Find security issues in your Rails applications

Introduce Brakeman - Rails security scanner
#m3dev M3 Tech Talk #24

Transcript

1. Find security issues in your Rails applications
2. self-introduction » ma2ge @twitter » ma2gedev @github
3. Find security issues in your Rails applications
4. !"#
6. Brakeman
7. ⭐1.6k
9. How to use $ gem i brakeman $ brakeman -o output.html
10. Let's try !
11. class FeaturesController < ApplicationController def vulnerable eval params[:code] end end
13. Let's try next case !
14. class FeaturesController < ApplicationController def vulnerable @unsafe_value = params[:code] end end # in view <%= eval @unsafe_value %>
17. Brakeman Plugin https://wiki.jenkins-ci.org/ display/JENKINS/Brakeman +Plugin
19. !"
20. Resources » http://brakemanscanner.org/ » https://github.com/presidentbeef/brakeman » http://brakemanscanner.org/docs/jenkins/
21. end