Your SlideShare is downloading. ×
0
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Brakeman
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Brakeman

210

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
210
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
1
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • \n
  • Transcript

    • 1. BrakemanScan security of your Rails app Romain Sempé @rsempe https://github.com/rsempe
    • 2. Web vulnerabilitiesResults of a recent survey on web apps: - 68% Cross site scripting issues - 32% SQL InjectionHarder to manually test the security when appsgrow larger!
    • 3. E.g SQL InjectionUser.first("login = #{params[:name]} ANDpassword = #{params[:password]}")Inputs: OR 1 = 1SQL query result:SELECT * FROM users WHERE login = OR 1=1AND password = OR 1=1 LIMIT 1;
    • 4. E.g Cross Site Scripting (XSS)<%= "Hello #{params[:name]}" %>Input: <script>alert(attacked)</script>
    • 5. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.
    • 6. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).
    • 7. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).CRSF protection by default withauthenticity_token.
    • 8. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).CRSF protection by default withauthenticity_token.Secure encryption with bcrypt (password_digest).
    • 9. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).CRSF protection by default withauthenticity_token.Secure encryption with bcrypt (password_digest).force_ssl method to ensure https.
    • 10. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).CRSF protection by default withauthenticity_token.Secure encryption with bcrypt (password_digest).force_ssl method to ensure https.No more SQL Injections with ActiveRecord.
    • 11. Rails secure strategyXSS protection: sanitize by default, otherwisehtml_safe.Mass assignment strategy update (notwhitelisted by default).CRSF protection by default withauthenticity_token.Secure encryption with bcrypt (password_digest).force_ssl method to ensure https.No more SQL Injections with ActiveRecord.And much more...
    • 12. A lot of commits aboutsecurity each month onRails!
    • 13. But how/whenmeasuring the securityissues of our Rails
    • 14. Brakeman gemOnly compatible with Rails.Inspect the source code and produce a report.Zero configuration required.Can be run at any stage of the development.
    • 15. Brakeman detections- Cross Site scripting- SQL Injection / Commands Injection- Unrestricted Mass assignments- Unsafe redirects- Unsafe file access- Insufficient model validations- ... and so on!
    • 16. Cost to fix defects Picture from RailsConf 2012 http://brakemanscanner.org/docs/presentations/ Brakeman-RailsConf2012.pdf
    • 17. $ gem install brakeman$ brakeman (-o report.html)
    • 18. Now, coding!
    • 19. Jenkins Integration
    • 20. « Zero warnings doesnot mean zerovulnerabilities » Justin Collins - RailsConf 2012 http://brakemanscanner.org/docs/presentations/ Brakeman-RailsConf2012.pdf
    • 21. http://brakemanscanner.org/https://github.com/presidentbeef/brakeman@brakemanhttp://brakemanscanner.org/docs/presentations/Brakeman-RailsConf2012.pdfhttp://railscasts.com/episodes/358-brakeman

    ×