OWASP - User contributions [en]

Category:OWASP LAPSE Project

2006-08-25T22:27:02Z

Oberon: /* News */

'''LAPSE: Web Application Security Scanner for Java'''
== News ==
* 8/23/2006 - version 2.5.5 released (see http://suif.stanford.edu/~livshits/work/lapse/download.html)
* 8/22//2006 - OWASP LAPSE Project Created

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

== Contributors ==
* [http://suif.stanford.edu/~livshits/ Benjamin Livshits]

Category:OWASP LAPSE Project

2006-08-24T21:56:20Z

Oberon:

== News ==
* 8/23/2006 - version 2.5.5 released (see http://suif.stanford.edu/~livshits/work/lapse/download.html)
* 8/22//2006 - OWASP LAPSE Project Created

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

== Contributors ==
* [http://suif.stanford.edu/~livshits/ Benjamin Livshits]

Category:OWASP LAPSE Project

2006-08-24T21:55:59Z

Oberon:

== News ==
* 8/23/2006 - version 2.5.5 released (see http://suif.stanford.edu/~livshits/work/lapse/download.html)
* 8/22//2006 - OWASP LAPSE Project Created

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

== Contributors ==
[http://suif.stanford.edu/~livshits/ Benjamin Livshits]

Category:OWASP LAPSE Project

2006-08-24T21:46:16Z

Oberon:

Category:OWASP LAPSE Project

2006-08-24T21:45:33Z

Oberon:

== News ==
* 8/23/2006 - version 2.5.5 released
* 8/22//2006 - OWASP LAPSE Project Created

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

[[Category:OWASP Project]]

Category:OWASP LAPSE Project

2006-08-24T21:45:02Z

Oberon:

== News ==
* 8/23/2006 - version 2.5.5 released
* 8/22//2006 - OWASP LAPSE Project Created

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

[[Category:OWASP Project]]

Category:OWASP LAPSE Project

2006-08-24T21:43:24Z

Oberon: /* Overview */

== News ==
* 8/2//2006 - OWASP LAPSE Project Created
* 8/23/2006 - version 2.5.5 released

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action]]
LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

[[Category:OWASP Project]]

File:Screenshot.jpg

2006-08-24T21:36:56Z

Oberon:

Category:OWASP LAPSE Project

2006-08-24T21:35:19Z

Oberon:

== News ==
* 8/2//2006 - OWASP LAPSE Project Created
* 8/23/2006 - version 2.5.5 released

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

[[Category:OWASP Project]]

Category:OWASP LAPSE Project

2006-08-24T21:28:59Z

Oberon:

== Overview ==

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].

LAPSE targets the following Web application vulnerabilities:

* Parameter manipulation * SQL injections
* Header manipulation * Cross-site scripting
* Cookie poisoning * HTTP splitting
* Command-line parameters * Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

* Identify taint sources
* Identify taint sinks
* Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

== Goals ==

TBD

== Download ==

TBD

== Features ==

TBD

== Future Development ==

TBD

== News ==

'''OWASP LAPSE Project Created! - 09:37, 22 August 2006 (EDT)'''

OWASP is proud to announce the creation of the OWASP LAPSE project!

== Project Contributors ==

TBD

== Project Sponsors ==

TBD

[[Category:OWASP Project]]

Category:OWASP LAPSE Project

2006-08-24T21:21:15Z

Oberon:

== Overview ==

With the general consensus about building security into the SDLC, there's a high demand for source code auditing tools that can be used directly by developers. And while the commercial space has some good offerings, there isn't really anything that's open source and free - until now.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

== Goals ==

TBD

== Download ==

TBD

== Features ==

TBD

== Future Development ==

TBD

== News ==

'''OWASP LAPSE Project Created! - 09:37, 22 August 2006 (EDT)'''

OWASP is proud to announce the creation of the OWASP LAPSE project!

== Project Contributors ==

TBD

== Project Sponsors ==

TBD

[[Category:OWASP Project]]