Google's Open Source Security Audit Tool
Google has placed Ratproxy, a passive security audit tool, into open source
The tool is especially relevant to Web 2.0 developers, according to the documentation:
It is designed specifically to deliver concise reports that focus on prioritized issues of clear relevance to contemporary web 2.0 applications, and to do so in a hands-off, repeatable manner. It should not overwhelm you with raw HTTP traffic dumps, and it goes far beyond simply providing a framework to tamper with the application by hand.
It is designed to catch, among other things:
- Potentially unsafe JSON-like responses that may be vulnerable to cross-domain script inclusion.
- Bad caching headers on sensitive content.
- Suspicious cross-domain trust relationships.
- Numerous classes of content serving issues
- Queries with insufficient XSRF defenses
- Suspected or confirmed XSS / data injection vectors
- HTTP and META redirectors.
The application can be downloaded from Google code.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
