Blog and website of Greg Molnar, Ruby Developer, Rails Developer, IT Security Consultant, Penetration Tester, Ethical hacker. Opinions expressed are mine.
I love Ruby and it is my goto scripting language. Even in the age of AI, I like to write short custom scripts for my tool arsenal. One way to find subdomains of a potential hacking target is to initiate a DNS zone transfer. You can use various shell tools for this, but if it is part of a process(my case), it might be easier and more flexible to just script it in Ruby. I decided to use the dnsruby…
Not the usual content on this blog, bnut this is an interesting story to tell I believe. I own a 2015 Chrysler Town and Country minivan. It is a really good car and filled with electric components. The side doors, the booth, there are 2 screens a DVD player and a bunch of other stuff. Awesome when all is good, not so much when something breaks.
You are a security concious developer and you follow the advice given by security folks to have strong password requirements, and you set a rule of having at least 10 characters, containing one uppercase, one lowercase letter, at least one digit and special character. Surely, this will result in strong passwords, right?
If you run your own servers, you will surely get a lot of weird hackbot requests, searching for accidentally accessible .env files and such. While these bots are generally harmful, unless you have an issue, I prefer to block them so they don’t spam my logs. If it is a Rails app, I use rack-attack , but I also have some jekyll and other stuff and for those, fail2ban is a great tool to solve this…
I was testing for SQL Injection on a target the other day, and after a little fuzzing indicated that there might be a vulnerability, I wanted to use SQLMap to make data exfiltration easier. But this vulnerability was part of a websocket request, and unfortunately, SQLMap doesn’t support websockets. One solution to this problem is to introduce a little proxy between the websocket endpoint and…
Typecraft made a really good video about how he customizes Omarchy with a set of bash scripts, so he can replicate his setup easily on new machines. While his approach is good, I chose a different one to achieve the same goal. Bash is fine, but let’s be honest, Ruby is a much better language to work with, and since Ruby is installed on Omarchy anyways, I decided to script my setup with Ruby.
Since the Ruby Central drama, there are new tools popping up to manage Ruby versions and to install gems. Ore is one of these tools, but it is more of a bundler companion than replacement. It does one thing: downloading gems and installing them. It doesn’t manage rubies, it doesn’t even need Ruby to be installed. It is written in go and can be installed as a binary, let’s see what Ore does:
September is conferencing season for me, and this year, I decided to do the Ruby Triathlon, so I attended Rails World in Amsterdam, FriendlyRb in Bucharest, and EuRuKo in Viana do Castelo.
I finally had a little time to look more into the Rubygems drama. I don’t know anything else than what you can publicly read and it looks like that information is also hard to trust.
We had two news Rails CVE published recently and both of them looks interesting from an exploitation stand point so I wanted to explore what could be achieved with them.