railsgoat - A vulnerable version of Rails that follows the OWA

项目说明

RailsGoat

RailsGoat is a deliberately web application built on Ruby on Rails. It demonstrates real-world security from the OWASP Top 10 and serves as a hands-on training platform for de and security professionals.

What is RailsGoat?

RailsGoat is an intentionally insecure Rails application designed to teach web application security. By exploring and exploiting its , you'll learn:

Current : Rails 8.0 with Ruby 3.4.1

Included

RailsGoat demonstrates real-world security from the OWASP Top 10, including SQL injection, cross-site scripting (XSS), authentication issues, insecure direct object references, and more.

For a complete list of with detailed explanations and tutorials, visit the RailsGoat Wiki.

Quick Start

Prerequisites

New to Ruby? Follow the setup guide at GoRails for your operating system.

Installation

1. Clone the repository:

2. Install dependencies:

3. Setup the database:

4. Start the server:

5. Open your browser:
Na to and start exploring!

Other Rails

The main branch runs Rails 8. For older , switch branches:

Learning Path

1. Training Mode (Recommended for Learners)

Run the test suite to see which security flaws exist:

Each failing test indicates a . The test output includes a link to a wiki tutorial explaining:

To run a specific test:

2. Explore the Application

3. Learn from the Wiki

Visit the RailsGoat Wiki for detailed tutorials on each , including:

Bonus Security Topics

Additional documentation co ad and modern Rails security concepts:

Docker Installation

Requirements: Docker and Docker Compose 1.6.0+

For Mac Apple Silicon (ARM64): Rosetta must be installed

The application will be a at

Troubleshooting: If the container exits with "A server is already running", remove tmp/pids/server.pid from your working directory and try again.

Ad Configuration

MySQL En

Some SQL injection require MySQL. To run with MySQL:

Email Testing

RailsGoat uses MailCatcher to intercept emails:

View emails at

For Contributors and Maintainers

Running Tests in Maintainer Mode

Set the RAILSGOAT_MAINTAINER en to that still exist:

In maintainer mode, tests pass when are correctly implemented (opposite of training mode).

Contributing

We welcome contributions! Please see our contribution guidelines for details.

Support

Need help?

Project History

RailsGoat was created to demonstrate security in Rails applications and teach secure coding practices. It has been continuously updated through Rails 3, 4, 5, 6, and now 8, maintaining relevance as the framework e.

Con to OWASP Top Ten 2013 completed in No 2013.

License

The MIT License (MIT)

---

Warning: This application contains serious security . Ne it on a public server or network. Use only in isolated training en.

项目信息

开发语言：HTML

Star 数：927

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A vulnerable version of Rails that follows the OWASP Top 10展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。