diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index c0a10b8..d998974 100755 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -4,7 +4,7 @@ class ApplicationController < ActionController::Base helper_method :current_user # Our security guy keep talking about sea-surfing, cool story bro. - #protect_from_forgery + # protect_from_forgery private diff --git a/app/controllers/tutorials_controller.rb b/app/controllers/tutorials_controller.rb index 4de5cde..9565ce8 100755 --- a/app/controllers/tutorials_controller.rb +++ b/app/controllers/tutorials_controller.rb @@ -32,6 +32,8 @@ class TutorialsController < ApplicationController end def csrf + @meta_code_bad = %{<%#= csrf_meta_tags %> } + @meta_code_good = %{<%= csrf_meta_tags %> } end def misconfig diff --git a/app/views/tutorials/csrf.html.erb b/app/views/tutorials/csrf.html.erb index b88e645..d60acca 100644 --- a/app/views/tutorials/csrf.html.erb +++ b/app/views/tutorials/csrf.html.erb @@ -20,7 +20,7 @@
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +

A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

@@ -34,7 +34,23 @@
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +

Cross-Site Request Forgery (CSRF) - The following code was taken from: /app/controllers/application_controller.rb and /app/views/layouts/application.html.erb

+

application_controller.rb<

+

+ + <%= %{# Our security guy keep talking about sea-surfing, cool story bro.}%> +
<%= %{ + # protect_from_forgery + } + %> + +

+

application.html.erb

+

+ + <%= @meta_code_bad %> + +

@@ -48,7 +64,29 @@
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +

Cross-Site Request Forgery ATTACK:

+

+ Save this content to an .html file and open it... +

+

+ + <%= + %{ + + } + %> + +

+ +

Cross-Site Request Forgery SOLUTION:

+

+ By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. The solution around the JS problem is to add the following code within the header section of the application.html.erb file (or any other application layout file). +

+

+ + <%= @meta_code_good %> + +

diff --git a/app/views/tutorials/xss.html.erb b/app/views/tutorials/xss.html.erb index f204b72..9a43d89 100644 --- a/app/views/tutorials/xss.html.erb +++ b/app/views/tutorials/xss.html.erb @@ -20,7 +20,7 @@
- XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. +

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

@@ -55,6 +55,10 @@

When registering, enter your JavaScript tag such as <%= %{