Developers act as online crooks through Google lessons

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Developers act as online crooks through Google lessons

» IT Security NEWS

» 05 May 2010

Developers act as online crooks through Google lessons

Just recently, the web giant Google launched a new web tutorial that is free of charge. The internet-based lesson allows different web developers to have an experience of how it feels like to be a vicious online criminal. Through the discussion, the web enthusiast will gain familiarity concerning the process of abusing any of the genuine security vulnerabilities found in a fake application in the web.

Learning through more tangible means

Jarlsberg, a small sample web application, possesses the codelab and it also contains many types of bugs that may be abused by the developers who are going to act as hackers. Exploitation of these vulnerabilities will then lead to crashing of the web servers. The technically-inclined individuals may also carry out attacks through activation of malicious codes from a certain distance. Lastly, giving away of protected contents may also occur by following the methods discussed in the document.

Those who are interested in testing this file may download it and execute it in a local computer system. The developers will personally learn the hazards of coding that lacks full protection.

Hackers have vast knowledge on technical languages

The Web Application Exploits and Defenses codelab created by Google have two settings that the developers may choose from. One is the black-box setting, which is fabricated in such a way that the hackers do not have any idea about their target’s source code. On the other hand, the hackers are informed that the Jarlsberg is encoded using the Python in the white-box setting. However, the users who will practice using the white-box setting of the codelab must have great understanding of this kind of technical language so that the manipulation of the application will be easier.

The purpose of this tutorial is to allow developers and other interested individuals to have the real experience on locating and repairing the security vulnerabilities found in a common web application. The security holes in this trial web application have three vulnerability categories: cross-site scripting (XSS), cross-site request forgeries (CSRF), and the path traversal.

The individuals concerned will learn valuable things such as the identification of the definite kind of vulnerability and also the process of succeeding in the attacks on the security holes.

Read more about SecPoint by viewing the following pages: About SecPoint, SecPoint Press, and SecPoint Products.