project 2 section - crypto.stanford.edu · • download vm • virtualbox: in...
TRANSCRIPT
CS 155
• Project 2:• Setup• Ruby on Rails primer• Tips for part A
• Bitbar
• Ruby on Rails App
• New users get 200 bitbars
• Can transfer bitbarsto other users
Part A: Attacks
Due May 11
Part B: Defenses
Due May 18
• Download VM
• VirtualBox: In Preferences->Network->Host-only Networks, add a new network (vboxnet0) if it doesn’t exist
• Start the VM. • proj2 directory has starter code
Route Map To Controller:bitbar/config/routes.rb
User Controller:bitbar/app/controllers/user_controller.rb
User Profile View:bitbar/app/views/user/profile.html.erb
http://blog.bigbinary.com/2013/03/19/cookies-on-rails.html
”Transfer 10 bitbars to attacker”
Victim’s bitbar cookies sent as auth!Victim logs in to Bitbar
Victim visits attacker website
Attacker’s Profile
User1’s Profile User 2’s Profile
User Bitbars
Attacker 10
User1 50
User2 100
User Bitbars
Attacker 11
User1 49
User2 100
User Bitbars
Attacker 12
User1 49
User2 99
Views
Views