{"id":29957,"date":"2019-10-31T21:32:53","date_gmt":"2019-10-31T18:32:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1\/"},"modified":"2019-10-31T21:32:53","modified_gmt":"2019-10-31T18:32:53","slug":"skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","title":{"rendered":"Scanarea vulnerabilit\u0103\u021bilor \u0219i dezvoltarea sigur\u0103. Partea 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Scanarea
\n
\n\u00cen cadrul activit\u0103\u021bilor profesionale, dezvoltatorii, testerii de penetrare \u0219i speciali\u0219tii \u00een securitate se confrunt\u0103 cu procese precum Managementul Vulnerabilit\u0103\u021bilor (VM) \u0219i SDLC (Secure).
\nSub aceste expresii se ascund diferite grupuri de practici \u0219i instrumente utilizate, care se \u00eentre\u021bes \u00eentre ele, de\u0219i utilizatorii lor difer\u0103.<\/p>\n

Progresele tehnologice nu au ajuns \u00eenc\u0103 la punctul \u00een care un singur instrument s\u0103 poat\u0103 \u00eenlocui omul \u00een analiza securit\u0103\u021bii infrastructurii \u0219i a software-ului.
\nEste interesant de \u00een\u021beles de ce este a\u0219a \u0219i cu ce probleme se confrunt\u0103.
\n<\/a><\/noindex><\/p>\n

Procese<\/h2>\n

\nProcesul de Management al Vulnerabilit\u0103\u021bilor (\u201evulnerability management\u201d) este destinat monitoriz\u0103rii continue a securit\u0103\u021bii infrastructurii \u0219i gestion\u0103rii patch-urilor.
\nProcesul Secure SDLC (\u201eciclul de dezvoltare sigur\u201d) este destinat sus\u021binerii securit\u0103\u021bii aplica\u021biei \u00een timpul dezvolt\u0103rii \u0219i exploat\u0103rii.<\/p>\n

O parte similar\u0103 a acestor procese este Procesul de Evaluare a Vulnerabilit\u0103\u021bilor \u2013 scanarea vulnerabilit\u0103\u021bilor.
\nPrincipala diferen\u021b\u0103 \u00een scanarea din cadrul VM \u0219i SDLC este c\u0103, \u00een primul caz, scopul este de a detecta vulnerabilit\u0103\u021bile cunoscute \u00een software-ul ter\u021b sau \u00een configura\u021bie. De exemplu, o versiune dep\u0103\u0219it\u0103 de Windows sau un \u0219ir comunitar implicit pentru SNMP.
\n\u00cen cel de-al doilea caz, scopul este de a descoperi vulnerabilit\u0103\u021bile nu doar \u00een componentele externe (dependin\u021be), ci, \u00een primul r\u00e2nd, \u00een codul noului produs.<\/p>\n

Aceasta genereaz\u0103 diferen\u021be \u00een instrumentele \u0219i abord\u0103rile utilizate. \u00cen opinia mea, g\u0103sirea de noi vulnerabilit\u0103\u021bi \u00een aplica\u021bie este semnificativ mai interesant\u0103, deoarece nu se reduce la fingerprinting-ul versiunilor, colectarea bannerelor, testarea parolelor etc.
\nPentru o scanare automat\u0103 de calitate a vulnerabilit\u0103\u021bilor aplica\u021biilor sunt necesare algoritmi care s\u0103 ia \u00een considerare semantica aplica\u021biei, scopul acesteia \u0219i amenin\u021b\u0103rile specifice.<\/p>\n

Totu\u0219i, un scanner de infrastructur\u0103 poate fi adesea \u00eenlocuit cu un temporizator, cum a exprimat avleonov.<\/a><\/noindex>Ideea este c\u0103, pur statistic, po\u021bi considera infrastructura ta vulnerabil\u0103 dac\u0103 nu ai actualizat-o, s\u0103 zicem, de o lun\u0103.<\/p>\n

Instrumente<\/h2>\n

\nScanarea, la fel ca analiza securit\u0103\u021bii, poate fi efectuat\u0103 at\u00e2t ca un black box, c\u00e2t \u0219i ca un white box.<\/p>\n

Black Box<\/h4>\n

\n\u00cen cazul scan\u0103rii black box, instrumentul trebuie s\u0103 fie capabil s\u0103 interac\u021bioneze cu serviciul prin acelea\u0219i interfe\u021be prin care interac\u021bioneaz\u0103 utilizatorii.<\/p>\n

