---
name: rt-exploit-ruby
description: "Authorized Ruby and Rails security review skill covering Rails configuration, dependency risk, unsafe deserialization patterns, mass assignment, authorization, secrets handling, and remediation."
---

# rt-exploit-ruby - Ruby and Rails Security Testing

## Overview

Ruby applications often concentrate risk in Rails conventions, background jobs, serializers, dependency versions, admin panels, and authorization boundaries. This skill turns Ruby/Rails-specific review into a repeatable workflow.

## Prerequisites

- Application URL or code access in scope.
- Framework and Ruby version identified.
- Test accounts for each role.
- Permission to review dependency manifests if available.
- Data access limits confirmed.

## Testing Areas

| Area | What To Review |
|---|---|
| Rails Configuration | Environment, debug exposure, host authorization, cookies, CSRF. |
| Authentication | Devise/custom auth, password reset, session lifetime, MFA. |
| Authorization | Pundit/CanCanCan policies, controller filters, object ownership. |
| Mass Assignment | Strong parameters and nested attributes. |
| Serialization | YAML, Marshal, JSON parsing, signed/encrypted payloads. |
| File Handling | ActiveStorage configuration, content type, direct upload access. |
| Background Jobs | Sidekiq/Resque dashboards, job argument sensitivity. |
| Dependencies | Gem advisories, outdated Rails, vulnerable plugins. |

## Workflow

1. Fingerprint framework, versions, routes, and major gems.
2. Build role/object authorization matrix.
3. Review high-risk endpoints: admin, upload, export, import, webhook, search.
4. Validate mass assignment and authorization with safe role-pair tests.
5. Review secrets and credentials handling.
6. Document root cause with controller/action/gem where known.

## Evidence

Use paired requests from different roles, redacted dependency advisory output, screenshots, and code snippets if code review is authorized.

## Remediation

- Enforce strong parameters.
- Centralize authorization policy checks.
- Patch Rails and vulnerable gems.
- Avoid unsafe object deserialization.
- Protect Sidekiq/admin dashboards.
- Set secure cookie and CSRF defaults.
- Rotate exposed secrets.

## References

- Rails Security Guide
- OWASP ASVS
- RubySec Advisory Database

