Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Talks #9 Rails Vulnerabilities

Avatar for Teodor Pripoae Teodor Pripoae
April 18, 2013
52
0

Talks #9 Rails Vulnerabilities

Avatar for Teodor Pripoae

Teodor Pripoae

April 18, 2013

More Decks by Teodor Pripoae

See All by Teodor Pripoae
PaaS - pros and cons
Avatar for Teodor Pripoae teodorpripoae
0
360

Featured

See All Featured
Dominate Local Search Results - an insider guide to GBP, reviews, and Local SEO
Avatar for Greg Gifford greggifford
PRO
0
370
<Decoding/> the Language of Devs - We Love SEO 2024
Avatar for Nikki Halliwell nikkihalliwell
1
360
Lightning Talk: Beautiful Slides for Beginners
Avatar for Ines Montani inesmontani
PRO
2
730
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.8k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
230
23k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
270
14k
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
570
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
260
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
Avatar for panda_program panda_program
123
22k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
600
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
8.4k

Transcript

  1. Vulnerabilitati de securitate in Ruby on Rails Teodor Pripoae Thursday,

    April 18, 13

  2. De ce ? Thursday, April 18, 13

  3. 1. Mass assignment Thursday, April 18, 13

  4. 2. CSRF via Leaky #match routes Thursday, April 18, 13

  5. XSS via link_to home_page_url (xss via personal url) Thursday, April

    18, 13

  6. 4. SQL Injection Thursday, April 18, 13

  7. 5. Logging passwords Thursday, April 18, 13

  8. 6. Binding to 0.0.0.0 on dev Thursday, April 18, 13

  9. 7. Versioned secret tokens Thursday, April 18, 13

  10. 8. File vulnerabilities Thursday, April 18, 13

  11. 9. User readable sessions Thursday, April 18, 13

  12. 10. XSS via Regular expressions Thursday, April 18, 13