presidentbeef / Inject Some Sql
Licence: mit
Have fun injecting SQL into a Ruby on Rails application!
Stars: ✭ 211
Programming Languages
ruby
36898 projects - #4 most used programming language
Projects that are alternatives of or similar to Inject Some Sql
Gdpr Rails
An example project on building a GDPR compliant application
Stars: ✭ 109 (-48.34%)
Mutual labels: rails, ruby-on-rails
Active record Events
Manage timestamps in ActiveRecord models
Stars: ✭ 109 (-48.34%)
Mutual labels: rails, ruby-on-rails
Sr mini
A single file Rails app that will have you running a StimulusReflex and CableReady demo in just 2 steps.
Stars: ✭ 98 (-53.55%)
Mutual labels: rails, ruby-on-rails
Rails new
A thoughtfully designed template for building modern Rails apps. Get started in minutes instead of hours 🔥🚀
Stars: ✭ 151 (-28.44%)
Mutual labels: rails, ruby-on-rails
Lol dba
lol_dba is a small package of rake tasks that scan your application models and displays a list of columns that probably should be indexed. Also, it can generate .sql migration scripts.
Stars: ✭ 1,363 (+545.97%)
Mutual labels: rails, ruby-on-rails
Zen Rails Security Checklist
Checklist of security precautions for Ruby on Rails applications.
Stars: ✭ 1,765 (+736.49%)
Mutual labels: rails, ruby-on-rails
Phpvuln
Audit tool to find common vulnerabilities in PHP source code
Stars: ✭ 146 (-30.81%)
Mutual labels: sql-injection, sqli
Stimulus reflex
Build reactive applications with the Rails tooling you already know and love.
Stars: ✭ 1,928 (+813.74%)
Mutual labels: rails, ruby-on-rails
Reactchat
A chat app built with React.js and ActionCable in Ruby on Rails 5.1
Stars: ✭ 90 (-57.35%)
Mutual labels: rails, ruby-on-rails
Rspec Rails Examples
RSpec cheatsheet & Rails app: Learn how to expertly test Rails apps from a model codebase
Stars: ✭ 2,089 (+890.05%)
Mutual labels: rails, ruby-on-rails
Instuigram
🎓 Learning Ruby on Rails through building the Instagram Application.
Stars: ✭ 88 (-58.29%)
Mutual labels: rails, ruby-on-rails
Pingcrm
PingCRM on Rails - A Ruby on Rails demo application to illustrate how Inertia.js works
Stars: ✭ 106 (-49.76%)
Mutual labels: rails, ruby-on-rails
Rails React Boilerplate
Ruby on Rails, React, Webpack 4 boilerplate app.
Stars: ✭ 86 (-59.24%)
Mutual labels: rails, ruby-on-rails
Fake api
The fastest way to prototype API in your Rails application
Stars: ✭ 119 (-43.6%)
Mutual labels: rails, ruby-on-rails
Rails Security Checklist
🔑 Community-driven Rails Security Checklist (see our GitHub Issues for the newest checks that aren't yet in the README)
Stars: ✭ 1,265 (+499.53%)
Mutual labels: rails, ruby-on-rails
Graphjin
GraphJin - Build APIs in 5 minutes with GraphQL. An instant GraphQL to SQL compiler.
Stars: ✭ 1,264 (+499.05%)
Mutual labels: rails, ruby-on-rails
Doorkeeper Provider App
An example OAuth 2 provider application using the Doorkeeper gem, Rails and Devise
Stars: ✭ 146 (-30.81%)
Mutual labels: rails, ruby-on-rails
Api guard
JWT authentication solution for Rails APIs
Stars: ✭ 159 (-24.64%)
Mutual labels: rails, ruby-on-rails
Inject Some SQL
These are sample Rails applications for demonstrating many ways SQL can be injected in Rails.
Setup
Clone the repo:
git clone https://github.com/presidentbeef/inject-some-sql.git
Pick either Rails 5, Rails 4 or Rails 3. They each have their own subdirectory.
cd inject-some-sql/rails5
In the subdirectory, install dependences and set up the database:
bundle install
rake db:setup db:seed
Run
Typical Rails start:
rails s
Open up localhost:3000 in a browser.
Reset Database
It's easy to mess up a database with SQL injection. The server does attempt to reset the database after each query, but that isn't foolproof.
To completely reset:
rake db:drop db:migrate db:seed
Inject SQL!
The site lists a whole bunch of ActiveRecord queries.
Each query has input for a single parameter (although some queries may actually have more than one). A sample injection is provided. Clicking "Run!" will run the query shown.
Adding/Modifying Queries
All queries are generated from app/models/queries.rb.
Limitations
- This is a single player game because the SQL query is stored in a global variable.
License
This code is made available under the MIT license.
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].