RailsGoat Documentation

To prevent vulnerabilities such as session hijacking, cookie forgery, or unauthorized data decryption, follow these security rules for managing application secrets (e.g., secret_key_base, API keys, OAuth secrets, and database credentials):

1. Never hardcode secrets: Avoid patterns like SECRET_KEY_BASE = "hardcoded_value" as they leak via Git history.
2. Use secure storage: Use environment variables or the Rails Encrypted Credentials system.
3. Protect the master key: If using encrypted credentials, ensure config/master.key is added to your .gitignore and never committed.
4. Rotate secrets regularly: Ensure secrets can be changed without requiring application code changes.
5. Restrict access: Limit who can access production secrets.

To make Railsgoat accessible, create the service using the provided YAML template and then expose it to create a route.

# Create the service from the template
$ oc create -f https://raw.githubusercontent.com/relotnek/railsgoat/master/openshift-configs/railsgoatservice.yaml

# Expose the service
$ oc expose service railsgoat

Rails 5.2+ uses an encrypted credentials system. Credentials are stored in an encrypted file, and access is controlled by a master key.

• Encrypted file: config/credentials.yml.enc (Safe to commit to version control).
• Master key: config/master.key (MUST NEVER be committed to version control).

To edit your credentials, use the Rails CLI command:

rails credentials:edit

To access a credential in your application code, use the Rails.application.credentials object:

Rails.application.credentials.secret_key_base

If you prefer using Docker, ensure you have Docker and Docker Compose (1.6.0+) installed. Note: Mac Apple Silicon (ARM64) users must have Rosetta installed.

Run the following commands to build, setup the database, and start the application:

docker-compose build
docker-compose run web rails db:setup
docker-compose up

The application will be available at http://localhost:3000.

Troubleshooting: If the container exits with "A server is already running", remove tmp/pids/server.pid from your working directory and try again.

To run RailsGoat locally, ensure you have Ruby 3.4.1, Git, and SQLite3 installed. Follow these steps to clone, install dependencies, and start the server:

1. Clone the repository and enter the directory.
2. Install bundler and the project dependencies.
3. Set up the database.
4. Start the Rails server.

Access the application at http://localhost:3000.

git clone https://github.com/OWASP/railsgoat.git
cd railsgoat
gem install bundler
bundle install
rails db:setup
rails server

Railsgoat supports both standard Docker and OpenShift-specific deployments. To use the OpenShift deployment, you must locate the Railsgoat build in your deployment and update the dockerStrategy to point to the configuration files in the openshift-configs directory.

Ensure the dockerfilePath is set to openshift-configs/Dockerfile and the from source uses an ImageStreamTag from the railsgoat namespace.

 strategy:
    dockerStrategy:
      dockerfilePath: openshift-configs/Dockerfile
      from:
        kind: ImageStreamTag
        name: 'ruby:2.6.5'
        namespace: railsgoat
    type: Docker

To intercept and view emails sent by the application, use MailCatcher. Install it via gem, run the service, and view intercepted emails at http://localhost:1080.

gem install mailcatcher
mailcatcher

To begin a new deployment, create a dedicated OpenShift project for Railsgoat using the oc new-project command.

$ oc new-project railsgoat --description="Railsgoat Openshift Deployment" --display-name="Railsgoat"

Once the deployment is active, you must run the database migrations inside the running pod. Use oc rsh to enter the pod and then execute the migration command.

# Enter the active pod
$ oc rsh <RAILSGOAT_POD_ID>

# Inside the pod terminal, run migrations
$ rails db:migrate

RailsGoat includes a training command that runs a vulnerability test suite. Each failing test indicates an existing security flaw. The output provides a link to a wiki tutorial explaining the vulnerability, how to exploit it, and how to fix it.

To run the full suite:

rails training

To run a specific vulnerability test (e.g., SQL injection):

rails training SPEC=spec/vulnerabilities/sql_injection_spec.rb

rails training
# Or for a specific spec:
rails training SPEC=spec/vulnerabilities/sql_injection_spec.rb

To deploy Railsgoat alongside a PostgreSQL database, use oc new-app pointing to the Railsgoat repository. You must provide environment variables that match your database configuration and set RAILS_ENV to openshift.

$ oc new-app https://github.com/OWASP/railsgoat.git --name=railsgoat -e POSTGRESQL_USER=username -e POSTGRESQL_PASSWORD=password -e POSTGRESQL_DATABASE=db_name -e DATABASE_SERVICE_NAME=postgresql -e RAILS_ENV=openshift

In Rails 5.1, secrets are managed via config/secrets.yml. To avoid hardcoding sensitive values like secret_key_base, use environment variables that are injected at runtime. This is the standard pattern for Docker, CI/CD pipelines, and cloud platforms.

Example of a secure config/secrets.yml configuration:

production:
  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>