Languages › Ruby
Ruby
RoadmapThe language of Metasploit — and elegant web bugs.
Learning Path Available — Lessons Currently Being Developed
Overview
Ruby powers Rails applications and, famously, Metasploit. Its security story includes mass assignment, unsafe deserialization, and template injection, and its anchor semantics have produced real CVEs. Learning Ruby means reading Rails source and extending the most established exploitation framework there is.
Why learn Ruby
- Metasploit is Ruby — extending it requires reading it.
- Rails apps are common and have their own bug classes.
- Mass assignment and deserialization are Ruby/Rails specialties.
Security applications
- Rails application source review
- Mass assignment vulnerabilities
- Unsafe deserialization
- Writing Metasploit modules
- Template injection in Ruby
Planned curriculum
- Ruby syntax and idioms
- Reading Rails application source
- Mass assignment bugs
- Deserialization in Ruby
- Anchor-semantics validation bypasses
- Template injection
- Writing a Metasploit module
- Static analysis of Ruby
This path is on the roadmap. The four live courses (Python, JavaScript, Bash, Regex) will teach you most of what carries over.