See Hacker Hack
summary
A Rails app called weirdo is built intentionally insecure and then attacked live with Burp proxy and other tools (Nikto, Brakeman/Brakeman Pro, bundler-audit). The demo shows hidden user_id fields and predictable numeric IDs let one user create, edit or delete another user’s records; forwarding edited requests in Burp makes the attack trivial. The fix is using current_user scoping, remove hidden ID fields, use UUIDs for records, and log with Papertrail on Heroku; the demo largely succeeds despite live hiccups.
AI-written summary · about
