BeEF VS SecureHeaders

Ha, fun to see this again! Back before everything was HTTPS, it was fun to use the Browser Exploitation Framework (https://beefproject.com) which had a script included that did this. Though in those cases I wasn't in control of the gateway, so ARP spoofing was required to get other devices to route through me.

For example IOS WebKit has a bunch of vulnerabilities announced recently. and one of those could be used via the Browser Exploitation Framework to install malware on your phone with you just clicking the link.

Motivation is a key part, so those attacks are more theoretical than practically dangerous, however there is a class of attacks that's based on the fact that your browser can make arbitrary network connections, so unprivileged javascript can be used for some scans of your local network - for example, your router's internally accessible admin page or some vulnerability in a printer accessible in local network, as the attacker might guess commonly used models, the internal IP addresses they use by default, etc. For example, you might take a look at https://beefproject.com/

This is something that kind of annoys me; there's even a /r/rails sub-reddit specifically for Ruby on Rails stuff. Understandably Rails helped put Ruby on the map. Before Rails, Ruby was just another fringe language. Rails became massively popular, helped many startups quickly build their Web 2.0 sites, and become successful companies (ex: GitHub, LinkedIn, AirBnB, etc). Like others have said, "Rails is where the money is at". However, this posses a problem for the Ruby community: whenever Rails becomes less popular, so does Ruby. I wish the Ruby ecosystem wasn't so heavily centralized around Rails, and that we diversified our uses of Ruby a bit. There's of course Sinatra, dry-rb, Hanami, Dragon Ruby, SciRuby, and a dozen security tools written in Ruby such as Metasploit, BeFF, Arachni, and Ronin.

If you can open any webpage there then I would recommend using BeEF https://beefproject.com/

Perhaps https://beefproject.com/

If you want an example of what exploiting a browser can do, see the capabilities of the Browser Exploitation Framework (BEef): https://github.com/beefproject/beef/wiki/BeEF-modules

Take a look at BeEF framework - https://beefproject.com/ that's pretty much all the things you can do from a browser.

The secure_headers gem will automatically apply several headers that are related to security. This includes:

add secure_headers