An interview with Satya Nadella on Microsoft’s partnership with OpenAI, using AI in a search engine, the competition with Google, and more (Nilay Patel/The Verge)

Comments Off on An interview with Satya Nadella on Microsoft’s partnership with OpenAI, using AI in a search engine, the competition with Google, and more (Nilay Patel/The Verge)

Nilay Patel / The Verge:
An interview with Satya Nadella on Microsoft’s partnership with OpenAI, using AI in a search engine, the competition with Google, and more  —  I’m coming to you from Microsoft’s campus in Redmond, where just a…

Read More >>

WordPress Login Flooder (DDoS) python script I used on a client to test Fastly VCL misconfig

Comments Off on WordPress Login Flooder (DDoS) python script I used on a client to test Fastly VCL misconfig

Recently, I was pentesting a client site and discovered they had a misconfig’d Fastly VCL. As such, it allowed spoofing, which meant all access logging in BigQuery and GCP log viewer were nearly irrelevant as you couldn’t trust whether or not it listed true origin IP.

To simulate the need to fix this issue, I wrote a simple Python script for spoofing with a DDoS. Unlike most “DDoS” scripts you’ll find in a repo (which don’t utilize zombies and therefore only sends requests from your own machine, aka just a DoS), I included mine to cycle through various proxies for obfuscation.

If the client hadn’t corrected the VCL config, they were susceptible to a potential unstoppable DDoS, as they had no rate-limiting enabled nor could have discovered the true IP if it were spoofed.

Nevertheless, check the script on GitHub and feel free to submit PRs or fork and use it for your own legal purposes.

submitted by /u/n4bb
[link] [comments]

Read More >>