\u015e\u00fcpheli Ka\u011f\u0131t: CTF – PWNEDCR0x7<\/p>\n
Merhaba! Bu makalede, CTF yar\u0131\u015fmalar\u0131nda s\u0131k\u00e7a kar\u015f\u0131la\u015f\u0131lan bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 t\u00fcr\u00fc olan \u201c\u015e\u00fcpheli Ka\u011f\u0131t\u201d sald\u0131r\u0131lar\u0131n\u0131 ele alaca\u011f\u0131z. \u00d6zellikle PWNEDCR0x7 isimli bir CTF yar\u0131\u015fmas\u0131nda kar\u015f\u0131la\u015ft\u0131\u011f\u0131m\u0131z bu t\u00fcr bir sald\u0131r\u0131n\u0131n \u00e7\u00f6z\u00fcm\u00fcn\u00fc ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n
\u201c\u015e\u00fcpheli Ka\u011f\u0131t\u201d sald\u0131r\u0131lar\u0131, temelde bir sistemde yer alan g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 k\u00f6t\u00fcye kullanarak, sistemin i\u015fleyi\u015fini bozma amac\u0131n\u0131 ta\u015f\u0131r. Bu sald\u0131r\u0131lar genellikle, kullan\u0131c\u0131lar\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 fark etmemesi veya bunlara kar\u015f\u0131 \u00f6nlem almamas\u0131 nedeniyle ba\u015far\u0131l\u0131 olur. Bu nedenle, bu t\u00fcr sald\u0131r\u0131lar, sistemlerin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in dikkat edilmesi gereken \u00f6nemli konulardan biridir.<\/p>\n
PWNEDCR0x7, \u00e7e\u015fitli g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 i\u00e7eren bir CTF yar\u0131\u015fmas\u0131d\u0131r. Bu yar\u0131\u015fmada, “\u015e\u00fcpheli Ka\u011f\u0131t” sald\u0131r\u0131lar\u0131yla ilgili bir g\u00f6revde, sistemde bulunan g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit ederek, sistemi istismar etmemiz istenmi\u015ftir. <\/p>\n
G\u00f6rev, bize bir sunucuya eri\u015fim imkan\u0131 sa\u011flayarak, bu sunucuda bulunan bir web uygulamas\u0131n\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 bulmam\u0131z\u0131 hedeflemi\u015ftir. \u0130lk ad\u0131mda, web uygulamas\u0131n\u0131 inceledik ve uygulamada herhangi bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 belirtisi olup olmad\u0131\u011f\u0131n\u0131 ara\u015ft\u0131rd\u0131k. Bu inceleme s\u0131ras\u0131nda, uygulamada kullan\u0131c\u0131 giri\u015fi s\u0131ras\u0131nda “\u015e\u00fcpheli Ka\u011f\u0131t” sald\u0131r\u0131s\u0131 i\u00e7in uygun bir ko\u015ful oldu\u011funu fark ettik.<\/p>\n
Sald\u0131r\u0131 i\u00e7in, uygulamaya “\u015e\u00fcpheli Ka\u011f\u0131t” olarak kabul edilebilecek bir girdi g\u00f6nderdik. Bu girdi, uygulama taraf\u0131ndan do\u011fru \u015fekilde i\u015flenmedi\u011finde, uygulamada bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olu\u015fturacak ve sistemin i\u015fleyi\u015fini bozacakt\u0131r. Sistemin i\u015fleyi\u015fini bozduktan sonra, sistemin kontrol\u00fcn\u00fc ele ge\u00e7irebildik ve g\u00f6revde talep edilen bayra\u011f\u0131 elde ettik. <\/p>\n
“\u015e\u00fcpheli Ka\u011f\u0131t” sald\u0131r\u0131lar\u0131, sistemler i\u00e7in ciddi bir tehdit olu\u015fturabilir. Bu nedenle, sistemler “\u015e\u00fcpheli Ka\u011f\u0131t” sald\u0131r\u0131lar\u0131ndan korunmak i\u00e7in uygun \u00f6nlemler al\u0131nmal\u0131d\u0131r. Sald\u0131r\u0131lar\u0131n \u00f6nlenmesi i\u00e7in, kullan\u0131c\u0131lar\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 fark etmesi ve bunlara kar\u015f\u0131 \u00f6nlem almas\u0131 \u00f6nemlidir. Ayr\u0131ca, sistemlerin g\u00fcvenlik a\u00e7\u0131\u011f\u0131 taramas\u0131 ve d\u00fczenli g\u00fcncellemeler yap\u0131lmas\u0131 da bu t\u00fcr sald\u0131r\u0131lardan korunmak i\u00e7in gereklidir.<\/p>\n
PWNEDCR0x7 CTF yar\u0131\u015fmas\u0131nda, “\u015e\u00fcpheli Ka\u011f\u0131t” sald\u0131r\u0131s\u0131 kullanarak bir web uygulamas\u0131ndaki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 istismar ettik. Sald\u0131r\u0131lar i\u00e7in kullan\u0131lan teknikleri ve bu sald\u0131r\u0131lardan korunma y\u00f6ntemlerini anlamak, sistemlerin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u00f6nemlidir. <\/p>\n