Webmaster Central Blog
Official news on crawling and indexing sites for the Google index
Do know evil
wtorek, maja 04, 2010
(Cross-posted on the
Google Online Security Blog
)
UPDATE July 13: We have changed the name of the codelab application to Gruyere. The codelab is now located at
http://google-gruyere.appspot.com
.
We want Googlers to have a firm understanding of the threats our services face, as well as how to help protect against those threats. We work toward these goals in a variety of ways, including security training for new engineers, technical presentations about security, and other types of documentation. We also use codelabs — interactive programming tutorials that walk participants through specific programming tasks.
One codelab in particular teaches developers about common types of web application vulnerabilities. In the spirit of the thinking that "it takes a hacker to catch a hacker," the codelab also demonstrates how an attacker could exploit such vulnerabilities.
We're releasing this codelab, entitled "Web Application Exploits and Defenses," today in coordination with
Google Code University
and
Google Labs
to help software developers better recognize, fix, and avoid similar flaws in their own applications. The codelab is built around Gruyere, a small yet full-featured microblogging application designed to contain lots of security bugs. The vulnerabilities covered by the lab include cross-site scripting (XSS), cross-site request forgery (XSRF) and cross-site script inclusion (XSSI), as well as client-state manipulation, path traversal and AJAX and configuration vulnerabilities. It also shows how simple bugs can lead to information disclosure, denial-of-service and remote code execution.
The maxim, "given enough eyeballs, all bugs are shallow" is only true if the eyeballs know what to look for. To that end, the security bugs in Gruyere are real bugs — just like those in many other applications. The Gruyere source code is published under a Creative Commons license and is available for use in whitebox hacking exercises or in computer science classes covering security, software engineering or general software development.
To get started, visit
http://google-gruyere.appspot.com/
. An instructor's guide for using the codelab is now available on
Google Code University
.
Posted by Bruce Leban, Software Engineer
Hey!
Check here if your site is mobile-friendly.
Etykiety
accessibility
10
advanced
195
AMP
13
Android
2
API
7
apps
7
autocomplete
2
beginner
173
CAPTCHA
1
Chrome
2
cms
1
crawling and indexing
158
encryption
3
events
51
feedback and communication
83
forums
5
general tips
90
geotargeting
1
Google Assistant
3
Google I/O
3
Google Images
3
Google News
2
hacked sites
12
hangout
2
hreflang
3
https
5
images
12
intermediate
205
interstitials
1
javascript
8
job search
2
localization
21
malware
6
mobile
63
mobile-friendly
14
nohacked
1
performance
17
product expert
1
product experts
2
products and services
63
questions
3
ranking
1
recipes
1
rendering
2
Responsive Web Design
3
rich cards
7
rich results
10
search console
35
search for beginners
1
search queries
7
search results
140
security
12
seo
3
sitemaps
46
speed
6
structured data
33
summit
1
TLDs
1
url removals
1
UX
3
verification
8
video
6
webmaster community
24
webmaster forum
1
webmaster guidelines
57
webmaster tools
177
webmasters
3
youtube channel
6
Archive
2020
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2019
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2018
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2017
gru
lis
paź
wrz
sie
cze
maj
kwi
mar
lut
sty
2016
gru
lis
paź
wrz
sie
cze
maj
kwi
mar
sty
2015
gru
lis
paź
wrz
sie
lip
maj
kwi
mar
lut
sty
2014
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2013
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2012
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2011
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2010
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2009
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2008
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2007
gru
lis
paź
wrz
sie
lip
cze
maj
kwi
mar
lut
sty
2006
gru
lis
paź
wrz
sie
Feed
Follow @googlewmc
Give us feedback in our
Product Forums
.
Subscribe via email
Enter your email address:
Delivered by
FeedBurner