Ruby for Pentesters

Install Ruby 4, meet irb, and write your very first script — an HTTP client that fingerprints a target. We point it at the retired HackTheBox machine Bizness and confirm what's running.

OFBiz has an authentication bypass (CVE-2023-51467). We turn that into a reusable Ruby method, learn how functions and constants work, and confirm we're past the login gate.

We point the auth bypass at OFBiz's ProgramExport screen, POST a Groovy payload, and run our first command on the box. Along the way you learn POST requests, hashes, and pulling data back out of a response.

Reflected output is clumsy. We write our own TCP listener in Ruby to catch an interactive reverse shell — and learn sockets and threads doing it.

With a shell as ofbiz, we go after the admin password hash. OFBiz's embedded Derby database sits in flat files on disk — we grep them, then learn regex and file handling to pull the hash out cleanly.

The admin hash isn't in any standard format hashcat ships with, so we reimplement OFBiz's exact hashing in Ruby and brute it against a wordlist. Then we build a thread pool to parallelize it — and meet the GVL, the reason Part 4's threads sped up network work but won't speed up pure hashing.

The cracked password is root's too — plain password reuse. We spend it to escalate, and learn the handful of ways Ruby runs external programs — system, backticks, Open3 — ending with a PTY to drive an interactive su.

Several throwaway scripts that all rebuild the same HTTP client. We fold them into one reusable class and give it a real command-line interface with OptionParser — the jump from scripting to tooling.

A tool you'll rerun deserves a safety net. We meet minitest, Ruby's built-in test framework, and learn to write code that's testable — separating the logic you can check from the network you can't.

The finale. A Metasploit module is just a Ruby class in the framework's shape — so we lift the exact OFBiz chain into one, and let the framework hand us HTTP, options, payloads, and a shell for free.