Skip to content

Navigation Menu

Appearance settings

Explore
By company size
By use case
By industry
View all solutions
Topics
- AI
- DevOps
- Security
- Software Development
- View all
Explore
- GitHub Sponsors
  Fund open source developers
- The ReadME Project
  GitHub community articles
Repositories
- Enterprise platform
  AI-powered developer platform
Available add-ons
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

OWASP / railsgoat Public

Notifications You must be signed in to change notification settings
Fork 743
Star 893

Code
Issues 23
Pull requests 14
Actions
Projects
Wiki
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Wiki
Security
Insights

Home

Jump to bottom

Ken Johnson edited this page Mar 20, 2015 · 16 revisions

Welcome to the railsgoat wiki!

Toggle table of contents Pages 65

Home
A1 Command Injection
A1 Injection
A1 SQL Injection Concatentation
A1 SQL Injection Interpolation
A10 Unvalidated Redirects and Forwards
A10 Unvalidated Redirects and Forwards (redirect_to)
A2 Broken Authentication and Session Management
A2 Credential Enumeration
A2 Insecure Compare and Timing Attacks
A2 Lack of HttpOnly Flag
A2 Lack of Password Complexity
A3 Cross Site Scripting
A3 Cross Site Scripting DOM Based
A3 XSS
A4 IDOR
A4 Insecure Direct Object Reference
A5 Security Misconfig JSON Escaping
A5 Security Misconfig Modification
A5 Security Misconfiguration
A6 Sensitive Data Exposure
A6 Sensitive Data Exposure Cleartext Storage SSNs
A6 Sensitive Data Exposure Insecure Password Storage
A6 Sensitive Data Exposure Model Attributes Exposure
A7 Missing Function Level Access Control
A7 Missing Function Level Access Control (Admin Controller)
A8 Cross Site Request Forgery
A8 CSRF
A9 Using Components with Known Vulnerabilities
A9 Using Components with Known Vulnerabilities (JQuery)
Denial of Service
Extras URLs vs URIs
Extras: Broken Regular Expression
Extras: Constantize
Extras: Logic Flaws
Extras: Logic Flaws Insecure Encryption Reuse
Extras: Mass Assignment
Extras: Mass Assignment Admin Role
Extras: Metaprogramming
Extras: Remote Code Execution
OWASP RailGoat Idea List
R4 A1 Injection
R4 A1 SQL Injection Concatentation
R4 A2 Broken Authentication and Session Management
R4 A2 Lack of Password Complexity
R4 A5 Security Misconfiguration
R4 A8 Cross Site Request Forgery
R4 A8 CSRF
R4 Extras Mass Assignment
R4 Extras Mass Assignment Admin Role
R4 Extras Metaprogramming
R4 Extras: Logic Flaws
R5 A1 Command Injection
R5 A1 Injection
R5 A1 SQL Injection Concatentation
R5 A10 Unvalidated Redirects and Forwards (redirect_to)
R5 A2 Credential Enumeration
R5 A4 Insecure Direct Object Reference
R5 A6 Sensitive Data Exposure Model Attributes Exposure
Rails 3 Tutorials
Rails 4 Tutorials
Rails 5 Tutorials
RailsGoat Summer of Code Slack Meeting Agenda (2 16 2018)
RailsGoat Summer of Code Type Project Information
SOC OWASP RailsGoat Status Table

Sections are divided by their OWASP Top Ten label (A1-A10) and marked as R4 and R5 for Rails 4 and 5.

Clone this wiki locally

Footer

© 2025 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Docs
Contact

You can’t perform that action at this time.