The Channel logo

News

By | John Leyden 18th July 2007 15:30

Google's Lemon squeezes out web app bugs

Hot Fuzz

Google is developing an automated tool for finding common web application vulnerabilities.

The tool, dubbed Lemon, is still in development by the ad-brokering giant's security researchers but is already been used internally. It's unclear whether or not Google will release the vulnerability testing tool more generally. Free vulnerability scanners, such as Nessus, already exist while firm such as eEye and Foundstone market commercial products.

Fruity

Lemon - whose name comes from a common description for defective products - uses fuzzing techniques to uncovered cross-site scripting (XSS) flaws and other bugs. The team plan to add tests for SQL injection (another common class of web vulnerability) later.

Fuzzing (AKA fault-injection testing) involves supplying inputs that are designed to trigger and thus expose flaws in web application. Lemon analyses the response to these inputs to unearth security flaws.

Cross-site scripting remains the main focus of the tool's development. Applications such as Gmail has been the subject of development flaws such as XSS attacks in the past. The tool could make it easier for Google to nip application development errors in the bud.

"Although it [Lemon] started out as an experimental tool, it has proved to be quite effective in finding XSS problems. Besides XSS, it finds other security problems such as response splitting attacks, cookie poisoning problems, stacktrace leaks, encoding issues and charset bugs. Since the tool is homegrown it is easy to integrate into our automated test environment and to extend based on specific needs. We are constantly in the process of adding new attack vectors to improve the tool against known security problems," writes Google researcher Srinath Anantharaju. ®

comment icon Read 5 comments on this article alert Send corrections

Opinion

Lightning

Jack Clark

Just as Jeff Bezos did to books and CDs, Amazon's rivals are now doing to it
Microsoft CEO Satya Nadella
ARA_LIbertad

Chris Mellor

Elliott Management sinks its teeth into retiring godhead

Features

Failure to crack next-gen semiconductors threatens to set back humanity
SMEs get lip service - what they need is dinner at the Club
SAP Match Insights
Vorsprung durch grossendatatechnik, as we like to say in Germany
Inside the Google Lab where surgeons prepare the human/dog experiment
Big Blue exec tells El Reg what to keep an eye on