Slashdot Log In
Google Gives Away Web App Security Tool
Posted by
timothy
on Thu Jul 03, 2008 05:22 PM
from the to-whom-it-may-concern dept.
from the to-whom-it-may-concern dept.
CWmike writes "Google has released for free one of its internal tools used for testing the security of Web-based applications. Ratproxy, released under an Apache 2.0 software license, looks for a variety of coding problems in Web applications. A 2006 survey by the Web Application Security Consortium found that 85.57 percent of 31,373 sites were vulnerable to cross-site scripting attacks, 26.38 percent were vulnerable to SQL injection and 15.70 percent had other faults that could lead to data loss."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Proving once again... (Score:2)
...despite all the haters, that Google certainly isn't evil.
Thanks!
Re: (Score:1, Informative)
Or just proving that there's a lot of developers at Google that aren't evil.
A corporation exists for the benefit of it's shareholders. As long as the shareholders interests are honorable, the company will stay that way. When Shareholder interest moves focus to maximizing profit "Do no evil" becomes a nice catchphrase.
Everything is evil, just watch me if I had the same opportunity...
Re: (Score:1)
Surrre. What were they using it for before they released it?
Re: (Score:2)
DO google pass on failed search attempts? I thought that they simply blocked certain keywords completely meaning that people searching for that stuff are probably safer than if they found the results.
Works great (Score:5, Informative)
Just run it with "-xX" and see what it finds in terms of XSS vulnerabilities... I used it this afternoon on an app and found a bunch of stuff. Some problems were tricky, other problems were simple ones of the "alert('hi')" variety. And it's in C so it's fast enough to browse through without being annoying. RatProxy + FireBug make a great combo. Thanks Google!
Re:Works great (Score:5, Funny)
If you run it with -xXx, it'll find any pornographic images on your site.
Parent
Re: (Score:3, Funny)
and 4x's gives you free beer
Re: (Score:2)
Re: (Score:2)
win32 compile (Score:1, Informative)
dont trust random executables from the internet
http://www.sendspace.com/file/hiwcs7 [sendspace.com] (needs cygwin)
Oooh, goody goody... (Score:5, Funny)
In other news, Viacom has petitioned the court for Google's logs of users who downloaded their ratproxy tool after it was used to reveal vulnerabilities on certain Viacom owned web sites.
I hate it when I have to RTFA (Score:4, Interesting)
Script Kiddie Time! (Score:1)
Documentation (Score:4, Informative)
Windows version (Score:2)
Is there a windows build somewhere for those of us forced to use windows at work?
Re: (Score:3, Informative)