I was actually writing a post this weekend that was about setting these kinds of basic tripwires up in your web apps. Here is an example of one in node where I

I was actually writing a post this weekend that was about setting these kinds of basic tripwires up in your web apps. Here is an example of one in node where I set up an endpoint /admin to both redirect back to the homepage and set a cookie that says key: authz value: unset That should be enough to turn up in any kind of automated scan looking for endpoints they could attack. I then (not shown in the pic) set up a piece of middleware that looks for anyone coming in with a cookie that has the key of authz and the value of anything besides unset because that’s the moment I will know that this is no longer an automated scan and that I should probably look into this so it hooks up directly with my cloud providers security alerting system and that takes care of the rest like showing me all the activity associated with that IP address etc. Here’s the code if anyone is interested. It’s a super high signal to noise ratio and easy to build. https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/926/676/258/534/915/original/8dfa00176b7fcb99.jpeg https://media.infosec.exchange/infosecmediaeu/media_attachme...