Hot answers tagged rails
6
Yes. You want Brakeman, a tool that scans your RoR code for security vulnerabilities
I recommend reading the OWASP Ruby on Rails Security Guide.
You could also try any web pen-testing tool; they are not language-specific. There are many of them. They only find low-hanging fruit, not all security problems, but it can't hurt to use them just in case they ...
5
You asked: Am I exposing potential vulnerabilities by exposing the same session cookie to all my users' subdomains?
Answer: It depends, but generally speaking, yes, you could be exposing yourself to some attacks. It depends upon what kind of content you allow on the subdomains (e.g., elmer.acme.com). There are two cases:
If you allow Elmer to put ...
3
It doesn't sound like you were hacked to me, it sounds more likely that Slicehost had some sort of issue temporarily. The SSH message you got means that the key that was sent by the server was different from the one in your cache. Here are possible reasons that come to mind:
- Another server may have been temporarily assigned the IP address, and then the ...
2
Disclaimer: I'm one of the developers at Tinfoil Security. We have a free and quick check at https://www.tinfoilsecurity.com/railscheck.
Tinfoil's check was based off of Metasploit's original probe. I'm curious as to why we came up as vulnerable when Metasploit did not -- feel free to email support@tinfoilsecurity.com or visit us at ...
2
Sorry for a short response, but I'm sure others will fill in eventually.
RPORT most likely means the port that the webserver is running on.
I've not used metasploit for this yet, unless Tinfoil Security uses the same concept, see:
https://www.tinfoilsecurity.com/railscheck
-k0nsl
2
I don't know how Slicehost works, but before considering the worst, I would try to contact them in order to have more information.
As you are saying, you had a 20min down server, and when you tried to connect via SSH during this down time, your SSH key has changed.
It can be an attack, but it's also possible that when a server is down, slicehost still ...
Only top voted, non community-wiki answers of a minimum length are eligible
