A Pentester's Guide: Osint, Breach Dumps, and Password Spraying

Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by netsectoday on Wednesday April 10, 2019 @03:33PM (#19628006)

> Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

1. Make sure your app requests are logged with the source IP and configure fail2ban to block the really bad offenders.

2. Set up `actionban` and `actionunban` commands in a custom fail2ban banaction.conf file.

3. Use ipset (an iptables extension) for O(log n) lookup against banned IPs in iptables (which affects all input/forward/output network requests).

4. Tadaa!

[ Parent | on HN ]

Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by joeyrideout on Wednesday April 10, 2019 @09:57PM (#19630489)

At first glance I thought you were describing a more traditional network firewall, but with the data from application logs (failed logins, presumably) this becomes a very elegant entry WAF. Very cool!

[ Parent | on HN ]