The Paraxial.io Blog

Paraxial.io is the only application security and compliance platform made for Elixir. Subscribe for new posts about Elixir and Phoenix security.

Elixir/Phoenix Security Live Coding: Preventing SQL Injection in Ecto

by Michael Lubas

Learn how to prevent SQL injection in Elixir/Phoenix applications during this live coding webinar. The founder of Paraxial.io, Michael Lubas, will walk through an example Phoenix application, showing secure and insecure Ecto code examples, and how an SQL injection attack works.

Continue Reading ->

Elixir Dependency Security: Mix, Hex, and Understanding the Ecosystem

by Michael Lubas

Dependencies in a software project are a frequent source of security concern. The ability to detect outdated packages, and update to the latest version without breaking the project, is necessary for modern teams. In Elixir, dependencies are hosted by the Hex package manager, and managed by the Mix build tool. To better understand the ecosystem, let’s examine the different components in detail.

Continue Reading ->

Announcing Vulnerability Scanning and Management for Elixir

by Paraxial.io

Paraxial.io now supports vulnerability scanning and management for Elixir applications. This is done via a mix task, which can be integrated into your CI/CD pipeline, that uploads the result of each scan to the Paraxial.io backend for tracking and reporting. This fulfills the compliance requirements for a number of security standards, and gives your team actionable metrics on the security of your project.

Continue Reading ->

Rocket Validator Stops Spam Users with Paraxial.io

by Paraxial.io

Rocket Validator helps website owners detect accessibility and HTML issues in their pages. The founder, Jaime Iniesta, was dealing with an annoying problem: spam user registrations. Bots would register for the service, but these signups were spam, not real humans. Jaime decided to create a Paraxial.io account, and create honeypot forms for the bots to submit. What happened next?

Continue Reading ->

Elixir/Phoenix Security: Denial of Service Due to Atom Exhaustion

by Michael Lubas

In Elixir, the atom is a basic type, a constant whose value is its own name. Atoms are often hard-coded, meaning the atom :red appears in source code, and is not dynamically created at runtime or compile time. However, it is possible for your application to accept user input, then create a new atom based on that input, for example:

Continue Reading ->

Paraxial.io on Thinking Elixir Episode 131: Start Securing Elixir and Phoenix

by Paraxial.io

Our founder Michael Lubas was on the Thinking Elixir Podcast this week, discussing Phoenix security and useful resources to get started defending your own applications. https://podcast.thinkingelixir.com/131

Continue Reading ->

Elixir/Phoenix Security: How attackers bypass IP based rate limiting

by Michael Lubas

“Limit the number of login attempts for one IP address to 5 in a 30 second period” is a standard rule for many web applications, and makes sense from the perspective of a site owner dealing with malicious credential stuffing. With the rise of cloud computing, it has become much easier for an attacker to access thousands of different IP addresses, for free, to bypass IP based blocking. This article will use a Phoenix application to demonstrate what the attack looks like, and how Paraxial.io stops it.

Continue Reading ->

Betafi Blocks Bots on Launch Day with Paraxial.io

by Paraxial.io

Betafi is a user research platform that makes it easy to capture and make sense of customer feedback sessions. User interviews, usability testing, and sharing business insights are all supported. Built on Elixir and Phoenix, the team at Betafi was preparing to launch on Product Hunt, and wanted to ensure the big launch day was not disrupted by bot attacks.

Continue Reading ->

Elixir/Phoenix Security: Introduction to Cross Site Request Forgery (CSRF)

by Michael Lubas

Cross site request forgery (CSRF) is a type of vulnerability in web applications, where an attacker is able to forge commands from a victim user. For example, consider a social media website that is vulnerable to CSRF. An attacker creates a malicious website aimed at legitimate users. When a victim visits the malicious site, it triggers a POST request in the victim’s browser, sending a message that was written by the attacker. This results in the victim’s account making a post written by the attacker.

Continue Reading ->

Announcing Elixir and Phoenix Security Consulting Services

by Michael Lubas

As Elixir and Phoenix adoption continues to increase in industry, the need for security expertise has grown as well. Finding engineers with a deep understanding of the Elixir ecosystem, and software security, is a difficult task.

Continue Reading ->

Securing Elixir/Phoenix Applications: 5 Tips to Get Started

by Michael Lubas

There are a number of resources online related to Elixir and Phoenix security, however when it comes to securing your own project, determining where to begin is a difficult task. Here are five recommendations to get started improving the security of your application.

