John Poulin forced-request

## rails_dynamic_render_code_exec.rb
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  @@trav_string = '%5c%2e%2e%2f'

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,

## server.js
/* Tell Node not to crash */
process.on('uncaughtException', function (err) {
    console.log('Caught exception: ', err);
});

## request_forgery_protection.rb
def protect_from_forgery(options = {})
    self.request_forgery_protection_token ||= :authenticity_token
    prepend_before_filter :verify_authenticity_token, options
end

def verify_authenticity_token
    unless verified_request?
      logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
      handle_unverified_request
    end

## request_forgery_protection.rb
def handle_unverified_request
  reset_session
end

def verified_request?
    !protect_against_forgery? || request.get? ||
      form_authenticity_token == params[request_forgery_protection_token] ||
      form_authenticity_token == request.headers['X-CSRF-Token']
end

## migration.rb
class ConvertFriendshipTable < ActiveRecord::Migration
  def change
    rename_column :friendships, :sender, :user
  end
end

## functions.rb
class FunctionParser
  def test
    # How do I access @vals from sim.rb?
    # puts @vals.inspect
  end
end

## json_encode-xss-prevention.php
<html>
<body>
<script>
    var a = “prefix” + <?= json_encode($_GET['p']); ?> + “suffix”;
</script>
</body>
</html>

## htmlentities_javascript.php
<html>
<body>
<script>
    var a = '<?= htmlentities($_GET['p']); ?>';
</script>
</body>
</html>

## mitigated_dynamic_render.rb
def show
  template = params[:id]
  d = Dir[“myfolder/*.erb]

  if d.include?(“myfolder/#{template}.erb”)
    render "myfolder/#{template}"
  else
    # throw exception or 404
  end
end

## mitigated_dynamic_render.rb
def show
  template = params[:id]

  valid_templates = {
    "dashboard" => "dashboard",
    "profile"   => "profile",
    "deals"   => "deals"
  }

  if valid_templates.include?(template)
	require 'msf/core'

	class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking
	@@trav_string = '%5c%2e%2e%2f'

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
	super(update_info(info,
	/* Tell Node not to crash */
	process.on('uncaughtException', function (err) {
	console.log('Caught exception: ', err);
	});
	def protect_from_forgery(options = {})
	self.request_forgery_protection_token \|\|= :authenticity_token
	prepend_before_filter :verify_authenticity_token, options
	end

	def verify_authenticity_token
	unless verified_request?
	logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
	handle_unverified_request
	end
	def handle_unverified_request
	reset_session
	end

	def verified_request?
	!protect_against_forgery? \|\| request.get? \|\|
	form_authenticity_token == params[request_forgery_protection_token] \|\|
	form_authenticity_token == request.headers['X-CSRF-Token']
	end
	class ConvertFriendshipTable < ActiveRecord::Migration
	def change
	rename_column :friendships, :sender, :user
	end
	end
	class FunctionParser
	def test
	# How do I access @vals from sim.rb?
	# puts @vals.inspect
	end
	end
	<html>
	<body>
	<script>
	var a = “prefix” + <?= json_encode($_GET['p']); ?> + “suffix”;
	</script>
	</body>
	</html>
	def show
	template = params[:id]
	d = Dir[“myfolder/*.erb]

	if d.include?(“myfolder/#{template}.erb”)
	render "myfolder/#{template}"
	else
	# throw exception or 404
	end
	end
	def show
	template = params[:id]

	valid_templates = {
	"dashboard" => "dashboard",
	"profile" => "profile",
	"deals" => "deals"
	}

	if valid_templates.include?(template)