Reputation
495
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 8
Newest
 Constituent
Impact
~10k people reached

  • 0 posts edited
  • 0 helpful flags
  • 37 votes cast
Jul
26
awarded  Constituent
Jul
21
comment DDOS - security or operational risk?
Correct, DDoS can also be used to form a breach in a security perimeter .For example, DDoS attacks are used to take down firewalls, which are positioned on edge and likely to be ill equipped to handle large traffic volumes.
Jul
21
awarded  Caucus
Jul
19
comment Content management url security
In re to your 2nd point. Incapsula is a cloud-based WAF, operating on top of a CDN. Both it and CF were repeatedly pentested, this is the most recent comparison. slideshare.net/zeroscience/cloudflare-vs-incapsula-round-2
Jul
19
answered Cloud Based WAF
Nov
12
comment How web application firewalls protect application from DDoS attacks?
@AnonymousPlatypus 750Gbps is how much inbound traffic we can process, not the amount we forward to firewall or to origin. For example, say we have a 100Gbps SYN flood + 100 RPS SQLis to the same site. Flood is filtered 1st and the rest is forwarded to WAF, where the SQLI requests are filtered out. That way WAF is never a SPOF.
Nov
10
comment How web application firewalls protect application from DDoS attacks?
Good answer. The exception to this rule is WAF/anti-DDoS integrated solutions. For example, a company I work for deploys WAF from a CDN network which can process +750Gig per second. This will help against volumetric attacks (amplification and floods) and also filter malicious request to applications.
Sep
24
awarded  Autobiographer
Jul
2
awarded  Yearling
May
1
comment How do crackers upload php scripts to Wordpress' wp-content directory?
Good answer (+1) Remote File Inclusion (RFI) attacks often enabled by themes. Themes with TimThumb related functionality are the most common suspect, still responsible for over 58% of all RFIs in 2013.
Nov
20
comment What can a zombie computer feasibly install and run?
No, but we should have the data to research this and publish a case-study. Thanks for the idea!
Nov
13
answered What can a zombie computer feasibly install and run?
Aug
21
revised Bot detecting by considering request inter-arrival time
deleted 9 characters in body
Jul
2
awarded  Yearling
May
12
revised How to verify the authenticity of Facebook users?
deleted 39 characters in body
Jan
15
answered Are image uploads also vulnerable to sql injection?
Jan
15
revised Bot detecting by considering request inter-arrival time
added 3 characters in body
Jan
14
answered Bot detecting by considering request inter-arrival time
Jan
3
answered How similar are bots regarding their HTTP GET request?
Dec
25
answered How to restrict web access to certain countries