Basic tools to help secure Ruby on Rails applications.

1. @marcusjcarey

3. Information wants to be free.

4. LOG ALL THE THINGS!

7. Burp

8. ZAP

9. Nikto

10. Brakeman

11. Brakeman Pro
It’s kinda hot!

17. Bundler Audit

18. GemCanary

19. Gemfile
# Devise Authentication
gem 'devise'
# Devise zxcvbn for password strength checks
gem 'devise_zxcvbn’
# Devise Security Extension
gem 'devise_security_extension’
# Devise Google Authenticator
gem 'devise_google_authenticator', '0.3.16'

22. User Model
class User < ActiveRecord::Base
…
end

23. Team Model
class Team < ActiveRecord::Base
has_many :users, dependent: :destroy
…
end

24. User Model with Team
class User < ActiveRecord::Base
belongs_to :team
…
end

25. set_contact
…
private
def set_contact
@contact = current_user.contacts.find_by(:uuid =>
params[:id])
end
…

26. set_contact with Team
…
private
def set_contact
@contact = current_user.team.contacts.find_by(:uuid =>
params[:id])
end
…

27. UUID Usage
class Contact < ActiveRecord::Base
belongs_to :team
before_create :create_uuid
def to_param
uuid
end
private
def create_uuid
begin
self.uuid = SecureRandom.uuid
end while self.class.exists?(:uuid => uuid)
end
end

28. current_user
# GET /contacts/new
def new
@contact = current_user.contacts.new
end
# GET /contacts/1/edit
def edit
end
# POST /contacts
# POST /contacts.json
def create
@contact =
current_user.contacts.new(contact_params)

29. current_user with Team
# GET /contacts/new
def new
@contact = current_user.team.contacts.new
end
# GET /contacts/1/edit
def edit
end
# POST /contacts
# POST /contacts.json
def create
@contact =
current_user.team.contacts.new(contact_params)

30. RailsConf 2015
• The World of Rails Security
• Metasecurity: Beyond Patching Vulnerabilities

31. vthreat.com
@vthreat
marcus@vthreat.com or alex@vthreat.com