Fingerprinting Rails websites in development mode.

Jesse Whitham (whithajess)'s Avatar

Jesse Whitham (whithajess)

17 Feb, 2015 10:23 PM

Hey so I think it would be cool to try fingerprint Rails websites that are in development mode. These have all kind of problems like showing full errors, not performing caching or eager loading etc. And are actually really easy to find a call to GET /rails/info/properties will basically show a php info style page with a large amount of information disclosure also a call to GET /rails/info/routes will give you the routes for the application both which I think would be really useful for helping craft attacks vs the application. I would be really keen to help with making this a reality but really have no idea were to start.

  1. Support Staff 1 Posted by Tasos Laskos on 17 Feb, 2015 10:29 PM

    Tasos Laskos's Avatar

    That's a nice idea, I can add some informational passive checks for these.

  2. 2 Posted by Jesse Whitham (... on 17 Feb, 2015 10:40 PM

    Jesse Whitham (whithajess)'s Avatar

    Cool if you do end up writing some checks can you link me the commits. Thanks

  3. Support Staff 3 Posted by Tasos Laskos on 17 Feb, 2015 10:54 PM

    Tasos Laskos's Avatar

    Or, I could add this to the common_directories check since that's its job anyways.

  4. Support Staff 4 Posted by Tasos Laskos on 17 Feb, 2015 10:57 PM

    Tasos Laskos's Avatar
  5. Tasos Laskos closed this discussion on 17 Feb, 2015 10:57 PM.

Comments are currently closed for this discussion. You can start a new one.

Keyboard shortcuts


? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac