Questions tagged [ruby]
The ruby tag has no usage guidance.
51
questions
11
votes
2
answers
45k
views
Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?
I was looking at this code and came across these comments which says encrypting without a salt is insecure. Why would it be insecure when you are already using a random IV for each value? I think the ...
- 1,758
11
votes
2
answers
3k
views
What unique risks does MVC model binding bring to a website? What additional vigilance is needed?
From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
- 50.9k
10
votes
4
answers
1k
views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
- 209
8
votes
3
answers
8k
views
ruby on rails pentesting web applications
I am currently testing a RoR web application, but I am honestly at a bit of a loss, I have never gone up against a RoR application before and I was wondering if there were any specific tools I could ...
- 4,355
7
votes
2
answers
36k
views
Why does OpenSSL not include AES-256-GCM? [closed]
I'm trying to implement AES-256-GCM in Ruby.
Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this.
However, neither 0.9.8r (which I had ...
- 279
6
votes
2
answers
2k
views
What risks are involved with installing gems from rubygems.org? Are alternatives safer?
Normally, when installing a Ruby gem, I'd ask my system admin to do
sudo gem install gemname
However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm ...
- 2,102
6
votes
2
answers
1k
views
How does the Meterpreter load modules?
I've been using the Meterpreter for some time and I'm still quite new to it and one of the questions I have is how it's module loading works.
Correct me if I'm wrong as I'm still learning how to use ...
- 183
6
votes
1
answer
1k
views
Ruby Devise salt exposed
The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded.
For example:
remember_user_token=...
- 409
6
votes
1
answer
614
views
Password security when connecting to ldap with rails application
How do you store a username/password securely in a rails app when using it for many ldap searches?
The connection in the app requires
ldap_bind_authenticate(Net::LDAP.new, username, password)
each ...
- 272
5
votes
8
answers
6k
views
How should I securely generate random passwords when importing new users?
I need to generate random passwords when importing new users from an external source. I'm currently doing it by taking a random assortment of 8 lowercase/uppercase letters, and numbers. I am also ...
- 235
5
votes
2
answers
2k
views
Could the bcrypt-ruby binding be vulnerable?
While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...
- 267
5
votes
2
answers
5k
views
Ruby resources for Penetration testing/testers and ethical hackers [closed]
I'm wondering if there is a place where I can find up-to-date information regarding ethical hacking with Ruby. I do find lot of Python information, which is OK, but I have 4 years of experience coding ...
- 281
4
votes
2
answers
1k
views
Can anybody recommend any gems for checking security vulnerabilities? [closed]
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
- 175
4
votes
1
answer
335
views
Does Apple maintain the security of the built-in Ruby?
Does Apple maintain the security of the Ruby implementation that comes by default in OS X?
I recently heard about CVE-2013-4073, but when I ran "Software Update..." on my OS X Lion box, it didn't ...
- 2,102
4
votes
0
answers
249
views
Is Marshal.load safe for Marsha.dumped data
I want to serialize and deserialize models that contain user input. Marshal is a serialization library built into Ruby.
By design, ::load can deserialize almost any class loaded into the Ruby process....
- 195
3
votes
1
answer
233
views
Possibility of SQLI in the following request?
I was testing an web application which is written in Ruby, Rails framework, when I stumbled on the following request which was sent. I modified the request and now it displays me a part of the query ...
- 131
3
votes
3
answers
709
views
Plain text Rails environment variables and security
I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "...
- 31
3
votes
0
answers
476
views
How does the Ruby on Rails CSRF Protection Work?
I am not sure i completely understand how Ruby on Rails handles CSRF protection.
My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
- 281
2
votes
1
answer
2k
views
AES encryption between Java and Ruby: what is the default mode and padding for AES in Java?
I'm writing a ruby app that needs to create some encryption that our java app needs to be able to decrypt. For this I have done some research, and I have this Java code now:
Cipher cipher = Cipher....
- 281
2
votes
1
answer
441
views
Can we join a table in this Ruby on Rails Direct Object Reference?
I am trying to inject a RoR application... I have found a nice command which will allow me to delete things unchecked...but the problem is that its not a problem its a very minor point, to make it a ...
- 4,355
2
votes
1
answer
123
views
How does CVE-2013-4287 make Rubygems any more vulnerable?
I've recently heard about CVE-2013-4287, which can cause denial of service due to CPU consumption.
But earlier this year, I attended Hacking with Gems which showed all kinds of weird and wonderful ...
- 2,102
2
votes
1
answer
1k
views
Restriction to ui panel on BeEF+Bettercap generates error login
I'm not sure if I discovered a possible bug. I already reported to Bettercap's staff on their Bettercap's Github but as you can see on that link, it seems the problem is not on Bettercap's side. Maybe ...
- 5,285
2
votes
1
answer
123
views
Is Ruby's SQL Injection protection enough to warrant not using additional security measures?
In my experience, SQL Injection is always a threat. If bad actors don't penetrate via SQL, they get enough data to launch bruteforces via MBASentry or do privilege escalation via scripts. However, I ...
- 123
2
votes
0
answers
305
views
Ruby Active Storage blob keys?
What are the security impacts of revealing the keys to the user? I googled around and only found the ruby documentation. But did not find any article on how it affects security. Is it just because of ...
- 21
2
votes
0
answers
398
views
Arp Spoofing detection with Ruby [closed]
I am planning to develop a Ruby script that detects ARP spoofing attacks on a local network, I have a few questions about it. There are three scenarios I am taking into consideration:
First idea as ...
