Tag: Traversal Attack

How to protect rails application from suspicious and abuse attacks?

How to protect rails application from suspicious and abuse attacks?

Mohamed Sami

Introduction

Many of DevOps teams are suffering from different attacks from people around the world who are trying to hack your website, compromise any information, robot sign up, send robots email, visit non-existing URLs.

These attacks if did not harm your application, it will increase the load on your environment and consume even the resources in not a good way. So, these attacks have to be prevented and blocked. In this article, we will discuss how to protect your ruby on rails app from suspicious and abuse attacks using simple methods which act as web application firewall (WAF) without the need to use and pay for external security services or WAF services.

Rails is a web application development framework written in the Ruby programming language that has been introduced at 2003. It is designed to make programming web applications easier by making assumptions about what every developer needs to get started. It allows you to write less code while accomplishing more than many other languages and frameworks.

Ruby on Rails is one of the popular framework built on Model View Controller (MVC) architecture pattern and has a large developer community which made it robust and easy to get support.

Read more →
Black Box Security Testing

Black Box Security Testing

Mohamed Sami

Black box testing is generally used when the tester has limited knowledge of the system under test or when access to source code is not available. Within the security test arena, black box testing is normally associated with activities that occur during the pre-deployment test phase (system test) or on a periodic basis after the system has been deployed.

Black box security tests are conducted to identify and resolve potential security vulnerabilities before deployment or to periodically identify and resolve security issues within deployed systems. They can also be used as a “badness-ometer” [McGraw 04] to give an organization some idea of how bad the security of their system is. From a business perspective, organizations conduct black box security tests to conform to regulatory requirements, protect confidentially and proprietary information and protect the organization’s brand and reputation.

Fortunately, a significant number of black box test tools focus on application security related issues. These tools concentrate on security-related issues including but not limited to:

Read more →