Hands-On Bug Hunting for Penetration Testers

Checking the Version for Particular Weaknesses

As an application framework, Rails, like all popular software, has gotten waves of security updates over the years, addressing critical issues like handling SQL injection from within Active Record, or extending the CSRF protection scheme to include more basic request types. But because the barrier to building a Rails application is so low, and the language and framework are so productivity-friendly, Rails apps are often spun up quickly. And since Rails is a common small business/prototyping solution that is nevertheless often pressed into mature production service, there's a healthy amount of legacy Rails code out there. That combination of a quickly-assembled architecture with expectations of ...