# Ruby on Rails **Blogs / Articles / Writeups / Presentations:** * * [Airbnb - Ruby on Rails String Interpolation led to Remote Code Executionbuer.haus](https://buer.haus/2017/03/13/airbnb-ruby-on-rails-string-interpolation-led-to-remote-code-execution/) * * * * * * * * [https://blog.heroku.com/rails-asset-pipeline-vulnerability#:\~:text=Released%20in%20CVE%2D2018%2D3760,set%20to%20compile%20at%20runtime.\&text=If%20Sprockets%20can't%20find,asset%20that%20matches%20the%20request.](https://blog.heroku.com/rails-asset-pipeline-vulnerability) **Cheatsheet:** * * **Labs:** * [h ](https://towardsdatascience.com/building-a-vulnerable-rails-application-for-learning-2a1de8cf98d5) * **Twitter Threads:** * * * * * * * * * * * [When auditing Ruby on Rails apps, always search for .js.erb views files. There is a stupid pattern called "Server-generated JavaScript Responses" which is a way to bypass SOP and inject content via JavaScript files (just like JSONP) which leads to XSSI.](https://twitter.com/lean0x2f/status/1205335920507006977) * [CSRF using PUT , DELETE is possible in ruby on rails frameworks if you see a hidden field called \_method in the request (if it dont exist try to add it) set its value to PUT or DELETE and then submit a GET or POST request it will override the HTTP Verb and success the attack .](https://twitter.com/secmind009/status/1205669730331373568) * [API TIP: 4/31- Testing a Ruby on Rails App & noticed an HTTP parameter containing a URL? Developers sometimes use "Kernel#open" function to access URLs == Game Over. Just send a pipe as the first character and then a shell command (Command Injection by design)](https://twitter.com/traceableai/status/1213495503981305858) * *