From 51aa8701f229b99235af74676cf36fde03f07bcb Mon Sep 17 00:00:00 2001 From: Ken Johnson Date: Thu, 23 May 2013 16:55:27 -0400 Subject: [PATCH] refactoring tutorial instances into partials for extensibility --- .../crypto/_password_hashing.html.erb | 67 +++++++++++ .../tutorial/csrf/_csrf_first.html.erb | 103 +++++++++++++++++ app/views/tutorials/crypto.html.erb | 72 +----------- app/views/tutorials/csrf.html.erb | 108 +----------------- 4 files changed, 176 insertions(+), 174 deletions(-) create mode 100644 app/views/layouts/tutorial/crypto/_password_hashing.html.erb create mode 100644 app/views/layouts/tutorial/csrf/_csrf_first.html.erb diff --git a/app/views/layouts/tutorial/crypto/_password_hashing.html.erb b/app/views/layouts/tutorial/crypto/_password_hashing.html.erb new file mode 100644 index 0000000..acd4113 --- /dev/null +++ b/app/views/layouts/tutorial/crypto/_password_hashing.html.erb @@ -0,0 +1,67 @@ +
+
+
+ A7 - Insecure Cryptographic Storage +
+
+
+
+
+
+ + + + Description + +
+
+
+ Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +
+
+
+
+
+ + + + Bug + +
+
+
+ Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +
+
+
+
+
+ + + + Solution + +
+
+
+ Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +
+
+
+
+
+ + + + Hint + +
+
+
+ Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +
+
+
+
+
+
\ No newline at end of file diff --git a/app/views/layouts/tutorial/csrf/_csrf_first.html.erb b/app/views/layouts/tutorial/csrf/_csrf_first.html.erb new file mode 100644 index 0000000..e56c42e --- /dev/null +++ b/app/views/layouts/tutorial/csrf/_csrf_first.html.erb @@ -0,0 +1,103 @@ +
+
+
+ A5 - Cross Site Request Forgery (CSRF) +
+
+
+
+
+
+ + + + Description + +
+
+
+

A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

+
+
+
+
+
+ + + + Bug + +
+
+
+

Cross-Site Request Forgery (CSRF) - The following code was taken from: /app/controllers/application_controller.rb and /app/views/layouts/application.html.erb

+

application_controller.rb<

+

+ 

+				 # Our security guy keep talking about sea-surfing, cool story bro.
+				 # protect_from_forgery
+
+ +

+

application.html.erb

+

+ 

+					<%= @meta_code_bad %>
+
+

+
+
+
+
+
+ + + + Solution + +
+
+
+

Cross-Site Request Forgery ATTACK:

+

+ Save this content to an .html file and open it... +

+

+ + <%= + %{ + + } + %> + +

+ +

Cross-Site Request Forgery SOLUTION:

+

+ By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. The solution around the JS problem is to add the following code within the header section of the application.html.erb file (or any other application layout file). +

+

+ 

+						<%= @meta_code_good %>
+
+

+
+
+
+
+
+ + + + Hint + +
+
+
+ Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor +
+
+
+
+
+
\ No newline at end of file diff --git a/app/views/tutorials/crypto.html.erb b/app/views/tutorials/crypto.html.erb index 2ab0279..e04656c 100644 --- a/app/views/tutorials/crypto.html.erb +++ b/app/views/tutorials/crypto.html.erb @@ -1,75 +1,9 @@
-
-
-
-
- A7 - Insecure Cryptographic Storage -
-
-
-
-
-
- - - - Description - -
-
-
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor -
-
-
-
-
- - - - Bug - -
-
-
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor -
-
-
-
-
- - - - Solution - -
-
-
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor -
-
-
-
-
- - - - Hint - -
-
-
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor -
-
-
-
-
-
-
+
+ <%= render :partial => "layouts/tutorial/crypto/password_hashing" %> +
diff --git a/app/views/tutorials/csrf.html.erb b/app/views/tutorials/csrf.html.erb index 287f244..ad8d961 100644 --- a/app/views/tutorials/csrf.html.erb +++ b/app/views/tutorials/csrf.html.erb @@ -1,111 +1,9 @@
-
-
-
-
- A5 - Cross Site Request Forgery (CSRF) -
-
-
-
-
-
- - - - Description - -
-
-
-

A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

-
-
-
-
-
- - - - Bug - -
-
-
-

Cross-Site Request Forgery (CSRF) - The following code was taken from: /app/controllers/application_controller.rb and /app/views/layouts/application.html.erb

-

application_controller.rb<

-

- 

-							 # Our security guy keep talking about sea-surfing, cool story bro.
-							 # protect_from_forgery
-
- -

-

application.html.erb

-

- 

-								<%= @meta_code_bad %>
-
-

-
-
-
-
-
- - - - Solution - -
-
-
-

Cross-Site Request Forgery ATTACK:

-

- Save this content to an .html file and open it... -

-

- - <%= - %{ - - } - %> - -

- -

Cross-Site Request Forgery SOLUTION:

-

- By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. The solution around the JS problem is to add the following code within the header section of the application.html.erb file (or any other application layout file). -

-

- 

-									<%= @meta_code_good %>
-
-

-
-
-
-
-
- - - - Hint - -
-
-
- Anim pariatur cliche reprehenderit, enim eiusmod high life accusamus terry richardson ad squid. 3 wolf moon officia aute, non cupidatat skateboard dolor brunch. Food truck quinoa nesciunt laborum eiusmod. Brunch 3 wolf moon tempor -
-
-
-
-
-
-
+
+ <%= render :partial => "layouts/tutorial/csrf/csrf_first"%> +