Safely watch an example exploit of a known Rails webconsole vulnerability

webconsole_exploit_honeypot.rb

# having read
# https://benmmurphy.github.io/blog/2016/07/11/rails-webconsole-dns-rebinding/
# I wanted to see what http://www.dnsrebinder.net/ would execute
# if I had an app with Rails webconsole running on localhost:3000

# Usage:
# * run this application
# * visit http://www.dnsrebinder.net/
# * watch console

require 'sinatra'

set :port, 3000

path_regex = /\/(__web_)?console/

get '/not_found' do
  # the exploiting script expects a certain status code
  # and a certain string in the response body:
  status 404
  body "console/repl_sessions/123'"
end

get path_regex do
  p params
  'hello, kitty'
end

post path_regex do
  p params
  'hello, kitty'
end

put path_regex do
  p params
  'hello, kitty'
end