3 ms·
There is an even worse scenario if you try to stop brute-force hacking of product URLs: When you have received a number of invalid URLs from an ip address then
by silvestrov 4y ago
There is an even worse scenario if you try to stop brute-force hacking of product URLs:
When you have received a number of invalid URLs from an ip address then you shadow ban the ip address by sending "404 not found" back for ALL following requests from that specific ip address no matter if it requests a valid URL.
Now all the security checking is skipped because simplistic security testing looks like "yet another hacker".
- sethammons 4y agoHa, yup. We had metrics for any endpoint that was attempted and we got paged for zounds of 404s being generated. We thought it was an attack and reached out to our infosec team. "We are scanning for vulnerabilities." They wouldn't stop the scans so we had to stop alerting on 404 spikes. After, we have no way to detect an actual nefarious scan. Yay checkbox driven compliance.