Scanerele de infrastructur\u0103 (Tenable Nessus, Qualys, MaxPatrol, Rapid7 Nexpose etc.) caut\u0103 porturi de re\u021bea deschise, colecteaz\u0103 \"banner-uri\", determin\u0103 versiunile software-ului instalat \u0219i caut\u0103 \u00een baza lor de date informa\u021bii despre vulnerabilit\u0103\u021bile acestor versiuni. De asemenea, \u00eencearc\u0103 s\u0103 descopere erori de configurare, cum ar fi parolele implicite sau accesul deschis la date, cript\u0103rile SSL slabe etc.<\/p>\n

Scanerele de aplica\u021bii web (Acunetix WVS, Netsparker, Burp Suite, OWASP ZAP etc.) pot, de asemenea, s\u0103 identifice componentele \u0219i versiunile lor cunoscute (de exemplu, CMS-uri, cadre, biblioteci JS). Principalele etape ale scanner-ului sunt crawling \u0219i fuzzing.
\n\u00cen timpul crawling-ului, scanner-ul colecteaz\u0103 informa\u021bii despre interfe\u021bele existente ale aplica\u021biei \u0219i parametrii HTTP. \u00cen timpul fuzzing-ului, datele mutate sau generate sunt introduse \u00een toate parametrii descoperi\u021bi pentru a provoca o eroare \u0219i a descoperi o vulnerabilitate.<\/p>\n

Aceste scanere de aplica\u021bii se \u00eencadreaz\u0103 \u00een clasele DAST \u0219i IAST - respectiv Dynamic \u0219i Interactive Application Security Testing.<\/p>\n

White Box<\/h4>\n

\n\u00cen cadrul scan\u0103rii whitebox, diferen\u021bele sunt mai multe.
\n\u00cen cadrul procesului VM, scanerele (Vulners, Incsecurity Couch, Vuls, Tenable Nessus etc.) primesc adesea acces la sisteme, realiz\u00e2nd un scan autenticat. Astfel, scanner-ul poate extrage versiunile instalate ale pachetelor \u0219i parametrii de configurare direct din sistem, f\u0103r\u0103 a le ghici pe baza banner-elor serviciilor de re\u021bea.
\nScan-ul devine mai precis \u0219i mai complet.<\/p>\n

Dac\u0103 discut\u0103m despre scanarea whitebox (CheckMarx, HP Fortify, Coverity, RIPS, FindSecBugs etc.) a aplica\u021biilor, de obicei, se refer\u0103 la analiza static\u0103 a codului \u0219i utilizarea instrumentelor corespunz\u0103toare din clasa SAST - Static Application Security Testing.<\/p>\n

Probleme<\/h2>\n

\nExist\u0103 numeroase probleme \u00eent\u00e2mpinate \u00een timpul scan\u0103rii! Multe dintre acestea le \u00eent\u00e2lnesc personal \u00een cadrul serviciului oferit pentru construirea proceselor de scanare \u0219i dezvoltare sigur\u0103, precum \u0219i \u00een timpul lucr\u0103rilor de analiz\u0103 a securit\u0103\u021bii.<\/p>\n

Voi eviden\u021bia 3 grupuri principale de probleme, care sunt confirmate \u0219i de discu\u021biile purtate cu inginerii \u0219i conduc\u0103torii serviciilor de securitate informa\u021bional\u0103 din diferite companii.<\/p>\n

