Other nomination

Cracking Ruby on Rails Session

joernchen · phenoelit.org

Rails keeps sessions in a client-side cookie signed with an HMAC whose secret lives in config/initializers/secret_token.rb, a file developers routinely commit to GitHub. With the secret a session can be forged: authenticated_system falls to user_id=>1, and authlogic falls to a find_by_id hash injecting a :select of "* from users limit 1 --".

Record

Researcher

joernchen

Published by

phenoelit.org

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Related sources

• Researcher’s companion script

Tags

• ruby
• rails
• cookie
• auth-bypass
• sqli
• deserialization
• github
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of joernchen, first published at the original source. Preserved copies are kept so the citation survives its host.