VirtualTam's bookmarks

1. h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c) 2024-11-04

   tags: network/http, network/reverse-proxy, programming/go, security, websocket

   [ permalink ]

   • BishopFox/h2csmuggler
2. smallstep/certificates - A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management 2024-05-27

   tags: cryptography/certificate, cryptography/certificate-authority, network/http, network/http-server/traefik, network/reverse-proxy, network/transport-layer-security, programming/go

   [ permalink ]

   • Run a private online TLS certificate authority in a Docker container
   • Configure popular ACME clients to use a private CA with the ACME protocol
   • Run your own private CA & ACME server using step-ca
   • Build a Tiny Certificate Authority For Your Homelab
3. Poorconn: Simulating Poor Network Conditions 2024-03-10

   tags: network/proxy, programming/python, programming/python/pytest, programming/testing/integration, quality-of-service

   [ permalink ]

   • xuhdev/poorconn
   • poorconn - Pytest plugin
4. Comcast Proxy - Simulating shitty network connections so you can build better systems 2024-03-10

   tags: network/proxy, programming/go, programming/testing/integration, quality-of-service

   [ permalink ]

   • Sometimes Kill -9 Isn’t Enough
5. toxiproxy - A TCP proxy to simulate network and system conditions for chaos and resiliency testing 2024-03-10

   tags: network/proxy, network/tcp, programming/go, programming/ruby, programming/testing/integration, quality-of-service

   [ permalink ]

   • Building and Testing Resilient Ruby on Rails Applications
6. How to Redirect a Domain to Another Domain with Traefik 2024-01-21

   tags: network/http, network/http-server/traefik, network/reverse-proxy

   [ permalink ]

   • Traefik Middleware - RedirectRegex
7. HAProxy - TLS Termination Setup 2023-07-24

   tags: cryptography/encryption, network/http, network/http-server/haproxy, network/reverse-proxy, network/transport-layer-security, security

   [ permalink ]

   • Traffic Routing - Rewrite Requests
   • Client IP Preservation - X-Forwarded-For
   • HAProxy & HTTP Strict Transport Security (HSTS)
   • Secure Cookies Using HAProxy Enterprise
8. Reining in the thundering herd ⛈ Getting to 80% CPU utilization with Django 2021-08-19

   tags: framework/django, gunicorn, network/http, network/http-server/haproxy, network/http-server/nginx, network/reverse-proxy, programming/python, protocol/fastcgi, uwsgi, web, wsgi

   [ permalink ]

   • https://rachelbythebay.com/w/2020/03/07/costly/
   • https://docs.gunicorn.org/en/stable/faq.html#does-gunicorn-suffer-from-the-thundering-herd-problem
   • https://uwsgi-docs.readthedocs.io/en/latest/articles/SerializingAccept.html
   • https://uwsgi-docs.readthedocs.io/en/latest/Options.html
   • https://web.archive.org/web/20160117023812/http://cramer.io/2013/06/27/serving-python-web-applications
   • https://circus.readthedocs.io/en/latest/
9. Load Balancing PHP-FPM with HAProxy and FastCGI - HAProxy Technologies 2021-08-19

   tags: network, network/http, network/http-server/haproxy, network/reverse-proxy, programming/php, protocol/fastcgi

   [ permalink ]
10. Kubernetes basic authentication with Traefik - Stack Overflow 2020-12-21

    tags: linux/container/kubernetes, network, network/http, network/reverse-proxy, security/authentication

    [ permalink ]
11. Introduction to HAProxy Logging - HAProxy Technologies 2020-12-11

    tags: network/http, network/http-server/haproxy, network/reverse-proxy, network/tcp, observability/logging

    [ permalink ]

    • https://www.haproxy.com/documentation/hapee/latest/administration/docker-logging/
12. Enhanced SSL Load Balancing with Server Name Indication (SNI) TLS Extension - HAProxy Technologies 2020-12-11

    tags: network/dns, network/http-server/haproxy, network/reverse-proxy, network/server-name-indication, network/tcp, network/transport-layer-security

    [ permalink ]

