Tag Info

Hot answers tagged

13

Ignore them. They look like automated scripts looking for common vulnerabilities in sites on the Internet. You say your site is built using RoR so the server most likely doesn't contain software like phpmyadmin. You won't be affected.


1

Look up the OWASP Top 10 (which is the most relevant resource for your question) proposed by edvinas.me and the list of Web-oriented attacks covered by fel1x. I don't have good advice for Web server security because I haven't done it in ages, but make sure you keep your servers up to date and that they run with only the privileges they need (separate OS ...


1

Encrypt the database with a key and only store the key in memory Add common security headers. You can look at what other sites use (for example kraken.com) and use the same HTTP headers after reading up on them (short list: HSTS, nosniff, XSS protection, XFO, CSP) Test for XSS Make sure the RoR XSRF protection works Try to find a pentest company to do a ...


1

I'm not sure about your application, but what you seem to be missing is that the user has some sort of control over the model (i.e: the ability to delete it). If your application allows users to be created without any intervention/approval, anyone could create a new user (and thus, have a valid current_user), and remove all objects by just iterating ...


1

Don't trust the URL... since POSTed data may hide what is really going on. The URL should be treated as a client-side value and should not be trusted anyway. Anyone can easily alter the URL and could easily create a POST to any UserID. Anyone who can guess the route variable names in ASP.NET MVC, can put unexpected data into a controller This can ...



Only top voted, non community-wiki answers of a minimum length are eligible