Skip to content

Commit 3b13adb

Browse files
committed
Hint about incorrect RAILSVERSION
If the secret doesn't match, you might have set the wrong RAILSVERSION. The difference is secret_token (Rails 3) vs. secret_key_base (Rails 4).
1 parent 10653fa commit 3b13adb

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/exploits/multi/http/rails_secret_deserialization.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ def exploit
247247
if check_secret(match[2],match[3])
248248
print_good("SECRET matches! Sending exploit payload")
249249
else
250-
fail_with(Failure::BadConfig, "SECRET does not match")
250+
fail_with(Failure::BadConfig, "SECRET does not match, wrong RAILSVERSION?")
251251
end
252252
else
253253
print_warning("Caution: Cookie not found, maybe you need to adjust TARGETURI")

0 commit comments

Comments
 (0)