Maliciously Monetizing AppSec Feature. Its All About The Money.
summary
Akamai traffic analysis claims open redirects are being weaponized for SEO at scale, not phishing, revealing 1,000 IPs that abuse 4,000 vulnerable apps to push links to 10,000 domains. Indexed evidence comes from 85 billion daily requests and ~9.4% bot traffic; attackers use headless browsers like PhantomJS, proxies and serialized phpinfo injections. Detection uses log regexes, domain-counting and template signatures; defenses include disabling open redirects or whitelists, robots/meta nofollow, rate limits and captchas.
AI-written summary · about
chapters (8)
- 0:00Start
- 9:51Security Data Intelligence
- 12:24The Motivation of Death Attack
- 14:17Access Logs
- 17:19Exploit in the Php Info Function
- 21:16Ensure that There Are no Exercise nor Html Injections on Your Website
- 22:27Web Harvesting or Web Extraction
- 33:07Call for Action
related talks
49mAre you human or a damn bot?
52mKnock Knock: Understanding Who is Using Your Web Applications
54mDetecting and managing bot activity more efficiently
54mModern Malvertising and Malware web-based exploit campaigns
55mModern Malvertising ...
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
46mNavigating The Landscape Of Client-Side Request Hijacking On The Web
33mSpotlight On Latest Web Application and API Attack Data