RailsGoat

RailsGoat is a deliberately vulnerable web application built on Ruby on Rails. It demonstrates real-world security vulnerabilities from the OWASP Top 10 and serves as a hands-on training platform for developers and security professionals.

What is RailsGoat?

RailsGoat is an intentionally insecure Rails application designed to teach web application security. By exploring and exploiting its vulnerabilities, you'll learn:

• How common security flaws manifest in Rails applications
• How to identify vulnerabilities through code review and testing
• How to implement proper security controls and remediation strategies

Current Version: Rails 8.0 with Ruby 3.3.6

Vulnerabilities Included

RailsGoat includes examples of these security issues:

• SQL Injection - Unsafe database queries
• Cross-Site Scripting (XSS) - Unescaped user input
• Cross-Site Request Forgery (CSRF) - Missing request validation
• Insecure Direct Object Reference - Unauthorized data access
• Mass Assignment - Unprotected model attributes
• Authentication Issues - Weak login mechanisms
• Sensitive Data Exposure - Cleartext storage of SSNs and weak password hashing
• Missing Access Controls - Unauthorized admin access
• Command Injection - Unsafe system command execution
• Unvalidated Redirects - Open redirect vulnerabilities
• Password Complexity Issues - Insufficient password requirements

Each vulnerability includes a failing test that demonstrates the security flaw and a wiki tutorial explaining the attack and remediation.

Quick Start

Prerequisites

• Ruby 3.3.6
• Git
• SQLite3 (included by default)
• MySQL (optional, required for certain SQL injection demos)

New to Ruby? Follow the setup guide at GoRails for your operating system.

Installation

1. Clone the repository:

   git clone https://github.com/OWASP/railsgoat.git
   cd railsgoat
   

2. Install dependencies:

   gem install bundler
   bundle install
   

3. Setup the database:

   rails db:setup
   

4. Start the server:

   rails server
   

5. Open your browser: Navigate to http://localhost:3000 and start exploring!

Other Rails Versions

The main branch runs Rails 8. For older versions, switch branches:

git checkout rails_3_2  # Rails 3.2
git checkout rails_4_2  # Rails 4.2
git checkout rails_5    # Rails 5.x

Learning Path

1. Training Mode (Recommended for Learners)

Run the vulnerability test suite to see which security flaws exist:

rails training

Each failing test indicates a vulnerability. The test output includes a link to a wiki tutorial explaining:

• How the vulnerability works
• How to exploit it
• How to fix it

To run a specific vulnerability test:

rails training SPEC=spec/vulnerabilities/sql_injection_spec.rb

2. Explore the Application

• Create an account and log in
• Browse the different features
• Try to access other users' data
• Attempt various injection attacks
• Review the source code to understand the vulnerabilities

3. Learn from the Wiki

Visit the RailsGoat Wiki for detailed tutorials on each vulnerability, including:

• Vulnerability explanation
• Exploitation techniques
• Code examples
• Remediation steps

Docker Installation

Requirements: Docker and Docker Compose 1.6.0+

For Mac Apple Silicon (ARM64): Rosetta must be installed

docker-compose build
docker-compose run web rails db:setup
docker-compose up

The application will be available at http://localhost:3000

Troubleshooting: If the container exits with "A server is already running", remove tmp/pids/server.pid from your working directory and try again.

Advanced Configuration

MySQL Environment

Some SQL injection vulnerabilities require MySQL. To run with MySQL:

# Create and migrate the database
RAILS_ENV=mysql rails db:create
RAILS_ENV=mysql rails db:migrate

# Start the server
RAILS_ENV=mysql rails server

Email Testing

RailsGoat uses MailCatcher to intercept emails:

gem install mailcatcher
mailcatcher

View emails at http://localhost:1080

For Contributors and Maintainers

Running Tests in Maintainer Mode

Set the RAILSGOAT_MAINTAINER environment variable to verify that vulnerabilities still exist:

RAILSGOAT_MAINTAINER="yes" bundle exec rspec

In maintainer mode, tests pass when vulnerabilities are correctly implemented (opposite of training mode).

Contributing

We welcome contributions! Please see our contribution guidelines for details.

Support

Need help?

• Join the OWASP Slack Channel
• Check the Wiki for tutorials
• Open an issue for bugs or questions

Project History

RailsGoat was created to demonstrate security vulnerabilities in Rails applications and teach secure coding practices. It has been continuously updated through Rails versions 3, 4, 5, 6, and now 8, maintaining relevance as the framework evolves.

Conversion to OWASP Top Ten 2013 completed in November 2013.

License

The MIT License (MIT)

---

Warning: This application contains serious security vulnerabilities. Never deploy it on a public server or network. Use only in isolated training environments.