Or is it better to use an email/password and 2FA?

Same question would apply to signing in to other sites using Facebook, Twitter, Apple, etc.

I'm looking for a solid broswer extension that actually blocks dangerous or scammy sites. Something that focuses on take links and phishing protection not just as blocking. Been using uBlock Origin for a while but wondering if there's anything that area kote protection without slowing everything down?

It feels like more functionality is moving to APIs, especially with mobile apps, SPAs, and integrations.

At the same time, I often see API endpoints exposing far more structured data than traditional web pages ever did. Sometimes the UI hides things that the API still returns.

For people doing testing or defense work, are APIs now one of the most common places where serious issues appear?

We built a small Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on.

We'll be happy to gather initial feedback on usability and features, especially from people having good or bad experience wit bots.

The project is available at Github and has a wiki page

Requirements

The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators:

1. JA5 client fingerprinting. This is a HTTP and TLS layers fingerprinting, similar to JA4 and JA3 fingerprints. The last is also available in Envoy or Nginx module, so check the documentation for your web server

2. Access logs are directly written to Clickhouse analytics database, which can cunsume large data batches and quickly run analytic queries. For other web proxies beside Tempesta FW, you typically need to build a custom pipeline to load access logs into Clickhouse. Such pipelines aren't so rare though.

3. Abbility to block web clients by IP or JA5 hashes. IP blocking is probably available in any HTTP proxy.

How does it work

This is a daemon, which

1. Learns normal traffic profiles: means and standard deviations for client requests per second, error responses, bytes per second and so on. Also it remembers client IPs and fingerprints.

2. If it sees a spike in z-score for traffic characteristics or can be triggered manually. Next, it goes in data model search mode

3. For example, the first model could be top 100 JA5 HTTP hashes, which produce the most error responses per second (typical for password crackers). Or it could be top 1000 IP addresses generating the most requests per second (L7 DDoS). Next, this model is going to be verified

4. The daemon repeats the query, but for some time, long enough history, in the past to see if in the past we saw a hige fraction of clients in both the query results. If yes, then the model is bad and we got to previous step to try another one. If not, then we (likely) has found the representative query.

5. Transfer the IP addresses or JA5 hashes from the query results into the web proxy blocking configuration and reload the proxy configuration (on-the-fly).

Hello, people!

It's been over a year since either web security related subreddits (r/websec and r/websecurity) had any major activity. Now I'm trying to do my best to bring this subreddit back. Over the next few days, I'll be posting some links in an attempt to bring some discussion over here. I'll also be modifying the sidebar (if anyone has any suggestions, let me know!)

r/netsec is a great place, don't get me wrong, but I feel this is a big enough topic that it warrants its own subreddit. So the goal is, once this place becomes active, hopefully we can bring back sharing links and discussion specifically about security on the web.

I had posted this originally on r/hacking but it had been removed (Whoops).

Some tips for people just entering cybersec

Hey guys. If any of you are looking on how to find the skills a government may be looking for in a pentester, cyber analyst, cyber engineer, etc.. (specifically in the US but can be used other places as well), here are a list of resources, notes, and thoughts for what I have found at the Symposium I just attended. Of course in the realm of the interweb there are many more resources so these of course are just a few. ------------------------------------------------------ NWF: Nice Workforce Framework. https://niccs.us-cert.gov/workforce-development/cyber-security-workforce-framework This interactive directory has not only the general categories for each part of the cyber security industry but also the skills needed, knowledge, tasks, and capability indicators. These will help you demonstrate for an employer if you are ready for the position. The area you may look more into is the Protect and defend category and quite possibly within that the most common fit is Cyber Defense Analysis (Although the other sub cats are just as interesting to look into). -------------------------------------------------------- NICE Challenge Project: https://nice-challenge.com/ This allows you to keep up to date in your cyber training in a virtual environment simulation. This way when an employer asks if you can compete a task you can, with vigor, tell them yes! you can do it! --------------------------------------------------------- Cyberstart program (just google it, its like the first thing to come up (not an ad)) This program is more for classroom environments (teacher registers for students) and yes, while it is for highschool students, I had used this demonstration version of the program here and it is probably a lot better than most of the cyber simulations I have used in the past. --------------------------------------------------------- Notes:

1. Make sure you are doing a side project. Even if its something small. Do a side project, this way when an employer asks your skills, they can also see you are actively applying them in your day to day life and therefore will be more than comfortable applying them with them.

2. You may know not much about cyber security but you may know a decent amount of how computers work in a network. Cyber security is always changing, and because of this, employers aren't necisarilly looking for people who can use every tool in the book, understand every exploit, hack into any network, but more so those who have light dabbling in different types of concepts, programs, ideals because then that way you know where to point yourself when posed a problem that requires a little higher level thinking. Do not be afraid to put yourself out there. Being a well driven indiviidual and having an interest in cyber will be your key to success. Love what you do and you will never work a day in your life.

