Tuesday, May 04, 2010
Cross-posted on the
Google Online Security Blog
We want Googlers to have a firm understanding of the threats our services face, as well as how to
help protect against those threats. We work toward these goals in a variety of ways, including
security training for new engineers, technical presentations about security, and other types of
documentation. We also use codelabs—interactive programming tutorials that walk participants
through specific programming tasks.
One codelab in particular teaches developers about common types of web application
vulnerabilities. In the spirit of the thinking that “it takes a hacker to catch a hacker,” the
codelab also demonstrates how an attacker could exploit such vulnerabilities.
We’re releasing this codelab, entitled “Web Application Exploits and Defenses,” today in
coordination with
Google Code University and
Google Labs
to help software developers better recognize, fix, and avoid similar flaws in their own
applications. The codelab is built around Gruyere, a small yet full-featured microblogging
application designed to contain lots of security bugs. The vulnerabilities covered by the lab
include cross-site scripting (XSS), cross-site request forgery (XSRF) and cross-site script
inclusion (XSSI), as well as client-state manipulation, path traversal and AJAX and configuration
vulnerabilities. It also shows how simple bugs can lead to information disclosure,
denial-of-service and remote code execution.
The maxim, “given enough eyeballs, all bugs are shallow” is only true if the eyeballs know what to
look for. To that end, the security bugs in Gruyere are real bugs—just like those in many
other applications. The Gruyere source code is published under a Creative Commons license and is
available for use in whitebox hacking exercises or in computer science classes covering security,
software engineering or general software development.
To get started, visit
https://google-gruyere.appspot.com/.
An instructor’s guide for using the codelab is now available on
Google Code University.
Bunu necə tətbiq edirik
We archive Search Central announcements because client questions often trace back to a change that was announced years ago. Reading the original is faster than reconstructing it from second-hand summaries.
Əlaqəli xidmətlər