How to hack your own Rails site?

Question

I have developed a Rails site which will be used by my company for internal use by all employees. It is ready to go live, but I want to make sure it is secure enough to face the big, bad outside world. So I want to test the security of the site by trying to hack it. What are good starting points for this? Are there any good tutorials or tips you know?

Answer 1

I like the brakeman gem for performing vulnerability scanning on Rails apps. Check out 'The Open Web Application Security Project' for current information about web app security.

As far as hacking yourself, aka 'pen testing', if security is of great importance to you, you're probably best off leaving it to security community to yield meaningful results. Either way, you can still try and test yourself.

Some great resources: Google Gruyere OWASP WebGoat Burp Suite (Burp Suite is probably my favorite) OWASP rails security guide(Also checkout OWASP Top 10 list) Hacking Dojo .com website and their Live CDs for pentesting This site Tweeter blog was a lot of fun ( I cant post many links due to reputation) but....allows you to try and perform SQL injection on a vulnerable app. I'm not sure how relevant it is today however.