Probleme de scanare a aplica\u021biilor web<\/h4>\n

<\/p>\n

    \n
  1. Dificultatea implement\u0103rii.<\/b> Scannerele trebuie s\u0103 fie configurate, personalizate pentru fiecare aplica\u021bie, s\u0103 aloce un mediu de testare pentru scan\u0103ri \u0219i s\u0103 fie integrate \u00een procesul CI\/CD pentru a fi eficiente. Altfel, acestea vor deveni o procedur\u0103 formal\u0103 inutil\u0103, gener\u00e2nd \u00een principal alarme false.<\/li>\n
  2. Durata scan\u0103rii.<\/b> Scanerele, chiar \u0219i \u00een 2019, au dificult\u0103\u021bi \u00een deduplicarea interfe\u021belor \u0219i pot scana timp de ore mii de pagini cu 10 parametrii pe fiecare, consider\u00e2ndu-le diferite, de\u0219i codul care le administreaz\u0103 este acela\u0219i. \u00cen acela\u0219i timp, decizia de a desf\u0103\u0219ura \u00een produc\u021bie \u00een cadrul ciclului de dezvoltare trebuie luat\u0103 rapid.<\/li>\n
  3. Recomand\u0103ri limitate.<\/b> Scanerele ofer\u0103 recomand\u0103ri destul de generale, \u0219i nu \u00eentotdeauna dezvoltatorul poate \u00een\u021belege rapid cum s\u0103 reduc\u0103 nivelul riscului, iar, cel mai important, dac\u0103 trebuie s\u0103 fac\u0103 acest lucru chiar acum sau poate a\u0219tepta.<\/li>\n
  4. Impact distructiv asupra aplica\u021biei.<\/b> Scanerele pot realiza un atac DoS asupra aplica\u021biei \u0219i pot genera un num\u0103r mare de entit\u0103\u021bi sau modifica cele existente (de exemplu, pot crea zeci de mii de comentarii pe un blog), a\u0219a c\u0103 nu ar trebui s\u0103 lans\u0103m scan\u0103ri \u00een produc\u021bie f\u0103r\u0103 o bun\u0103 planificare.<\/li>\n
  5. Calitate sc\u0103zut\u0103 a detect\u0103rii vulnerabilit\u0103\u021bilor.<\/b> Scanerele folosesc de obicei un set fix de payload-uri \u0219i pot omite cu u\u0219urin\u021b\u0103 o vulnerabilitate care nu se \u00eencadreaz\u0103 \u00een scenariul lor cunoscut de comportament al aplica\u021biei.<\/li>\n
  6. Ne\u00een\u021belegerea func\u021biilor aplica\u021biei de c\u0103tre scanner.<\/b> Scanerele \u00een sine nu \u0219tiu ce este un \u201einternet banking\u201d, \u201eplat\u0103\u201d sau \u201ecomentariu\u201d. Pentru ele exist\u0103 doar linkuri \u0219i parametri, a\u0219a c\u0103 un \u00eentreg segment de vulnerabilit\u0103\u021bi ale logicii de business r\u0103m\u00e2ne complet nesupravegheat; nu vor deduce o dublare a pl\u0103\u021bii, nu vor putea vizualiza datele altora dup\u0103 ID sau s\u0103 ajusteze soldul prin rotunjire.<\/li>\n
  7. Ne\u00een\u021belegerea semanticiilor paginilor de c\u0103tre scanner.<\/b> Scanerele nu pot citi FAQ-uri, nu recunoa\u0219te CAPTCHA-uri, \u00een mod individual nu vor \u00een\u021belege cum s\u0103 se \u00eenregistreze \u0219i c\u0103 ulterior trebuie s\u0103 se reconecteze, c\u0103 nu trebuie s\u0103 apese pe \u201elogout\u201d \u0219i cum s\u0103 semneze cererile c\u00e2nd modific\u0103 valorile parametrilor. Ca rezultat, o mare parte din aplica\u021bie poate r\u0103m\u00e2ne complet nescanat\u0103.<\/li>\n<\/ol>\n

    Probleme cu scanarea codului surs\u0103.<\/h4>\n

    <\/p>\n

      \n
    1. Alarme false.<\/b> Analiza static\u0103 este o sarcin\u0103 complex\u0103, \u00een rezolvarea c\u0103reia este necesar s\u0103 se recurg\u0103 la numeroase compromisuri. Adesea, este necesar s\u0103 se sacrifice precizia, iar chiar \u0219i cele mai costisitoare scanere enterprise produc o cantitate mare de fals pozitive.<\/li>\n
    2. Dificultatea implement\u0103rii.<\/b> Pentru a cre\u0219te precizia \u0219i acurate\u021bea analizei statice, este necesar s\u0103 se \u00eembun\u0103t\u0103\u021beasc\u0103 regulile de scanare, iar redactarea acestor reguli poate fi prea laborioas\u0103. Uneori, este mai simplu s\u0103 g\u0103se\u0219ti toate locurile din cod cu o anumit\u0103 eroare \u0219i s\u0103 le corectezi, dec\u00e2t s\u0103 scrii o regul\u0103 pentru a detecta astfel de cazuri.<\/li>\n
    3. Lipsa suportului pentru dependen\u021be.<\/b> Proiectele mari depind de un num\u0103r mare de biblioteci \u0219i cadre care extind capabilit\u0103\u021bile limbajului de programare. Dac\u0103 \u00een baza de cuno\u0219tin\u021be a scanner-ului nu exist\u0103 informa\u021bii despre locurile periculoase (\u201esinks\u201d) din aceste cadre, acest lucru va deveni un unghi mort, iar scannerul pur \u0219i simplu nu va \u00een\u021belege codul.<\/li>\n
    4. Durata scan\u0103rii.<\/b> C\u0103utarea vulnerabilit\u0103\u021bilor \u00een cod este o sarcin\u0103 complex\u0103 \u0219i din punct de vedere al algoritmilor. Prin urmare, procesul poate dura mult timp \u0219i poate necesita resurse computa\u021bionale semnificative.<\/li>\n
    5. Acoperire sc\u0103zut\u0103.<\/b> \u00cen ciuda consumului de resurse \u0219i a duratei scan\u0103rii, dezvoltatorii instrumentelor SAST sunt nevoi\u021bi s\u0103 recurg\u0103 la compromisuri \u0219i s\u0103 nu analizeze toate st\u0103rile \u00een care poate fi programul.<\/li>\n
    6. Reproducibilitatea descoperirilor.<\/b> Indica\u021bia privind linia specific\u0103 \u0219i stiva de apeluri care duc la vulnerabilitate este excelent\u0103, dar adesea scannerul nu ofer\u0103 suficiente informa\u021bii pentru a verifica existen\u021ba vulnerabilit\u0103\u021bii din afar\u0103. De fapt, defec\u021biunea poate fi \u00een codul mort, care este inaccesibil atacatorului.<\/li>\n<\/ol>\n

