webhooks.fyi VS webhook-sentry

Very cool article.

I'm one of the creators of https://webhooks.fyi/ and will do a PR to add this one. Thanks!

On the contrary, I like the name. :) And while you might have something that works for your company, it most likely won't meet many other companies needs. You can check webhooks.fyi[0] by Ngrok for the various implementations and edge cases.

[0] https://webhooks.fyi

Hello all! I'm one of the creators of webhooks.fyi over at ngrok.

Happy to answer any questions!

First, yes it's ridiculously hard to build webhooks correctly. There are so many shortcuts that feel "okay" and you don't really think about until you realize that it didn't quite work as you had planned and now you have a gap. We're hoping the site can help people move more of that thinking earlier and make better decisions.

Second, we're missing a bunch of webhooks! While we looked at 100+ in our own research, we only had time to add ~50 to this initial pass. If you'd like to add your favorites, pull requests welcome: https://github.com/ngrok/webhooks.fyi

>Domains that resolve to private IPs: attacker could set up foo.com which resolves to a private IP

There's a clever extension to this attack; a naive way to mitigate it is to do a DNS resolution first to verify it's not a private IP and then do the actual request. An attacker can simply return a public IP on the first DNS resolution (with a 0 TTY) and then return a private IP on the second. This is called a "TOCTOU" (time-of-check time-of-use) vulnerability. I've written about this and other security best practices on my blog here - https://www.ameyalokare.com/technology/webhooks/2021/05/03/s...

I've also built an egress proxy that prevents such attacks here - https://github.com/juggernaut/webhook-sentry

Same caveat applies, use at your own risk :-)