PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

New Dojo sandbox environment for creating Ruby CTF challenges

yeswehack.com | blog | #bug-bounty | #ruby-on-rails | #ruby | #ctf | #dojo | #sandbox
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

YesWeHack's Dojo platform adds a Ruby sandbox for creating CTF challenges, with a step-by-step tutorial and a bug hunter's view of Ruby pitfalls such as mass assignment and deserialization bugs.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #54 Highscore solution
Dojo Solution - Hacker Club: Filter bypass and JSON injection to achieve improper access
blog · yeswehack.com
Dojo challenge #53 Hacker Club solution
This technical writeup demonstrates practical payload crafting for Ruby ERB template injection vulnerabilities.
blog · blog.trailofbits.com
Free Ruby Security Workshop
Trail of Bits hosts a free Ruby Security Workshop in NYC alongside SummerCon: led by Hal Brodigan, it covers Ruby/Rails vulnerability classes like YAML deserialization, plus hands-on exercises.
vulnerability · bishopfox.com
Ruby Vulnerabilities: Exploiting Dangerous Open, Send and Deserialization Operations
A walkthrough of three common Ruby-specific remote code execution bugs exploiting dangerous open, send, and deserialization operations in a Ruby on Rails application, with exploit examples.
vulnerability · vercel.com
$1 million hacker challenge for Vercel Sandbox
Vercel is running a two-week, public HackerOne program with up to $1,000,000 in bounties for researchers who can escape a Vercel Sandbox.
blog · yeswehack.com
Dojo challenge #48 RubitMQ solution
Dojo #48: Oj.load's unrestricted object mode lets crafted JSON instantiate a gadget class whose find command executes arbitrary shell through -exec — deserialization to RCE in one chain.
Back