BlackHat presentation demo vids: SalesForce Sifto

This write-up demonstrates how an attacker can abuse Force.com developer accounts to run a distributed web-scanning application (Sifto) by porting Nikto into Apex, using event-loop processing, automating account registration (including a CAPTCHA bypass), and auto-configuring allowed endpoints; the authors measured large-scale scanning throughput (≈3000 tests in ~11 minutes) as a proof-of-concept for abusing free cloud resources.