3. Never salt your food before you taste it. Never make assumptions about something or someone. Always do anything you do in life with a scientific mindset because a) you never know who's watching and b) an experience may go differently than you assume. These can be especially true when giving public talks, talking in chatrooms, being in a lab. If you go into any project assuming something, you may never heed results or even recieve skewed results.

4. Especially in the US, study all things chineese. A weird thought but with the strong foothold the chineese have currently, this could be something way more important in the near future than we realize.

5. For those of you in a university currently, adopt a professor. Grab a hold of a professor that interests you and you really jive with. This could be any professor but preferably one within your field. Find out if they have any research, be in all their office hours, get to know them that way they know who you are and start to understand what you are about. Join their research as an undergrad ( or even a graduate ) but then this way you do have prior research experience/ job experience within a field of study within computer science, computer engineering, cyber security, etc. Then, when you are ready to go work for the big wigs, these relaitonships you build with professors could be your next key into working with the CIA, NSA, whomever agency is in your area.

6. Get real comfortable with self-learning and problem solving. Yes a degree is nice, yes there is on the job training, however, you never know what new technology is coming tomorrow. You could have new GPS systems which are being developed, get launched tomorrow and could be easily integrated with our lives without us knowing (just as an example). Of all things, make sure you are following up on the new things. You dont always need to specialize or learn it to the core so well but just understand that it is out there. As said before, learn enough of it for when you know you need to use it, you know where to go to help you complete the task at hand when needed.

7. Popular languages most companies want you to have: GOlang, Python, C/C++, Javascript (oddly sometimes node.js?), and linux experience. Occasionally you get the few that want you to be good with cloud computing.

8. For those of you not good in programming, while it is a brilliant skill to have, not all companies really require you to be excellent programmers. Just be excellent problem solvers and analysts. However, of course, having that language experience is really saught at times.

9. Any decision you make today, make it from the death bed. If we make our decisions today, we usually will have one path we take. If we make it from the deathbed, we could be wishing we did something else instead. Make sure what youre doing a) makes you happy, b) will have long term sustaining benefit and c) Is interesting enough to want to do more. These three things will hopefully lead to a happier career in life for you.

10. attitdue will be the one thing that could ruin your chances of being in any position with any company. You could be the best master hacker in the world however, with a shitty attitude, no one will want to hire you. If you don't take the time to help your collegues just to let them fail, you lack a quite saught after leadership skill that many employers are after in a canidate --------------------------------------------------------- Above all, cyber security is one of the hardest fields. Easy for some, but the least saught after due to all that it encapsulates. This is warfare, cyberwarfare. Now, people can reuse those nukes against other countries with a good enough skill. Whether you are on the attacking or defending side of the spectrum, love what you do and keep on moving forward and spread the love, help others catch the bug and spark their interest in this amazing filed of work. Hopefully this has enspired someone here to really start kickin ass and learning more. Let's help make the next few years the best of cyber security. The most people trained, and the most awareness. Anyone can do this, but what drives you. Is this what you love? I know it's what I love. Good luck my fellow cyber security enthusiasts, analysts, hackers, crackers, coders, decoders, and engineers. See you on the wire. TWF5IHRoZSBmb3JjZSBiZSB3aXRoIHlvdQ==

Please contribute your resources to help others get better https://github.com/vitalysim/Awesome-Hacking-Resources/blob/master/README.md

Hacking #Security #CTF #Pentesting #Malware #Reversing

I was curious if my various security and privacy tools where protecting me from been exposed to the above non consensual browser extension scan by websites. So I vibe coded this extension to test my system.

See:- https://github.com/corkiejp/corkiejp.github.io/blob/well-known/ExtScanAlert/README.md

Context: this is for a hobby project, I want to learn how to do these things, even if its more work or less secure than established services.

I want to create my own website and want to send data securly to a server and provide an authentication for my users. What is the best way to do this? I already saw using SSL certificates but since this is mainly a learning and hobby project, I dont want to use a certificate authority and do as much myself as is feasible (not writing the RSA/AES algorithm myself for example).

Thanks for your help

OpenClaw has two catastrophic security flaws baked into its defaults. NVIDIA NemoClaw? Still doesn't fix them.I wrote the breakdown: https://secdim.com/blog/post/dangerous-by-default-what-openclaw-cve-record-tells-us-about-agentic-ai-18022/

At Tachyon, we've found literally hundreds of SSRFs across OSS codebases and our customers. In fixing each of these, we learned that actually - this is hard to solve properly. There are many different layers that can be attacked.

Allowlists aren't sufficient because URLs can be obfuscated. Good allowlists don't block redirects. And even that still allows DNS rebinding.

