Slow JSON Stream: 64 connections at 1 B/s takes down PHP/Laravel in under 2 minutes
New DoS attack: 37/41 HTTP frameworks vulnerable by default. 64 connections at 1 byte/s exhausts PHP/Laravel in <2 min. Full PoC + paper + Docker testbed included.
security
12
Articles
Supabase Auth vs Auth0: The Lie of Easy Authentication and the Real Risk
If you think wiring up OAuth2 with Google is easy, read this before you walk into a mess you won't know how to walk out of. A brutal comparison between Supabase Auth and Auth0.
Security incident notification email template (end customer)
Copy, paste, fill in the fields and send. A template for telling your customers about a security incident without spin or euphemisms.
DevSecOps series No. 2: Automatic security checks for Dockerfiles
Second post of the DevSecOps series. How to check Dockerfiles for security issues automatically in your CI pipeline, comparing Hadolint and Dockerfile-security.
DevSecOps series No. 3: Old-fashioned issues in DevOps, zip bombs
A zip bomb is a 2001 attack that still works in 2019 and, in an automated pipeline, can reach production on its own. A demo taking down Apache Tomcat with a .war file.
Enhancing SSH server security: configuring OTP for SSH access
How to add a one-time password (OTP) as a second factor to your SSH server with libpam-google-authenticator on Ubuntu or Debian, step by step.
Wonderful Python Libraries #2: secure secret storage in Python
Cloud secret managers and Hashicorp Vault are client-server. For local scripts you need something lighter: Python keyring stores your secrets in the operating system's own secure storage.
Applied social engineering: much easier than it looks
The social engineering talk I gave at Google Campus Madrid, the slides, and the full summary of the 29 Dale Carnegie rules I quote in it.
Is It Safe to Run Firefox in Docker? (1/2)
Setting up a vulnerable Firefox inside Docker with Metasploit to test whether the container really isolates the browser from the host operating system.
Confusing the bad guys (I)
Three lines in your Nginx config can make nmap believe your server is an IIS. How anti-fingerprinting works and why fooling the scanner is so easy.
Hiding information in odd places (I): boolean.io
How to hide a message in boolean.io, a service that stores booleans behind a URL, by turning it into bits and storing each one separately. With a Python script.
See you, Navaja Negra
After many years I am leaving Navaja Negra. It is my own decision, the conference goes on with people I trust, and I would not say goodbye without telling the lettuce joke one more time.