ddactic.bsky.social

I did not expect to write this post. I expected the big-name CDN to dominate the bypass-resistance scoring across our scans. It does not. ddactic.net?ref=bsky

Traditional DDoS tests have a fixed shape. Push volumetric load at the target, verify the scrubbing center absorbs it, produce a report that says the test completed successfully. ddactic.net?ref=bsky

Not all security findings are equal in scope. Application vulnerabilities are usually scoped to one target: fix the input validation on this endpoint, rotate this credential, patch this library version. The blast radius is bounded by the organization that owns the code. ddactic.net?ref=bsky

The thing that surprised me most when I started running DDoS tests professionally was how rarely the failure was at the volumetric layer. ddactic.net?ref=bsky

Every measurement in a DDactic scan started as a question we asked about real production infrastructure. ddactic.net?ref=bsky

A lot of security research ends as a blog post. You find something interesting, write it up, get credit at a conference, move on. That is a legitimate path. The knowledge is public and the community benefits. ddactic.net?ref=bsky

A side effect of building a DDoS resilience testing platform is that we spend a lot of time probing the infrastructure vendors our customers sit behind. To measure whether a protection stack holds, you have to understand how it actually behaves, not how the documentation says it behaves.

A month-end summary because the patterns are too consistent to keep private. ddactic.net?ref=bsky

I want to put a marker down because customers ask us how to evaluate other DDoS tests they receive from vendors and consultants. ddactic.net?ref=bsky

Every recommendation our hardening engine ships carries a strategic doctrine label, and the doctrine matters more than the rule itself. We tag each one with one of four: ddactic.net?ref=bsky

The login endpoint is the most consistently under-protected attack surface we see in customer scans. Most teams know it is a target. Few teams know how to enumerate the specific ways attackers hit it. ddactic.net?ref=bsky

Most rate limits I see in the field are scoped wrong. They limit by source IP. The attacker rotates source IPs. The limit becomes decorative within thirty seconds. ddactic.net?ref=bsky

We ran DDactic's scanner against DDactic. ddactic.net?ref=bsky

The best way to hide your origin is not a CDN proxy. It is a private tunnel. ddactic.net?ref=bsky

"Supports HTTP/2" and "inspects HTTP/2 frames" are not the same sentence. We probed 16 major vendors. The result is uncomfortable. ddactic.net?ref=bsky

The same 10,000 RPS attack needs 10,000 TCP connections on HTTP/1.0. On HTTP/2, it needs 10. ddactic.net?ref=bsky

Every DDoS attack you have ever read about reduces to exhausting one of six resources. Not 200 attack types. Six. ddactic.net?ref=bsky

I did not expect to write this post. I expected the big-name CDN to dominate the bypass-resistance scoring across our scans. It does not. ddactic.net?ref=bsky

Every major application-layer attack class has an HTTP version equivalent. Most defenses are written for HTTP/1.1. The gap is not theoretical. ddactic.net?ref=bsky

במשך כמה שנים ניהלתי בדיקות DDoS. בדקנו סביבות שונות של יצרני הגנות, ועזרתי לחברות להקשיח את תצורת ההגנה והארכיטקטורה שלהן. ddactic.net?ref=bsky

Showing the work of why we ship eight vendor templates instead of one universal one. ddactic.net?ref=bsky

A pipeline detail that explains why our hardening recommendations are never stale. ddactic.net?ref=bsky

A small operational detail we obsess over because it changes whether teams actually apply our recommendations. ddactic.net?ref=bsky

Anonymized but real. An IL insurance company with five enterprise WAF licenses and a multi-million-dollar protection budget. ddactic.net?ref=bsky

A doctrine I want to put on record because we get asked about it almost weekly. ddactic.net?ref=bsky

The taxonomy under our new hardening engine, which I want to share because it doubles as a self-audit checklist. ddactic.net?ref=bsky

Something I keep thinking about from the rate-limit counting post. ddactic.net?ref=bsky

Look at the rate limits on your production WAF right now. ddactic.net?ref=bsky

Your employees' stolen passwords reveal more than compromised accounts. ddactic.net?ref=bsky

Security teams assume TLS fingerprinting blocks bots. ddactic.net?ref=bsky

We reverse-engineered 20 bot detection vendors. ddactic.net?ref=bsky

Every vendor has a different way to tell you you're "protected." None of them give you a number you can compare across vendors, track over time, or use to justify budget. ddactic.net?ref=bsky

You configured a rate limit: 100 requests per 10 seconds. You tested it from your office. It works. An attacker sends 90 requests per 10 seconds from each of 10 different countries. Your CDN sees 900 requests per 10 seconds total but triggers nothing. ddactic.net?ref=bsky

DDoS vendors detect and block attacker IPs within minutes. Static IPs become useless fast. ddactic.net?ref=bsky

Every instance in our fleet runs up to 7 testing tools simultaneously. Each one can crash. ddactic.net?ref=bsky

Our full distributed load generation fleet costs $23.50 per hour. ddactic.net?ref=bsky

We added breach database lookups to our recon pipeline. ddactic.net?ref=bsky

We use Claude Haiku at four specific points across our six-stage recon pipeline. Not for marketing. For accuracy. ddactic.net?ref=bsky

We don't rely on a single source for asset discovery. ddactic.net?ref=bsky

Hot take: "I built this with AI" is usually the wrong message. ddactic.net?ref=bsky

A scrubbing center is not a guarantee. It's a routing decision, and most CISOs blur three different things into one. ddactic.net?ref=bsky

Every TLS certificate you've ever issued is public. ddactic.net?ref=bsky

We scan companies and almost always find the same thing in the subdomain list: ddactic.net?ref=bsky

3 years inside Israeli enterprise DDoS readiness taught me one thing: the internal dashboards almost never match what an outside attacker actually sees. So I went and looked from the outside. ddactic.net?ref=bsky

I built a production-ready cybersecurity SaaS platform in 60 days. ddactic.net?ref=bsky

Most security tools tell you what's wrong. We generate the exact commands to fix it. ddactic.net?ref=bsky

We don't just scan individual companies. We scan entire industries. ddactic.net?ref=bsky

$1.08 billion. ddactic.net?ref=bsky

Every major application-layer attack class has an HTTP version equivalent. Most defenses are written for HTTP/1.1. The gap is not theoretical. ddactic.net?ref=bsky

For a few years I ran DDoS tests. Different vendor environments, different architectures. I would help companies understand their attack surface and tune their defenses. ddactic.net?ref=bsky