Anti-Scraping Part 1: Core Principles to Deter Scraping

Part two of an anti-scraping series applies rate limits, generic errors, and data caps to a demo message board, then shows how scrapers adapt, proving defense in depth beats any single control.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.

A walkthrough of common login page bypass techniques—SQL injection, response manipulation, forced browsing, default credentials and credential stuffing—and how defenders should counter them.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.