Google is developing an automated tool for finding common web application vulnerabilities.

The tool, dubbed Lemon, is still in development by the ad-brokering giant's security researchers but is already been used internally. It's unclear whether or not Google will release the vulnerability testing tool more generally. Free vulnerability scanners, such as Nessus, already exist while firm such as eEye and Foundstone market commercial products.

Fruity

Lemon - whose name comes from a common description for defective products - uses fuzzing techniques to uncovered cross-site scripting (XSS) flaws and other bugs. The team plan to add tests for SQL injection (another common class of web vulnerability) later.

Fuzzing (AKA fault-injection testing) involves supplying inputs that are designed to trigger and thus expose flaws in web application. Lemon analyses the response to these inputs to unearth security flaws.

Cross-site scripting remains the main focus of the tool's development. Applications such as Gmail has been the subject of development flaws such as XSS attacks in the past. The tool could make it easier for Google to nip application development errors in the bud.

"Although it [Lemon] started out as an experimental tool, it has proved to be quite effective in finding XSS problems. Besides XSS, it finds other security problems such as response splitting attacks, cookie poisoning problems, stacktrace leaks, encoding issues and charset bugs. Since the tool is homegrown it is easy to integrate into our automated test environment and to extend based on specific needs. We are constantly in the process of adding new attack vectors to improve the tool against known security problems," writes Google researcher Srinath Anantharaju. ®

Related stories

Stay focused on fuzzy tests, warn security experts (7 April 2008)
Ex-MS staffer to demo Vista smart card hack (18 March 2008)
Firefox broken Jar vuln. menaces Gmail (12 November 2007)
How to expose Gmail contacts without really trying (27 September 2007)
New cracks in Google mail (26 September 2007)
Unholy trinity of flaws put Google users at risk (24 September 2007)
Researcher crosses swords with Google over XSS 'flaw' (21 August 2007)
Gmail: a short, sharp rant (26 July 2007)
Google in crusade against neckties (24 July 2007)
Google ponies up $4.6bn for wireless spectrum (20 July 2007)
Google earnings less astronomical than expected (20 July 2007)
Google bags hosted security firm Postini for $625m (9 July 2007)
Google patches critical desktop flaw (21 February 2007)
Cookie monster menaces Google (18 January 2007)
Google blacklist sheds light on phishing tactics (5 January 2007)
Google plugs GMail exploit (2 January 2007)
Worm automates Google AdSense fraud (6 October 2006)
Tool uses Google to hunt for open source bugs (28 July 2006)
Flaw finders lay siege to Microsoft Office (22 July 2006)
Google-based malware search tool surfaces (18 July 2006)