Collected research

Cracking Ruby on Rails Session

Let Me Github That For You

joernchen · phenoelit.org

Rails keeps sessions in a client-side cookie signed with an HMAC whose secret lives in config/initializers/secret_token.rb, a file developers routinely commit to GitHub. With the secret a session can be forged: authenticated_system falls to user_id=>1, and authlogic falls to a find_by_id hash injecting a :select of "* from users limit 1 --".

Record

Document

Let Me Github That For You

Researcher

joernchen

Published by

phenoelit.org

Topic

Identity

In the archive

• Collected in the 2012 research round

Related sources

• Rails cookie signing script

Tags

• ruby
• rails
• cookie
• auth-bypass
• sqli
• deserialization
• github
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of joernchen, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.