- 121
2
votes
0
answers
312
views
What is the purpose of OpenSSL::X509::ExtensionFactory [closed]
Why standard library of ruby suggests to create factory and only then add extensions to certificate ?
ef = OpenSSL::X509::ExtensionFactory.new
ef.subject_certificate = our_cert
ef.issuer_certificate =...
- 203
2
votes
0
answers
505
views
Token based authentication: Why invalidate the token after each request?
I use the gem devise_token_auth while developing an API for a mobile app.
Authors claim that:
Tokens should be invalidated after each request to the API.
This behavior is enabled by default.
Can ...
- 131
2
votes
1
answer
136
views
How to verify Ruby on Rails projects are at current patch levels?
I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
- 233
1
vote
2
answers
4k
views
Zap Proxy - script to modify headers automatically
Hello just wondering if someone already wrote a script for Zap to modify headers automatically with out me having to do it on each response/request..
example.
modify response from 3xx or 4xx to 2xx to ...
- 281
1
vote
1
answer
3k
views
SQL injection in find_by Active Record RoR 4
I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0.
Now, I have limited experience with RoR so please ...
- 1,522
1
vote
2
answers
119
views
exploiting the scenario and how to generate a secure reset password token
I am using the following line of code to create a reset password code sent to the user in her/his email. when scanned with brakeman to my ruby code, this line of code is catched and describes it as it ...
- 131
1
vote
1
answer
400
views
How to transfer the `id` more securely in Rails project?
I checked my rails project with a brakeman, and received warning.
Potentially dangerous key allowed for mass assignment:
params.require(:inspector_id)
class ReportsController < ...
1
vote
1
answer
2k
views
"SSL: CERTIFICATE_VERIFY_FAILED" with my own certificates
Two sites. Only one works.
I have two SSL-enabled sites running on Heroku, both of which provide APIs. I bought the SSL certificates from different sources.
When I use Ruby and Python to make some ...
- 11
1
vote
1
answer
191
views
Implement GPG Verification (Bitcoin-OTC)
I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...
- 113
1
vote
1
answer
7k
views
Checking if current user exists before executing code
In one of my controllers I have this method:
def method_name
if current_user
@model = Model.find(params[:id])
if @model.destroy
flash.alert = 'Model deleted successfully'
...
- 111
1
vote
2
answers
488
views
What is an XML round trip vulnerability?
I keep hearing about the XML round trip vulnerability in version 3.2.4 of the Ruby package REXML. I looked into it myself, of course, and it seems to have something to do with parsing an XML document, ...
- 200
1
vote
0
answers
164
views
Odd rails filter allows <script> tag but not <% %>
I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
- 43
1
vote
1
answer
296
views
sample .apk file fore testing the Directory traversal vulnerability [closed]
I am looking to get a .apk file for testing the Directory traversal vulnerability.
https://github.com/rubyzip/rubyzip/issues/315
We have upgraded the rubyzip gem to address this issue. And I want ...
- 13
1
vote
0
answers
212
views
Metasploit Plugin not interacting with Meterpreter Client
I'm developing a plugin to automate some post exploitation tasks. Two days ago all methods that interact with the client (from the client_core and stdapi) simply don't return anything, like if in a ...
- 11
1
vote
0
answers
2k
views
Converting Metasploit module to standalone Python script [closed]
How easy is to convert Ruby code to Python code and to change Metasploit module into standalone Python script for Linux?
- 119
0
votes
1
answer
518
views
I get the feeling that Microsoft and Mac use two different forms of AES
I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft.
And I need to decode this encryption with Ruby's SSL::Cipher class .
The problem is ...
- 101
0
votes
1
answer
222
views
Ruby on Rails: Request to http://\localhost/admin/config.php
I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php
This is the notification:
-------------------------------
Request:
------------------------...
- 103
0
votes
2
answers
345
views
Analysing a MetaSploit Exploit, can't figure out why a function is not executing
I'm studying a MetaSploit Exploit vnc_keyboard_exec, and I was wondering where is defined the function cmd_psh_payload (line 141).
So I greped through msf/core directory on my Kali machine and found ...
- 23
0
votes
2
answers
329
views
Is injecting a second Authenticity_Token on a login request considered a security threat?
I'm running a security test on a website. The login request looks like this:
POST /sessions HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/...
- 397
0
votes
1
answer
247
views
How do I prevent my Rails application from attack? [closed]
My website is being nuked by new signups and new posts some of which don't even have user.id associated with.
How do I solve this? What code should I add to the user#new page and/or post#new page.
...
0
votes
1
answer
1k
views
Rails File.open(#{Rails.root}) is vulnerable to LFI?
I am performing White Box testing on Rails application with static code analyzing tools like brakeman, I came across an instance where the developer is loading images using file.open.
file = File....
0
votes
1
answer
399
views
is there any need to encrypt sensitive images in a database?
I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified. ...
- 103
0
votes
1
answer
290
views
Metasploit Ruby Scripting: Problem with framework.db.creds
I am trying to access the credentials I have gathered so far with Metasploit in a Ruby-Resource script. Unfortunately I get the following error when I try to access framework.db.creds.
>> ...
- 1
0
votes
0
answers
187
views
How do I catch metasploit session scripts error code in ruby?
I was able to start a session using metasploit framework (msf6) with an android but after a while being in the session, the meterpreter session closes. Luckily however after a few seconds, another ...
0
votes
1
answer
4k
views
RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)
I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
- 15