Continue Reading ->

Cross Site Scripting (XSS) Patterns in Phoenix

by Michael Lubas

Cross Site Scripting (XSS) refers to a class of vulnerability in web applications, where an attacker is able to inject a script into the browsing context of a victim. The root cause of this vulnerability is untrusted user input being rendered in a web browser, where JavaScript written by an attacker is executed. If a website has user authentication, and an attacker is able to exploit XSS in the site, the end result is user accounts will be compromised.

Continue Reading ->

Detecting SQL Injection in Phoenix with Sobelow

by Michael Lubas

SQL injection is a type of attack against a web application, where some malicious input is parsed by the underlying database, resulting in an unauthorized operation being performed. This can be the disclosure of sensitive data, modification of the database, or deletion of entire tables.

Continue Reading ->

Elixir code style, a brief example

by Michael Lubas

Write a function in Elixir named build_string that takes 4 arguments:

Continue Reading ->

ElixirConf 2022 Teller Challenge Writeup

by Michael Lubas

At this year’s ElixirConf Teller hosted a challenge in Elixir, write an Elixir client for a banking application to get the secret account number and balance. This is a writeup for the remote attendee instance, if you played this in-person at ElixirConf the setup was different.

Continue Reading ->

Setting User-Agent in Elixir with Finch, HTTPoison, Req, or Tesla

by Michael Lubas

Paraxial.io Printing User Agents

In 1996 Google co-founder Larry Page posted in comp.lang.java, Q: Setting User-Agent Field?. 26 years later, you may still need to set the User-Agent in your project. Here are four examples from the Elixir HTTP clients Finch, HTTPoison, Req, and Tesla.

Continue Reading ->

eBook Release: Inside a Web Bot Attack 🤖

by Paraxial.io

It was an ordinary day at work for Peter, until he saw a spike in login attempts 1,000 times higher than average! Go inside the response to a bot attack and learn how Paraxial.io can keep your business secure.

Click here to get the eBook!

Continue Reading ->

Paraxial.io Featured in ElixirCasts Episode 149

by Paraxial.io

Paraxial.io was featured in the excellent ElixirCasts, a series of video tutorials on Elixir and Phoenix. The episode walks through the installation of Paraxial.io in less than seven minutes, and the configuration of a rule to stop automated credential stuffing attacks.

Click here to watch the episode on elixircasts.io.

Continue Reading ->

Testing a Phoenix application for credential stuffing with Elixir, Floki, and HTTPoison

by Michael Lubas

Credential stuffing is a type of attack performed against web applications, where the attacker uses username/password pairs from a data breach as input to a program, which performs automated login attempts against a victim application. This is a highly effective technique for stealing user accounts, because password reuse is so common.

This post will demonstrate how to test a Phoenix web application to see if credential stuffing from one IP address is possible. If you work on a public-facing web application, and want to improve its security, this is an excellent test. Credential stuffing attacks are easy for attackers to perform, and lead to user accounts getting compromised. If you currently have defenses in place, such as a bot prevention tool, captcha, or custom plugs, this project will reveal discrepancies between how you expect the system to behave, and how it actually does.

Continue Reading ->

🎉 Announcing the Paraxial.io Beta Launch! 🎉

by Paraxial.io

The Paraxial.io Web Interface

Paraxial.io protects your Elixir/Phoenix application from bots attempting automated logins, scraping, and disruption of service. Today we are happy to announce the beta program is open to new users!

Continue Reading ->

Classifying Data Center IP Addresses in Phoenix Web Applications with Radix Trees

by Michael Lubas

A route that blocks data center IPs

Several cloud hosting companies publish the IP address ranges of their services. Examples include AWS, Azure, GCP, Oracle, and DigitalOcean. This information is useful to website owners, because the expected behavior of a client coming from a cloud server is different from a residential IP address. Consider a website that sells concert tickets, and wants to prevent bots from quickly purchasing all available tickets. The website owner notices that when tickets go on sale, hundreds of clients with data center IP addresses are making automated requests, purchasing tickets for resale before real visitors can.

Continue Reading ->

Throttling and Blocking Bad Requests in Phoenix Web Applications with PlugAttack

by Paraxial.io

A credential stuffing attack

Web applications that accept username and password pairs for authentication may experience credential stuffing by malicious clients. We use the term “credential stuffing” to refer to the act of using credentials, taken from a website’s public data breach, to preform many authentication attempts against victim accounts on a different website. This tutorial will demonstrate how to mitigate credential stuffing against a Phoenix Framework application, using PlugAttack.

Continue Reading ->