Security challenge solution#1
Open
Mpurushotham wants to merge 3 commits into
Open
Conversation
… Slack response bot Part 1 (CORS): reproduced the credentialed cross-origin data theft and documented root cause, delivery vectors, and prevention (evidence/cors-attack-repro.md). Part 2 (XFF spoofing): proved req.ip is attacker-controllable due to trust proxy: true; documented GCP/LB hop-count fix and edge rate-limiting recommendation (evidence/xff-spoof-repro.md). Parts 3-4: ELK-on-Cloud-Run log pipeline design and hybrid detection approach for the Part 1 attack (REPORT.md). Part 5 (Slack): standalone Bolt Socket Mode bot (slackbot/) with node:sqlite persistence; real detection hook in app.js posts an interactive alert on a credentialed cross-origin request; classification updates the message in place and persists state. Verified end-to-end in the workspace. Evidence: OWASP ZAP baseline scan report + notes (evidence/).
Screenshot of #candidate-purushotham showing three bot alerts classified into the discreet resolved state, corresponding to the persisted SQLite rows.
… stack ARCHITECTURE.md: Mermaid diagrams for the CORS attack flow, hardened GCP target architecture, ELK log pipeline, and the detection-to-Slack SOAR loop; plus key takeaways, a security-automation maturity roadmap, and the tech stack. Linked from REPORT.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Solution to the Security & Infrastructure Engineer challenge (Parts 1–5).
Contents
REPORT.md— written answers for Parts 1–4 (CORS analysis & prevention, XFF spoofing test + GCP/LB fix + rate-limiting recommendation, ELK-on-Cloud-Run log pipeline, and the attack-detection approach).ARCHITECTURE.md— Mermaid diagrams (attack flow, hardened GCP target architecture, log pipeline, detection→Slack SOAR loop), key takeaways, a security-automation roadmap, and the tech stack.slackbot/— Part 5 Slack app:@slack/boltin Socket Mode,node:sqlitepersistence, interactive classification (Cyber attack / Infra instability / False positive) that updates the message in place and stores the event lifecycle.app.js— real detection hook on/json-cors-origin/*: a credentialed cross-origin request (the Part 1 signature) fires the Slack alert automatically.evidence/— reproductions (CORS + XFF), OWASP ZAP baseline report + notes, and a Slack screenshot of resolved alerts.Verified
Full chain proven end-to-end in the workspace: real attack request → detection in
app.js→ interactive Slack alert → human classification →chat.updateto resolved state → persisted in SQLite with classifier + timestamp.Notes
slackbot/, Socket Mode — no public URL needed); secrets are read from an untracked.env(slackbot/.env.exampleshows the shape).