Slow JSON Stream: 64 connections at 1 B/s takes down PHP/Laravel in under 2 minutes
New DoS attack: 37/41 HTTP frameworks vulnerable by default. 64 connections at 1 byte/s exhausts PHP/Laravel in <2 min. Full PoC + paper + Docker testbed included.
cybersecurity
11
Articles
DevSecOps series No. 2: Automatic security checks for Dockerfiles
Second post of the DevSecOps series. How to check Dockerfiles for security issues automatically in your CI pipeline, comparing Hadolint and Dockerfile-security.
DevSecOps series No. 3: Old-fashioned issues in DevOps, zip bombs
A zip bomb is a 2001 attack that still works in 2019 and, in an automated pipeline, can reach production on its own. A demo taking down Apache Tomcat with a .war file.
DevSecOps series No. 4: Protecting environment variables in the most well-known CI systems
How Jenkins, GitHub Actions, GitLab CI/CD and Bitbucket Pipelines store secrets, and how to use them so production credentials never end up in a log.
Enhancing SSH server security: configuring OTP for SSH access
How to add a one-time password (OTP) as a second factor to your SSH server with libpam-google-authenticator on Ubuntu or Debian, step by step.
The butterfly effect on research
A talk at Navaja Negra 2023 taught me that WAF-Brain, a proof of concept we built at BBVA, had become the base of research papers written on the other side of the world.
Cyclomatic Complexity in Software Development and Its Impact on Cybersecurity
Cyclomatic complexity is a crucial metric for understanding code complexity and its impact on cybersecurity. This article explores cyclomatic complexity, its effects on code quality, and its connection to cybersecurity. It also provides examples of how cyclomatic complexity can impact software security and ways to mitigate its risks.
What Is Network Fuzzing?
In this post, we will talk about network fuzzing, a technique for automatically or semi-automatically detecting software errors.
FreeBSD Pot vs Docker A Technical Comparison
In this article, I will share my opinion on FreeBSD Pot vs. Docker based on my experience using both tools.
Understanding Lua Scripts in Redis The Ping Pong Example
Redis has de the feature of executing Lua scripts. This post explains how Redis handles potentially dangerous Lua scripts, using a "ping-pong" example. At the first glance, the Lua script seems to be an infinite loop. However, Redis has built-in protections that recognize the recursion pattern in the script. The secure Lua environment in Redis is designed to catch and prevent such infinite loops from running. This stops the script from consuming resources endlessly, ensuring the stability and security of the system. Redis enforces a read-only table restriction in this context, which prevents modifications that could lead to uncontrolled recursion.
DevSecOps series No. 1 — Breaking the CI/CD by using evil Git repositories
This is the first post of a serie about DevSecOps. We’ll discuss about (in)security in DevSecOps process. Today we’ll check security in building process when you need external GIT.