Rails: How to use ActionMailer by itself?

Ruby on rails for malicious use? CEH?

• Hi, each one of my classmates was assigned a language to write about for our CEH presentation. I got Ruby on Rails. I needed to show how any language can be used maliciously. For Ruby I found the paradox virus but I need an actually example of one for Ruby on Rails. Do you think Ruby on Rails could be used maliciously such as to download a file to the person's desktop then run it like a drive-by, or to steal passwords..etc? Thank you kindly for your answers.

• Answer:

  If you want something written in Ruby, you can look at the Metasploit framework. This is a penetration testing framework designed for exploit development and offensive security, and there are hundreds of exploits and auxiliary modules all written in Ruby, you'll probably find it useful for your project. If you want to look at other examples, you can enter the following on Google, this will list all the exploits written in Ruby on milw0rm.com (a very popular site to see POCs): "#!/usr/bin/ruby" site:milw0rm.com When you use Ruby to write an exploit, the payload (aka shellcode) is the one that's going to determine the functionality of your attack (download/upload/remote control/impersonation/password sniffing/etc), and this piece of code is almost always written in assembly (converted to hexadecimal). This applies to all other languages out there -- Python/Perl/C/C++/etc. (Lucky for you Metasploit has a payload generator, so you probably don't even need a crash course for it) Sure you can use Ruby to write a malicious program and implement it on your victim's machine, but most of the time this isn't ideal, because the reality is not so many systems support Ruby by default. Another drawback is your victim gets to see the source code, and that's never good from the attacker's perspective. This is why the language itself is used mostly for remote attacks. Coding exploits in rails would be a bit unnecessary, but if that's what they want, then fine, make one of the examples run in RoR. Metasploit: http://metasploit.com