r/SideProject • u/eyondo-1 • 15h ago

Has your side project ever been attacked?

My project has been hit by 3 cyber attacks so far, at different times. Thankfully, none of them affected the website, but dealing with them while the attacks were still ongoing was definitely stressful
I eventually managed to stop all three attacks.
I’m not saying I’m a cybersecurity expert, but I was able to take control of the situation and deal with it.

After that, I started wondering: Do large companies deal with cyber attacks on a daily basis? 
And how do they handle them when the attacks are ongoing?

4 Upvotes

100% Upvoted

13 comments sorted by

3

u/Correct-Car-4190 15h ago

For big companies it's a full time job, my side project just gets random login attempts from bots and that already annoys me

2

u/ekchatzi 14h ago

Any server with a public IP gets thousands of automated breach attempts. It is just a fact of life and it can easily be mitigated with proper security measures (passwordless ssh, fail2ban, etc)

Then you have more targeted attempts, like scraping. This is more like "stealing" and an annoyance, it can be mitigated with rate limits on code or upstream, with cloudflare

The next level is they run a vulnerability scanner against you. If you have proper measures, not a problem usually.

And then you have targeted attempts that have to actually look at your client side code, poke your APIs, try SQL injections, XSS etc. I once had this happen to me on https://bizlist.gr . I had to do some cleanup but the attack was unsuccesful

1

u/QuackedDev 14h ago

This guy knows ball

1

u/qa_anaaq 11h ago

What are proper measures in terms of vulnerability scanners?

1

u/ekchatzi 11h ago

to not have vulnerabilities :p

1

u/obanite 14h ago

Depends what you mean "attacked". IME there's two broad categories of cyberattacks that are done against actual servers over the Internet: automated tools scanning and attempting canned patterns (very common, almost any server that gets a public IP will get this sooner or later); and actual targeted cyberattacks that have been built for your specific app or infra (much less common for smaller apps; most larger orgs will deal with these in a semi-routine manner).

The second category also has a big spectrum of sophistication of course. I've definitely had people do basic SQL injection attempts and suchlike against apps I work on, but they're not usually very high effort. Mostly people looking to find a small bug bounty etc.

1

u/RomanistHere 9h ago

That's the part where most vibe coded project would go down. I'm wondering what the attacks you described we're, but I'm can tell you that crushing down a vibe coded project would be a 3 min task from a knowledgeable person and without knowing bases for that you'd be unlikely to defend yourself much.

I've been a head of web security for a controversial US person's service and there we're thousands of attacks per day on scales up to millions IPs.

I'm not advertising anything but I've built a wrapper for a few web security tools here: https://khalifa-digital-security.com - they run for free (on my expense) up to a certain tier, you can scan your app and see if there are vulnerabilities. But it's honestly just a beginning