Hijacking Ruby on Rails apps through exposed "secret" tokens: < Thousands of GitHub repos:

Let Me Github That For You | Lands of Packets

phenoelit.org 21 Dec '12, 4pm

Hijacking Ruby on Rails apps through exposed "secret" tokens: < Thousands of GitHub repos:

This blog post serves as a wrap up of some aspect of the presentation I gave at ZeroNights 2012 . Ruby on Rails (RoR) is atm my favorite piece of software to hunt bugs at. After quite some time spending on looking at Rails apps I figured that I oversaw the most easy way to attack an (Open Source) Rails app for quite a while. Before I come to my main point we'll have to look at both RoR sessions and authentication systems: Ruby on Rails Sessions RoR sessions are by default stored client-side in a cookie. In order to be tamper resistant, this cookie is signed with an SHA-1 HMAC. When the HMAC is missing or the cookie being tampered with RoR will refuse to use the session variables within the cookie. So, let's look at such a cookie, as an example I'll use a Github session cookie: _gh_sess=BAh7BzoQX2NzcmZfdG9rZW4iMStDQWNRZ1l4VlZPb3ZPM3FBYXZWZGtsYzF2NUVENkdaRnhEK1A0QmNqU1k9Og9z...

Full article: http://phenoelit.org/blog/archives/2012/12/21/let_me_gith...

Tweets

@circl_lu » 03 Jan '13, 12pm
[link] "Ruby on Rails Authentication Frameworks" #infosec #security #ror
@robilad » 25 Dec '12, 3pm
"Ruby on Rails (RoR) is atm my favorite piece of software to hunt bugs at." [link]
@caseyjohnellis » 22 Dec '12, 3am
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] ping @wireghoul
@diodesign » 21 Dec '12, 7pm
RT @hdmoore Hijacking Ruby on Rails apps: [link] < Thousands of GitHub repos: [link] Merry Xmas!
@cliffsull » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@hdmoore » 21 Dec '12, 4pm
Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@Ztefan » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@exploitaration » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@zate » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@dogusss » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@__BKM_ » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]
@techpeace » 21 Dec '12, 4pm
RT @hdmoore: Hijacking Ruby on Rails apps through exposed "secret" tokens: [link] < Thousands of GitHub repos: [link]

Let Me Github That For You | Lands of Packets

Hijacking Ruby on Rails apps through exposed "secret" tokens: < Thousands of GitHub repos:

Tweets

Hijacking Ruby on Rails apps through exposed "s...

@adron Next time you are in that situation, che...

What Does Let It Burn Mean? via @DrewMTips

[AJ] SelectHub: Senior Ruby/Rails Developer

Are you a #Ruby (on #Rails) developer in the ar...