Webmaster Central Blog
Official news on crawling and indexing sites for the Google index
Do know evil
tisdag, maj 04, 2010
(Cross-posted on the
Google Online Security Blog
)
UPDATE July 13: We have changed the name of the codelab application to Gruyere. The codelab is now located at
http://google-gruyere.appspot.com
.
We want Googlers to have a firm understanding of the threats our services face, as well as how to help protect against those threats. We work toward these goals in a variety of ways, including security training for new engineers, technical presentations about security, and other types of documentation. We also use codelabs — interactive programming tutorials that walk participants through specific programming tasks.
One codelab in particular teaches developers about common types of web application vulnerabilities. In the spirit of the thinking that "it takes a hacker to catch a hacker," the codelab also demonstrates how an attacker could exploit such vulnerabilities.
We're releasing this codelab, entitled "Web Application Exploits and Defenses," today in coordination with
Google Code University
and
Google Labs
to help software developers better recognize, fix, and avoid similar flaws in their own applications. The codelab is built around Gruyere, a small yet full-featured microblogging application designed to contain lots of security bugs. The vulnerabilities covered by the lab include cross-site scripting (XSS), cross-site request forgery (XSRF) and cross-site script inclusion (XSSI), as well as client-state manipulation, path traversal and AJAX and configuration vulnerabilities. It also shows how simple bugs can lead to information disclosure, denial-of-service and remote code execution.
The maxim, "given enough eyeballs, all bugs are shallow" is only true if the eyeballs know what to look for. To that end, the security bugs in Gruyere are real bugs — just like those in many other applications. The Gruyere source code is published under a Creative Commons license and is available for use in whitebox hacking exercises or in computer science classes covering security, software engineering or general software development.
To get started, visit
http://google-gruyere.appspot.com/
. An instructor's guide for using the codelab is now available on
Google Code University
.
Posted by Bruce Leban, Software Engineer
Hey!
Check here if your site is mobile-friendly.
Etiketter
accessibility
10
advanced
195
AMP
13
Android
2
API
7
apps
7
autocomplete
2
beginner
173
CAPTCHA
1
Chrome
2
cms
1
crawling and indexing
158
encryption
3
events
51
feedback and communication
83
forums
5
general tips
90
geotargeting
1
Google Assistant
3
Google I/O
3
Google Images
3
Google News
2
hacked sites
12
hangout
2
hreflang
3
https
5
images
12
intermediate
205
interstitials
1
javascript
8
job search
2
localization
21
malware
6
mobile
63
mobile-friendly
14
nohacked
1
performance
17
product expert
1
product experts
2
products and services
63
questions
3
ranking
1
recipes
1
rendering
2
Responsive Web Design
3
rich cards
7
rich results
10
search console
35
search for beginners
1
search queries
7
search results
140
security
12
seo
3
sitemaps
46
speed
6
structured data
33
summit
1
TLDs
1
url removals
1
UX
3
verification
8
video
6
webmaster community
24
webmaster forum
1
webmaster guidelines
57
webmaster tools
177
webmasters
3
youtube channel
6
Archive
2020
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2019
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2018
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2017
dec.
nov.
okt.
sep.
aug.
juni
maj
apr.
mars
feb.
jan.
2016
dec.
nov.
okt.
sep.
aug.
juni
maj
apr.
mars
jan.
2015
dec.
nov.
okt.
sep.
aug.
juli
maj
apr.
mars
feb.
jan.
2014
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2013
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2012
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2011
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2010
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2009
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2008
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2007
dec.
nov.
okt.
sep.
aug.
juli
juni
maj
apr.
mars
feb.
jan.
2006
dec.
nov.
okt.
sep.
aug.
Feed
Follow @googlewmc
Give us feedback in our
Product Forums
.
Subscribe via email
Enter your email address:
Delivered by
FeedBurner
