I am quite puzzled by how to test my rails app for the YAML vulnerability
first, I upgraded to the latest rails 3.2.11, and I tried this
It gave me
not likely to be vulnerable or URIPATH must be set
which should be reasonable since I upgraded to the latest rails.
But I checked another rails app which I abandoned long time ago, which I know isn't patched. I got the same result. Note that both of my apps run on heroku.
What is the difference between RHOSTS and VHOST and URI? Should RPORT be the http port or should it be the port that the webserver is running?