We built an OSS library for Python users to never have to deal with this again: https://github.com/tachyon-oss/drawbridge

And here's our full blog on the issue: https://tachyon.so/blog/ssrfs-trickiest-issue

Hey everyone,

I've been working on a Burp Suite extension for comprehensive API security testing and wanted to share it with the community. It's completely free and works with both Burp Community and Pro.

**What it does:**

Automates API reconnaissance and vulnerability testing. It captures API traffic, normalizes endpoints (like `/users/123` → `/users/{id}`), and generates intelligent fuzzing attacks across 15 vulnerability types.

**Key features:**

- Auto-captures and normalizes API endpoints

- 15 attack types with 108+ API-specific payloads (SQLi, XSS, IDOR, BOLA, JWT, GraphQL, NoSQLi, SSTI, XXE, SSRF, etc.)

- Built-in version scanner and parameter miner

- Exports to Burp Intruder with pre-configured attack positions

- Turbo Intruder scripts for race conditions

- Integrates with Nuclei, HTTPX, Katana, FFUF, Wayback Machine

**Why I built it:**

I got tired of manually testing APIs for the same vulnerabilities repeatedly. This extension automates endpoint enumeration, attack generation, and integrates with external tools for comprehensive testing.

**Example workflow:**

1. Proxy target through Burp

2. Browse/interact with the API

3. Go to "Fuzzer" tab → Generate attacks

4. Send to Burp Intruder or export Turbo Intruder scripts

5. Review results

The extension also has tabs for Wayback Machine discovery, version scanning (`/api/v1`, `/api/v2`, `/api/dev`, etc.), and parameter mining (`?admin=true`, `?debug=1`, etc.).

**GitHub:** https://github.com/Teycir/BurpAPISecuritySuite

It's MIT licensed, so feel free to use it however you want. Would love to hear feedback or feature requests if anyone tries it out.

---

**Note:** This is a tool I built for my own security testing work and decided to open source. Not affiliated with PortSwigger.

Hello Team,

I am a security researcher and I founded this vulnerability.

I just sent a forged email to my email address that appears to originate from <mydomain>. I was able to do this because of the following DMARC record:

DMARC record lookup and validation for: mydomain " No DMARC Record found "

How To Reproduce(POC-ATTACHED IMAGE):-

1.Go To- mxtoolbox.com/DMARC.aspx

2.Enter the Website.CLICK GO.

3.You Will See the fault(DMARC Quarantine/Reject policy not enabled)

Fix:

1)Publish DMARC Record.

2)Enable DMARC Quarantine/Reject policy

3)Your DMARC record should look like

"v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:[email protected]"

I've read a while ago about someone doing HTTP header request overflow so that it was injecting the remaining data to the next request. I think he was exploiting the fact this server didn't validate content-size and actual content. I'm looking for some book or document about this domain but not sure which keywords to look for

We can read about numerous successful attacks on well-known web applications on a weekly basis. Reason enough to study the background of "Web Application Security" of custom-made / self-developed applications - no matter if these are used only internally or with public access...

https://www.hissenit.com/en/blog/secure-programming-of-web-applications-sql-code-injection.html

I’ve released Wirebrowser, a desktop app for browser-based HTTP interception (using CDP instead of a proxy MITM) and JavaScript memory analysis — inspect heap snapshots and traverse runtime objects.

• Intercept and modify requests and responses in-flight

• Replay traffic (similar to Burp’s Repeater)

• Inspect heap snapshots and runtime JS objects (memory inspection)

• Run automation scripts via CDP or Node.js (with full Puppeteer access)

Curious if this approach could fit into your testing/exploitation/debugging workflow. Feedback appreciated.

Found this on X

Hahaha🙈🙉🙊

Hey guys,

I've been working on tightening up some server configs recently and came across this small open-source project: nginx-defender.

It monitors NGINX access logs in real time, detects suspicious request patterns (e.g., excessive hits in a short window, known exploit strings, bad actors hammering login endpoints), and automatically adds those IPs to your NGINX deny list, no complex fail2ban setup required.

A few things I like about it are that it's lightweight meaning it just runs alongside your existing NGINX deployment. No heavy dependencies makes it easy to drop into production or staging. Real-time blocking also adds threat mitigation happens immediately. It also keeps NGINX configs clean by managing a separate deny list file.

I tested it on a box exposed to the internet and it blocked multiple botnet-style probes within hours. For small to medium deployments or self-hosted apps, it’s a quick win for reducing malicious traffic without adding extra layers.

GitHub link:
https://github.com/anipaleja/nginx-defender

Curious what the rest of you are using for lightweight intrusion prevention or NGINX hardening. any other tools worth trying?

Is there a way to detect when a header suffers some modification or manipulation?

I was thinking of hashing the headers and their content and using that hash as ID, what do you guys think?