    • https://discourse.haproxy.org/t/req-ssl-sni-and-ssl-termination/2139/3
    • com/@olivier.ragain/haproxy-https-load-balancing-on-sni-207c17398d19
13. What is "AWS Security Scanner" in my server logs? 2020-07-31

    tags: cloud/aws, network, security

    [ permalink ]

    • https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
    • https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
    • https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html
    • https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
    • https://aws.amazon.com/blogs/aws/new-host-based-routing-support-for-aws-application-load-balancers/
    • https://aws.amazon.com/about-aws/whats-new/2018/07/elastic-load-balancing-announces-support-for-redirects-and-fixed-responses-for-application-load-balancer/
    • https://www.reddit.com/r/aws/comments/e18e5n/botexploit_what_is_this_trying_to_do_and_how
    • https://www.reddit.com/r/aws/comments/e18e5n/botexploit_what_is_this_trying_to_do_and_how/f8qympp/
    • https://forums.aws.amazon.com/thread.jspa?threadID=316889
    • https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    • https://www.wired.com/story/capital-one-paige-thompson-case-hacking-spree/
    • https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
    • https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/
    • http://www.thecloudavenue.com/2019/08/how-capital-one-hack-was-achieved-in-aws.html
    • http://www.thecloudavenue.com/2019/11/changes-to-aws-ec2-instance-metadata-service.html
14. Docker and Kubernetes userland proxies, versus exposing wide port ranges 2020-01-24

    tags: linux/container, linux/container/docker, linux/container/kubernetes, network, network/tcp, network/udp, performance

    [ permalink ]

    Docker:

    • https://github.com/moby/moby/issues/9021
    • https://github.com/moby/moby/issues/11185
    • https://github.com/moby/moby/issues/11185#issuecomment-245983651
    • https://github.com/moby/moby/issues/19017
    • https://github.com/docker/for-mac/issues/2670#issuecomment-372365274

    Kubernetes:

    • https://github.com/kubernetes/kubernetes/issues/1802
    • https://github.com/kubernetes/kubernetes/issues/23864
    • https://github.com/kubernetes/kubernetes/issues/23864#issuecomment-387070644

    Disabling userland proxy:

    • https://github.com/moby/moby/issues/5618
    • https://github.com/moby/moby/issues/14856
    • https://github.com/moby/moby/issues/11185#issuecomment-129085898

    Threads:

    • https://stackoverflow.com/questions/28717464/docker-expose-all-ports-or-range-of-ports-from-7000-to-8000
    • https://www.percona.com/blog/2016/02/05/measuring-docker-cpu-network-overhead/
    • https://forums.docker.com/t/exposing-large-range-of-ports-is-not-viable/20127/5
15. Athens | A Go Module Proxy 2019-12-03

    tags: continuous-integration, dependency, network/http, network/proxy, programming/go, storage/cache

    [ permalink ]

    • https://github.com/gomods/athens
    • https://arslan.io/2019/08/02/why-you-should-use-a-go-module-proxy/
    • https://golang.org/cmd/go/#hdr-Module_proxy_protocol
16. apt - Import the repository signing key behind a proxy - Ask Ubuntu 2019-10-16

    tags: cryptography/pgp, cryptography/pgp/gnupg, gpg, network/http, network/ldap, security

    [ permalink ]
17. ModSecurity: Open Source Web Application Firewall 2019-09-17

    tags: apache, network, network/http-server/apache-httpd, network/proxy, security, web

    [ permalink ]

    • https://github.com/SpiderLabs/ModSecurity
    • https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu
18. NAXSI - an open-source, high performance, low rules maintenance WAF for NGINX 2019-09-17

    tags: linux/kernel, network, network/http, network/http-server/nginx, network/proxy, security

    [ permalink ]

    • https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-naxsi-on-ubuntu-14-04
19. Pomerium, a standardized interface to add access control whether an application itself has authorization or authentication baked-in 2019-09-16

    tags: network/http, network/proxy, programming/api, security, security/authentication, user, web

    [ permalink ]

    • https://github.com/pomerium/pomerium
20. API Gateways and Service Meshes: Opening the Door to Application Modernisation 2019-07-15

    tags: consul, envoy, linux/container/docker, linux/container/kubernetes, network/http, network/proxy, programming/api

    [ permalink ]