Google Releases a Web-App Case Study For Hackers

Hugh Pickens writes "The San Francisco Chronicle reports that Google has released Jarlsberg, a 'small, cheesy' web application specifically designed to be full of bugs and security flaws as a security tutorial for coders, and encourages programmers to try their hands at exploiting weaknesses in Jarlsberg as a way of teaching them how to avoid similar vulnerabilities in their own code. Jarlsberg has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The codelab is organized by types of vulnerabilities." (Read on for more.)

"In black box hacking, users try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior while in white-box hacking, users have access to the source code and can use automated or manual analysis to identify bugs. The tutorial notes that accessing or attacking a computer system without authorization is illegal in many jurisdictions but while doing this codelab, users are specifically granted authorization to attack the Jarlsberg application as directed."

Jarlsberg

[clone53421]

For those who missed the reference, Jarlsberg [wikipedia.org] is a variety of cheese which has large, irregular holes.

Re:a tutorial from China

[FuckingNickName]

Android is built on Linux, which is open source. Google's apps on Android are closed source.
Chromium is built on WebKit, which is built on KDE's HTML rendering engine, which is open source. Chrome is closed source.

So even when they're taking great advantage of open source, like Apple, they can't resist making sure the full kaboodle is closed. And these are just just their minor projects.

Their major search thing is as closed as they promised it wouldn't be (though no-one remembers that any more).

HackThisSite

[brainfsck]

I had fun messing around on the site. If you're interested in this sort of thing, HackThisSite.org [hackthissite.org] has about a dozen similar "Realistic Missions" as well as forums and many other types of security-related challenges.

Web Goat

[dhadley519]

Interested parties should also be aware of web goat by the owasp team. http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project [owasp.org]