hkr_mag
Joined 13 years ago
Karma
204
Submissions
68
Member since
Nov 20
Wallarm, co-founder
View on Hacker NewsRecent submissions
Comment · 8 years ago
For those who is new to the world of SSRF vulnerabilities, check the SSRF Bible (full disclaimer: I'm with Wallarm): https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUed...
Comment · 8 years ago
This is a list of what you can do for application security with Nginx (mostly with open source tools):
https://github.com/wallarm/awesome-nginx-security
My talk from Nginx conference: https://www.nginx.com/blog/build-application-security-shield...
Important note. Care about vulnerabilities. Not about attacks. Buy Burp license. Run appsec training for all of your developers; it's easy while you're small.
Disclaimer: I am a co-founder of Wallarm mentioned in preso.
Comment · 8 years ago
Awesome job, guys! We have several team members (mostly sales) using Polymail as a default email client.
Comment · 9 years ago
One of the most promising companies among the whole S16 batch. Congatz!
Comment · 10 years ago
+1. Success factor, API.ai, Evernote — three logos from my memory
Comment · 10 years ago
The main idea about Wallarm is to get inner knowledge of how the application works and how users use it. Based on this data, we craft dynamic rules for every single applications or API.
The simplest example is what data transmitted in different parameters of the form field or API calls. For example, it's OK if someone put an SQL Injection payload at Stack-overflow site in the form writing a security-related article. It can be a normal behavior. Meanwhile, SQL injection payload is probably a malicious thing for a login form at your bank website.
We wouldn't ban request only if it is sent with curl. There is a set of different factors and statistics that are taken into the account. E.g. if you run this requests too quickly and it is sent with curl, it can be considered as a malicious activity.