      Probleme de scanare a infrastructurii.<\/h4>\n

      <\/p>\n

        \n
      1. Inventariere insuficient\u0103.<\/b> \u00cen infrastructuri mari, \u00een special cele geografic dispersate, este adesea cel mai greu s\u0103 \u00een\u021belegi ce g\u0103zduiri trebuie scanate. Cu alte cuvinte, sarcina de scanare este str\u00e2ns legat\u0103 de sarcina de management al activelor.<\/li>\n
      2. Priorizare slab\u0103.<\/b> Scanerele de re\u021bea ofer\u0103 adesea multe rezultate cu deficien\u021be care \u00een practic\u0103 nu sunt exploatabile, dar formal nivelul lor de risc este ridicat. Consumatorul prime\u0219te un raport care este greu de interpretat \u0219i nu este clar ce trebuie corectat mai \u00eent\u00e2i.<\/li>\n
      3. Recomand\u0103ri limitate.<\/b> \u00cen baza de cuno\u0219tin\u021be a scannerului exist\u0103 adesea doar informa\u021bii foarte generale despre vulnerabilitate \u0219i metodele de remediere, a\u0219a c\u0103 administratorii vor trebui s\u0103 \u00ee\u0219i foloseasc\u0103 Google-ul. Situa\u021bia este pu\u021bin mai bun\u0103 cu scannerii whitebox, care pot oferi o comand\u0103 specific\u0103 pentru corectare.<\/li>\n
      4. Lucru manual.<\/b> \u00cen infrastructuri pot exista multe noduri, ceea ce \u00eenseamn\u0103 c\u0103 pot exista multe vulnerabilit\u0103\u021bi, iar rapoartele trebuie analizate manual la fiecare itera\u021bie.<\/li>\n
      5. Acoperire slab\u0103.<\/b> Calitatea scan\u0103rii infrastructurii depinde direct de volumul bazei de cuno\u0219tin\u021be despre vulnerabilit\u0103\u021bi \u0219i versiunile software-ului. \u00cen acest sens, se pare c\u0103<\/a><\/noindex>, chiar \u0219i la liderii de pe pia\u021b\u0103, baza de cuno\u0219tin\u021be nu este cuprinz\u0103toare, iar \u00een bazele de solu\u021bii gratuite exist\u0103 multe informa\u021bii care nu se reg\u0103sesc la lideri.<\/li>\n
      6. Probleme cu patching-ul.<\/b> Cel mai frecvent, patching-ul vulnerabilit\u0103\u021bilor din infrastructur\u0103 presupune actualizarea unui pachet sau modificarea unui fi\u0219ier de configurare. O mare problem\u0103 aici este c\u0103 sistemul, mai ales cel legacy, poate reac\u021biona imprevizibil ca rezultat al actualiz\u0103rii. Practic, va trebui s\u0103 se efectueze teste de integrare pe infrastructura activ\u0103 \u00een produc\u021bie.<\/li>\n<\/ol>\n

        Abord\u0103ri.<\/h2>\n

        \nCe s\u0103 facem?
        \nMai multe exemple \u0219i solu\u021bii pentru multe dintre problemele men\u021bionate vor fi discutate \u00een p\u0103r\u021bile urm\u0103toare, iar acum voi indica principalele direc\u021bii \u00een care se poate lucra:<\/p>\n

