new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

abuse_cases/monitoring

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Continuous DNS monitoring best practices

Implement ongoing DNS monitoring to catch dangling records before attackers do: (1) Compare DNS records against live resources by verifying every CNAME target still exists and responds with expected content rather than a cloud provider error page; (2) Monitor for service fingerprints by scanning for the error responses listed in the service fingerprints table, at least weekly; (3) Track DNS zone changes using version-controlled DNS management (e.g., Terraform, OctoDNS, DNSControl) to create an audit trail; (4) Monitor Certificate Transparency logs using services like crt.sh or certspotter to alert on any certificate issuance for your subdomains.

Indicators of compromise for subdomain takeover

Signs that a subdomain may have already been taken over: (1) Subdomain suddenly serves unexpected content, a parking page, or a different application than expected; (2) SSL/TLS certificate for the subdomain was issued to an unknown entity or organization (visible in Certificate Transparency logs); (3) Users report phishing emails or pages appearing to come from the subdomain; (4) Web application firewall or proxy logs show the subdomain resolving to an IP address outside known infrastructure ranges; (5) DMARC aggregate reports show email being sent from the subdomain that the organization did not originate.

C9 Implement Security Logging and Monitoring controls

C9 Implement Security Logging and Monitoring includes: REST Security Cheat Sheet (Audit Logs) and Logging Cheat Sheet.

Give your agent this brain