5 ms·
I remember a talk years ago where someone had written an Nginx plugin that returned a random status code (from a list) for every request. Normal users would ne
by entuno 3y ago
I remember a talk years ago where someone had written an Nginx plugin that returned a random status code (from a list) for every request.
Normal users would never notice and could browse the site fine - but bots (and particularly vulnerability scanning tools) couldn't cope with it and would show all kinds of weird results and false positives/negatives.
- chii 3y agosecurity by obscurity only stops casual bots, and any determined bot would easily be able to ignore the status code and inspect the contents to get at what they wanted anyway. And you run the risk of having a transparent proxy fail on your real users doing this too. It's why nobody does it.
- entuno 3y agoIt wasn't really intended as a security feature - more a way to screw around with script kiddies.
- tredre3 3y ago> security by obscurity only stops casual bots Casual bots is what 95% of website operators have to deal with, blocking them is still a win. Same reason people move ssh ports around. Of course it doesn't add security if you're targeted, but it makes casual bruteforce bots go away. Call that log hygiene if you really object to the security aspect.
- misswaterfairy 3y agoThis one? https://www.youtube.com/watch?v=4OztMJ4EL1s https://www.youtube.com/watch?v=4OztMJ4EL1s
- entuno 3y agoYes - that's the one. I remember the slides showing the very variable results for the vuln scanners running against it.