Skip to content

Instantly share code, notes, and snippets.

@williamsbdev

williamsbdev/Ruby Security Vulnerability Egrep

Created June 10, 2016 02:22
Show Gist options
  • Save williamsbdev/5d641f957c0f2112b43895633726989a to your computer and use it in GitHub Desktop.
Save williamsbdev/5d641f957c0f2112b43895633726989a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Ruby Security Vulnerability Egrep
# this command will return places where the application shells out or dynamically executes code:
egrep -r --include "*.rb" -e "(exec|eval|system)(\(| \"| \')|\`.*\`|%x(\(|\[|\{|\<)" .
# RAILS: find places where unsafe SQL queries are executed:
egrep -r --include "*.rb" -e "\.(find_by_sql|select_all|exec_query|execute)(\(| \"| \')" .
# RAILS: find places where HTML encoding is turned off via the "safe" attribute:
egrep -r --include "*.erb" -e ".html_safe|raw(\(| \"| \')" .
# returns hardcoded credentials
egrep -r --include "*.rb" -e "(user|username|pass|password)\s*\=\s*\".*\"" .
# returns hardcoded port
egrep -r --include "*.rb" -e "port\s*\=\s*\d+" .
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment