CircleCityCon · Indianapolis, IN · 2015 · 17 min
Player blocked? Watch it on YouTube.
The tagline on the first slide was “It’s not just for Python,” and that was the whole point. Python gets all the attention in security tooling, but a lot of the tools we use every day are written in Ruby, and the language is a good fit for the work.
Why Ruby works for security
- It reads easily.
empty?,times,each: you can hand a Ruby script to someone who doesn’t write Ruby and they’ll follow it. - Batteries included. A big standard library, first-class regular expressions borrowed from Perl, built-in support for most network protocols, binary string handling, and full OpenSSL bindings.
- It bends. Open classes, introspection, metaprogramming and blocks make it great for DSLs (think RSpec, Sinatra, Chef), which is exactly what a lot of security tools turn into.
- It reaches native code. FFI and DL for calling C libraries, plus a C API for extending or embedding it.
- IRB. A REPL for poking at a protocol or a payload interactively.
The tools
Most of the talk was a tour of security projects built on Ruby: Metasploit (ported from Perl in 2006), Metasm, Ronin, Ruckus, BeEF, Gauntlt, PEDump, Ruby BlackBag (rbkb), Ragweed, PacketFu, Arachni, Brakeman, WPScan, and OWASP RailsGoat.
Some of those have gone quiet since 2015, but Metasploit, BeEF, Brakeman and WPScan are all still around, and the argument for Ruby hasn’t really changed.