postmodern_mod3

5 ms·

1.
by postmodern_mod3 2y ago
Title got a little cut off. Should mention the new recon engine (ronin-recon) and the new local Web UI (ronin-app).
2.
by postmodern_mod3 3y ago
"but the ecosystem is the biggest problem by promoting magic." This argument isn't entirely true anymore. The Ruby ecosystem has mostly moved away from meta-programming, and embraced classical OOP. Rubyists now tend to avoid
3.
by postmodern_mod3 3y ago
There is a significant anti-Ruby sentiment in the tech industry right now, especially in certain fields like InfoSec, that is being pushed by a very vocal subset of the community. Whenever they see Ruby come up, they will try pushing the me
4.
by postmodern_mod3 3y ago
Even Haskell has exceptions. Even with Strong Typing and Functional Programming, things can go wrong, like network issues or your hard drive fills up.
5.
Finding all TLD typos using Ruby and ronin-support(ronin-rb.dev)
2 points by postmodern_mod3 3y ago|1 comments
6.
by postmodern_mod3 3y ago
Recently there was a news story about how a typo in a US military address (.mil) caused top secret emails to accidentally be sent to a similar Mali address (.ml). This blog post shows how to find all valid TLD typos using a little bit of Ru
7.
by postmodern_mod3 4y ago
There is not a Python equivalent to Ronin as a whole, to my knowledge. There are however Python libraries that provide some of the features of Ronin. For example, pwntools can be used for packing binary data and generating shellcode for exp
8.
by postmodern_mod3 4y ago
It might still be. The original metasploit developers had a habit of vendoring all of their dependencies to create a mono-repo that "just worked" (tm), even after Bundler was created, which beefed up their SLoC count. Plus there&#
9.
Ronin 2.0.0 has finally been released!(ronin-rb.dev)
2 points by postmodern_mod3 4y ago|0 comments
10.
by postmodern_mod3 4y ago
One minor note: Crystal achieved basic Windows support as of 2021/11/18. https://github.com/crystal-lang/crystal/issues/5430 As of Crystal 1.5.0, Windows support is basically there. https:/&#x
11.
by postmodern_mod3 4y ago
How so? Go does not prevent you from writing a monolith. Furthermore, Go does not actually require that you check the err return value of functions.
12.
by postmodern_mod3 4y ago
You can write "complected" monoliths in any language. You can also write SOAs in any language. If you need native performance, Crystal is a better option, as it provides much of the same syntax, semantics, and stdlib as Ruby, but
13.
by postmodern_mod3 5y ago
- tooling: there is a VS Code plugin for Crystal ( https://marketplace.visualstudio.com/items?itemName=crystal-... ). There is also syntax highlighting for most popular editors, if you prefer a text-editor to a fully-loaded I
14.
by postmodern_mod3 13y ago
If you are looking for a minimal alternative to RVM, you should also checkout chruby ( https://github.com/postmodern/chruby#readme ). It's only ~90 LoC, supports bash/zsh, optionally supports auto-switching of Rubies, and doesn't install ob
15.
by postmodern_mod3 14y ago
Took a while to write a new blog post. Still, CVE-2013-0333 relies on the same YAML deserialization technique as CVE-2013-0156, so all the previous information is still relevant.
16.
by postmodern_mod3 14y ago
and write-up for those who are interested in the technical details: http://ronin-ruby.github.com/blog/2013/01/28/new-rails-poc.h...
17.
by postmodern_mod3 14y ago
Not unless nginx/apache routes the request directly to public/. There will definitely be more code-paths to YAML.load, but so far ActionDispatch::Http::Parameters has been the entry point.
18.
by postmodern_mod3 14y ago
@benmmurphy seems to be the only one who knows how to get RCE via Syck (1.8.x YAML parser). https://twitter.com/benmmurphy/status/296025302986014720
19.
by postmodern_mod3 14y ago
Bonus points if you exfiltrate config/initializers/secret_token.rb.
20.
by postmodern_mod3 14y ago
Maybe graph the rate of vulnerabilities discovered vs. LoC/files added? It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.
21.
by postmodern_mod3 14y ago
YAML does not allow execution of arbitrary Ruby code. Some YAML types allow specifying a custom class, which the Psych YAML parser (default in Ruby 1.9) will call the initialize or []= methods. If you can find a class that eventually evals(
22.
by postmodern_mod3 14y ago
What if I told you that there is a new web framework similar to Rails, called Fortran on Fails. It has zero vulnerabilities reported against it, ergo it must be 100% secure.
23.
by postmodern_mod3 14y ago
> Similar projects with a similar user base, like Django, don't have vulnerabilities of this severity with this frequency. Not all Django vulnerabilities have been discovered or reported yet. Just because no one has found or reported a
24.
by postmodern_mod3 14y ago
Here you go: https://gist.github.com/4660248
25.
by postmodern_mod3 14y ago
Vulnerability counts are misleading metric for security. They do not include the vulnerabilities which have not yet been discovered or created.
26.
by postmodern_mod3 14y ago
Checkout the lengthy write-up for the original vulnerability. http://ronin-ruby.github.com/blog/2013/01/09/rails-pocs.html
27.
by postmodern_mod3 14y ago
Proof-of-Concept exploit: https://gist.github.com/4660248
28.
by postmodern_mod3 14y ago
Charlie Somerville has already released his PoC. http://charlie.bz/blog/rails-3.2.10-remote-code-execution You should release your PoC(s) as well.
29.
by postmodern_mod3 14y ago
Proof-of-Concept Exploits for CVE-2013-0156 and CVE-2013-0155 are here: rails_rce.rb ( https://gist.github.com/4499206 ) rails_sqli.rb ( https://gist.github.com/4499032 ) rails_dos.rb ( https://gist.github.com/4499017 ) rails_jsonq.rb ( htt