postmodern

joined 1 year ago
MODERATOR OF
ruby_infosec
sorted by: new top controversial old
1
Announcing the Ronin 2.1.0 Open Beta (ronin-rb.dev)
3
Stop wasting your time on annoying CTF challenges (and just use Ronin)! (ronin-rb.dev)
What are You Working on Wednesday in c/[email protected]
[–] [email protected] 2 points 10 months ago (1 children)

Working on wrapping up the Ronin Phase II epic.

3
Solving Advent of Cyber 2023 Day 22 with ronin-exploits (ronin-rb.dev)
0
Solving Advent of Cyber 2023 Day 4 using Ronin (ronin-rb.dev)
0
Solving Advent of Cyber 2023 Day 3 using Ronin (ronin-rb.dev)
1
Solving HackThisSite Programming Level 11 with Ronin (ronin-rb.dev)
1
Solving HackThisSite Programming Level 1 with Ronin (ronin-rb.dev)
1
Yes, you can use Ronin on the OSCP (ronin-rb.dev)
1
Ronin is participating in Hacktoberfest 2023! (ronin-rb.dev)
1
ronin 2.0.5, ronin-support 1.0.3, ronin-db-activerecord 0.1.2, ronin-db 0.1.2, ronin-vulns 0.1.4, ronin-payloads 0.1.4, and ronin-exploits 1.0.3 released! (ronin-rb.dev)
What are You Working on Wednesday in c/[email protected]
[–] [email protected] 3 points 1 year ago

Trying to close out more issues on the ronin-app, a local web UI for Ronin.

1
Proposal to deprecate "|command-here" inputs for Kernel.open() accepted (bugs.ruby-lang.org)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
0 comments fedilink
 

Dozens of Ruby-related CVEs have been caused by user input being passed to the top-level Kernel.open() method, which not only accepts paths or URIs (if open-uri has been loaded), but also "|command-here" commands which are then opened using IO.popen() resulting in Remote Command Execution (RCE) vulnerabilities. In the next minor Ruby version (3.3.0) a deprecation warning will be printed if a "|command-here" input is given to Kernel.open(). Hopefully, in Ruby 4.0 this insecure feature will be removed.

What are You Working on Wednesday in c/[email protected]
[–] [email protected] 2 points 1 year ago

A website wordlist generator that's better than CeWL for ronin-web using ronin-web-spider (based on spidr) and the wordlist library. Current writing the man page, there's a lot of options to document.

1
Finding all TLD typos using Ruby and ronin-support (ronin-rb.dev)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
0 comments fedilink
 

You may have recently read a news story about how a typo in a US military email address (@.mil -> @.ml) accidentally caused sensitive military secrets to be sent to a similar Mali email address for years.

What if I told you, you could use Ronin to find all of the one-character-missing valid typos for all of the TLDs?

view more: next ›