Ruby on Rails – Rubysec Tools and Tricks

There are several options for analyzing Ruby and Ruby-on-Rails applications, some of which are specific to Rails and others that can be applied more generally to similar applications (such as apps that are also RESTful, MVC, CRUD-oriented, primarily server-side, and so on).

Exploiting RESTful MVC Routing Patterns

Because Rails is so opinionated toward RESTful MVC patterns applied to CRUD apps, the URL routing structure is often easy to intuit. Understanding the /resource/action and /resource/{identifier}/action patterns allows an attacker to play around with potentially dangerous paths like /users/{identifier}/update that can be inferred from simple observation.

...