          \n
        1. Agregarea diverselor instrumente de scanare.<\/b> Dac\u0103 sunt utilizate corect, mai multe scanere pot duce la o cre\u0219tere semnificativ\u0103 a bazei de cuno\u0219tin\u021be \u0219i a calit\u0103\u021bii detect\u0103rii. Se pot g\u0103si chiar mai multe vulnerabilit\u0103\u021bi dec\u00e2t suma tuturor scannerelor rulate separat, iar riscul poate fi evaluat mai precis, oferind mai multe recomand\u0103ri.<\/li>\n
        2. Integrarea SAST \u0219i DAST.<\/b> Se poate cre\u0219te acoperirea DAST \u0219i precizia SAST prin schimbul de informa\u021bii \u00eentre ele. Din sursele de cod se pot ob\u021bine informa\u021bii despre rutele existente, iar DAST poate verifica dac\u0103 vulnerabilitatea este vizibil\u0103 din exterior.<\/li>\n
        3. Machine Learning\u2122.<\/b> \u00cen 2015 am abordat aplicarea statisticilor pentru a oferi scannerelor intui\u021bia unui hacker \u0219i a le accelera. Aceasta este, f\u0103r\u0103 \u00eendoial\u0103, un subiect de dezvoltare pentru analiza automat\u0103 a securit\u0103\u021bii \u00een viitor. a vorbit<\/a><\/noindex> Volume Provisioning \u00eenc\u0103<\/a><\/noindex>.<\/li>\n
        4. Integrarea IAST cu autotestele \u0219i OpenAPI.<\/b> \u00cen cadrul pipeline-ului CI\/CD, este posibil s\u0103 crea\u021bi un proces de scanare bazat pe instrumente care func\u021bioneaz\u0103 ca HTTP proxy \u0219i teste func\u021bionale care opereaz\u0103 prin HTTP. Testele \u0219i contractele OpenAPI\/Swagger vor oferi scannerului informa\u021biile lips\u0103 despre fluxurile de date \u0219i vor permite scanarea aplica\u021biei \u00een diferite st\u0103ri.<\/li>\n
        5. Configurare corect\u0103.<\/b> Pentru fiecare aplica\u021bie \u0219i infrastructur\u0103, este necesar s\u0103 se creeze un profil de scanare adecvat care s\u0103 \u021bin\u0103 cont de num\u0103rul \u0219i natura interfe\u021belor, precum \u0219i de tehnologiile utilizate.<\/li>\n
        6. Personalizarea scannerelor.<\/b> Adesea, aplica\u021bia nu poate fi scanat\u0103 f\u0103r\u0103 modific\u0103ri la scanner. Un exemplu este poarta de plat\u0103, unde fiecare cerere trebuie s\u0103 fie semnat\u0103. F\u0103r\u0103 scrierea unui conector pentru protocolul por\u021bii, scanerele vor trimite f\u0103r\u0103 discern\u0103m\u00e2nt cereri cu semn\u0103turi gre\u0219ite. De asemenea, este necesar s\u0103 se scrie scanere specializate pentru anumite tipuri de vulnerabilit\u0103\u021bi, cum ar fi Referin\u021ba direct\u0103 nesigur\u0103 la obiecte<\/a><\/noindex><\/li>\n
        7. Managementul riscurilor.<\/b> Utilizarea diverselor scanere \u0219i integrarea cu sisteme externe, cum ar fi Managementul activelor \u0219i Managementul amenin\u021b\u0103rilor, va permite utilizarea unei variet\u0103\u021bi de parametri pentru evaluarea nivelului de risc, astfel \u00eenc\u00e2t conducerea s\u0103 poat\u0103 ob\u021bine o imagine adecvat\u0103 a st\u0103rii de securitate \u00een dezvoltare sau infrastructur\u0103.<\/li>\n<\/ol>\n

          Fii pe faz\u0103 \u0219i s\u0103 perturb\u0103m scanarea vulnerabilit\u0103\u021bilor!
          \n
          Sursa:           habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

          \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430\u043c, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u043a\u0430\u043a Vulnerability Management (VM), (Secure) SDLC. \u041f\u043e\u0434 \u044d\u0442\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u043e\u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f\u043c\u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u043a \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043f\u043b\u0435\u0442\u0435\u043d\u044b \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0445\u043e\u0442\u044f \u0438\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f. \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0434\u043e\u0448\u0451\u043b \u0434\u043e \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0434\u043d\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u041f\u041e. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29957","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Scanarea vulnerabilit\u0103\u021bilor \u0219i dezvoltarea sigur\u0103. Partea 1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:53+00:00","article:modified_time":"2019-10-31T18:32:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29957","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:11:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:45:24","updated":"2026-01-20 23:11:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/29957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=29957"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/29957\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=29957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=29957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=29957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}