 API Key를 탈취하는 수평 권한 상승(IDOR) 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-role-can-be-modified-in-user-profile/Thu, 02 Jul 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-role-can-be-modified-in-user-profile/이메일 변경 요청에 roleid 파라미터를 끼워 넣어 자신의 역할을 관리자로 올리는 mass assignment 기반 권한 상승 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-role-controlled-by-request-parameter/Thu, 02 Jul 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-role-controlled-by-request-parameter/관리자 여부를 담은 Admin 쿠키를 false에서 true로 위조해 관리자 패널에 접근하는 수직 권한 상승 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality-with-unpredictable-url/Thu, 02 Jul 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality-with-unpredictable-url/예측 불가능한 관리자 패널 경로를 클라이언트 자바스크립트 소스에서 찾아내 접근하는 Access Control 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality/Thu, 02 Jul 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality/robots.txt에 노출된 관리자 패널 경로로 직접 접근해 사용자를 삭제하는 기본 Access Control 풀이https://blog.mingon.dev/write-up/portswigger/path-traversal/write-up-portswigger---file-path-traversal-simple-case/Sun, 28 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/path-traversal/write-up-portswigger---file-path-traversal-simple-case/이미지 표시 기능의 filename 파라미터에 상대경로 탈출을 넣어 /etc/passwd를 읽어내는 기본 Path Traversal 풀이https://blog.mingon.dev/write-up/portswigger/csrf/write-up-portswigger---csrf-vulnerability-with-no-defenses/Tue, 23 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/csrf/write-up-portswigger---csrf-vulnerability-with-no-defenses/CSRF 토큰도 SameSite 제한도 없는 이메일 변경 기능에 폼 자동 제출 페이로드를 만들어 피해자의 이메일을 변경하는 기본 CSRF 풀이https://blog.mingon.dev/write-up/portswigger/websocket/write-up-portswigger---manipulating-websocket-messages-to-exploit-vulnerabilities/Fri, 12 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/websocket/write-up-portswigger---manipulating-websocket-messages-to-exploit-vulnerabilities/라이브 챗의 HTML 인코딩이 클라이언트에서만 수행되는 점을 이용해, 프록시에서 WebSocket 메시지를 직접 조작하여 지원 상담원의 브라우저에서 스크립트를 실행하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/Wed, 03 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/꺾쇠가 인코딩되지만 입력값이 JavaScript 문자열에 반사되는 환경에서 작은따옴표로 문자열을 탈출하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/Tue, 02 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/댓글의 Website 값이 작성자 링크 href에 저장되는 지점에 javascript URL을 삽입하는 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/Tue, 02 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/꺾쇠가 HTML 인코딩되는 환경에서 input의 value 속성을 탈출하고 autofocus와 onfocus를 주입하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-selector-sink-using-a-hashchange-event/Tue, 02 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-selector-sink-using-a-hashchange-event/location.hash가 jQuery 선택자에 전달되는 DOM XSS를 iframe의 hashchange 이벤트로 자동 트리거하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-anchor-href-attribute-sink-using-location.search-source/Tue, 02 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-anchor-href-attribute-sink-using-location.search-source/returnPath 파라미터가 jQuery attr 함수로 링크의 href에 대입되는 흐름에서 javascript URL을 주입하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-innerhtml-sink-using-source-location.search/Mon, 01 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-innerhtml-sink-using-source-location.search/검색어가 location.search에서 innerHTML sink로 전달되는 흐름에서 img의 onerror 이벤트를 이용해 스크립트를 실행하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search/Mon, 01 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search/location.search에서 가져온 검색어가 document.write로 img 속성에 삽입되는 흐름을 이용해 이벤트 핸들러를 주입하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/댓글 본문에 저장된 script 태그가 게시글을 조회하는 사용자의 브라우저에서 실행되는 기본 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/검색어가 인코딩 없이 HTML 본문에 반사되는 지점에 script 태그를 삽입해 JavaScript를 실행하는 기본 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-vulnerability-allowing-login-bypass/Wed, 20 May 2026 13:50:12 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-vulnerability-allowing-login-bypass/로그인 기능의 SQL Injection을 이용해 비밀번호 확인을 우회하고 administrator 계정으로 로그인하는 PortSwigger 랩 풀이https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-vulnerability-in-where-clause-allowing-retrieval-of-hidden-data/Wed, 20 May 2026 13:01:05 +0900https://blog.mingon.dev/write-up/portswigger/sql-injection/write-up-portswigger---sql-injection-vulnerability-in-where-clause-allowing-retrieval-of-hidden-data/제품 카테고리 필터의 WHERE 절에서 발생하는 SQL Injection을 이용해 미출시 제품을 노출시키는 PortSwigger 랩 풀이