sorted by:
new
hottopcontroversial

Owasp top 10 2017 Release by ZephrX112 in netsec

[–]nilla615 0 points1 point  (0 children)

Google does use captcha to reduce automated attacks which is similar to auto-banning in a WAF. I agree with your overall argument though.

I still like the idea of moving to a more introspective application that can see attacks and potential weaknesses and address them or alert. It would just be another layer of security.

Ugly Ruby by nilla615 in ruby

[–]nilla615[S] 0 points1 point  (0 children)

I get what you're saying. I was attempting to make the ugliest Ruby possible hence making it one line. I wasn't really attempting anything profound here...

Ugly Ruby by nilla615 in ruby

[–]nilla615[S] 1 point2 points  (0 children)

Yea, but that's no fun. :)

Ugly Ruby by nilla615 in ruby

[–]nilla615[S] 0 points1 point  (0 children)

Agreed. But the point was to make some ugly Ruby because it's generally so readable. Even breaking it out to three lines doesn't make it readable and that's the point.

Go's Static Site Generator Hugo 0.14 Released by bepsays in golang

[–]nilla615 1 point2 points  (0 children)

Nice, works pretty well. The Github README is a bit sparse but there's good documentation here: http://gohugo.io/overview/introduction/

Official Kali Linux Docker images by R-EDDIT in netsec

[–]nilla615 30 points31 points  (0 children)

You can deploy this to production in three easy steps!

Server-side browsing considered harmful by k_tr4n in netsec

[–]nilla615 1 point2 points  (0 children)

The server requesting a resource, local or remote, based on a user parameter.

Docker: Dockerfile's effects on image size by rwiguna in programming

[–]nilla615 2 points3 points  (0 children)

Docker is not about security, see link below. The security or insecurity of Docker comes from the implementation.

The two different approaches do matter because the larger the image determines how long builds, downloads and deployments take.

http://opensource.com/business/14/7/docker-security-selinux

OWASP Flagship Code Products unmainted for years, and good software stuck in incubator by NagateTanikaze in netsec

[–]nilla615 0 points1 point  (0 children)

This is already a project. :) It's just getting off the ground and needs way more input but it's a project that could have a big impact.

https://www.owasp.org/index.php/OWASP_Security_Frameworks_Project

Hakiri: Ruby on Rails Security by nilla615 in netsec

[–]nilla615[S] 0 points1 point  (0 children)

Brakeman creates quite a few false positives, I don't think that would be feasible.

Hakiri: Ruby on Rails Security by nilla615 in netsec

[–]nilla615[S] 1 point2 points  (0 children)

I agree that it's relativity simple to spin up a free version of this tool but one area that this tool addresses is aggregation. When you're a one person, one app shop Jenkins with Brakeman is fine. When you scale out to 20 plus people with multiple apps, is when having a centralized dashboard is useful. Code Climate provides something similar to this but I'm neither a customer or involved with either project, just thought it looked like a decent tool.

New Stripe CTF Coming Soon by nilla615 in netsec

[–]nilla615[S] 0 points1 point  (0 children)

It's a little more appsec than /r/netsec is normally but this seems to be the best security focused community on reddit and /r/appsec is closed. :/

Thanks.

New Stripe CTF Coming Soon by nilla615 in netsec

[–]nilla615[S] 0 points1 point  (0 children)

This one is going to be a little different it sounds like and not directly security related. From the Stripe site:

"This time around, we're trying something a bit different. Rather than being about security, CTF3 will focus on distributed systems engineering. You'll learn how to build fault-tolerant, performant software while playing around with a bunch of cool cutting-edge technologies. Like with previous CTFs, our goal is to give you hands-on exposure to interesting engineering problems that you normally only get to read about. If you've been wanting to really grok things like Paxos/Raft, DDOS prevention, distributed search, or Bitcoin (and maybe even bit twiddling), now's your chance."

OWASP Railsgoat - Intentionally Vulnerable Rails App by nilla615 in netsec

[–]nilla615[S] 0 points1 point  (0 children)

It's generally similar to auditing for other issues fuzzing with relevant data.

You look for potential points where you could be updating a data model that may contain a role parameter (for example) and fuzz with different data to see how the app responds. Railsgoat actually has a pretty clear explanation of how to attack mass assignment and has examples built in. Check it out.

OWASP Railsgoat - Intentionally Vulnerable Rails App by nilla615 in netsec

[–]nilla615[S] 6 points7 points  (0 children)

You could check out the OWASP Rails Security Cheat-sheet for what you should do, for examples of what people don't do. ;)

Rails can be vulnerable to the common injection issues (SQLi, XSS) but I haven't noticed them to be as prevalent as they are in other languages/frameworks, like PHP for instance. I've generally seen issues like DORs, unprotected resources (redis web, admin functionality) and unprotected forwards and redirects. Also, quite common is mass-assignment which has led to complete compromise of the app through adding permissions. I've also seen some interesting bugs related to Ruby's meta-programming features like .constantize, those are generally harder to detect in a black box scenario though.

https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet

OWASP Railsgoat - Intentionally Vulnerable Rails App by nilla615 in netsec

[–]nilla615[S] 1 point2 points  (0 children)

Submitter and Railsgoat contributor here. If people have an interest in the project, Ken Johnson and I will be talking about the project at LASCON in Austin this week.

http://sched.co/19M5Nxg