This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP LAPSE Project"

From OWASP
Jump to: navigation, search
 
(38 intermediate revisions by 7 users not shown)
Line 1: Line 1:
==== Main ====
+
=Main=
  
'''LAPSE: Web Application Security Scanner for Java'''
+
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
== News ==
+
<div style="width:100%;height:100px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>
* 8/23/2006 - version 2.5.5 released (see http://suif.stanford.edu/~livshits/work/lapse/download.html)
 
* 8/22//2006 - OWASP LAPSE Project Created
 
  
== Overview ==
+
==OWASP Lapse Project==
 +
[[Image:LapseLogo.png|300px|left]]
 +
The OWASP Lapse Project is '''LAPSE+: The Security Scanner for Java EE Applications'''.
 +
'''OWASP LAPSE Project''' is an initiative to make available to developers and auditors a tool for detecting vulnerabilities in Java EE Applications. The project aims to put at their disposal a tool based on the static analysis of code, due to the importance and difficulty of this type of analysis to detect security flaws in Java EE Applications. The difficulty of this analysis increases when they face applications consisting of thousands of lines of code or having a complex structure with many Java classes. Hence, OWASP LAPSE Project offers a tool that helps the developer and auditor to carry out the static analysis of code in the most effective and efficient way. The tool that is provided and gives the name to the project is LAPSE+.
  
LAPSE stands for a <u>L</u>ightweight <u>A</u>nalysis for <u>P</u>rogram <u>S</u>ecurity in <u>E</u>clipse. LAPSE is designed to help with the task of auditing <b>Java J2EE</b> applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].
+
==Introduction==
  
[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
+
'''LAPSE+''' is a security scanner for detecting vulnerabilities of untrusted data injection in Java EE Applications. It has been developed as a plugin for Eclipse Java Development Environment, working specifically with Eclipse Helios and Java 1.6 or higher. LAPSE+ is based on the GPL software LAPSE, developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project]. This new release of the plugin developed by [http://www.evalues.es/index.php/en.html Evalues Lab] of [http://www.uc3m.es Universidad Carlos III de Madrid] provides more features to analyze the propagation of the malicious data through the application and includes the identification of new vulnerabilities.
LAPSE targets the following Web application vulnerabilities:
 
  
    * Parameter manipulation        * SQL injections
+
'''LAPSE+''' is based on the static analysis of code to detect the source and the sink of a vulnerability. The source of a vulnerability refers to the injection of untrusted data, e.g. in the parameters of an HTTP request or a Cookie. The sink of a vulnerability refers to the process of data modification to manipulate the behaviour of the application, such as a servlet response or a HTML page. The vulnerability sources can lead to sinks by simple assignments, method calls or parameters passing. When it is possible to reach a vulnerability sink from a vulnerability source then we have a vulnerability in our application.
    * Header manipulation          * Cross-site scripting
 
    * Cookie poisoning              * HTTP splitting
 
    * Command-line parameters       * Path traversal 
 
  
What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.
 
  
If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:
+
==Description==
  
* Identify taint sources
+
[[Image:LapsePlusScreenshot.png|thumb|300px|right|LAPSE+ in action (click to see a bigger image)]]
* Identify taint sinks
 
* Find paths between sources and sinks
 
  
LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Ounce Labs.
+
'''The vulnerabilities detected by LAPSE+''' are related to the injection of untrusted data to manipulate the behavior of the application. This type of vulnerabilities are the most common in web applications. The vulnerability categories detected by LAPSE+ are enumerated below:
  
For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/
+
* Parameter Tampering.
 +
* URL Tampering.
 +
* Header Manipulation.
 +
* Cookie Poisoning.
 +
* SQL Injection.
 +
* Cross-site Scripting (XSS).
 +
* HTTP Response Splitting.
 +
* Command Injection.
 +
* Path Traversal.
 +
* XPath Injection.
 +
* XML Injection.
 +
* LDAP Injection.
  
== Contributors ==
+
'''Three steps are needed in LAPSE+''' for the detection of this kind of vulnerabilities:
* [http://suif.stanford.edu/~livshits/ Benjamin Livshits]
 
  
== Feedback and Participation: ==
+
* '''Vulnerability Source.''' The first step involves the detection of the points of code that can be source of an attack of untrusted data injection.
 +
* '''Vulnerability Sink.''' After detecting the points of code that can be target of data injection, LAPSE+ identifies the points that can propagate the attack and manipulate the behaviour of the application.
 +
* '''Provenance Tracker.''' Finally, we check if it is ''possible to reach a Vulnerability Source from a Vulnerability Sink'' performing the backward propagation through the different assignations. If this occurs, ''we have a security vulnerability'' in our code.
  
We hope you find the OWASP LAPSE Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected].  To join the OWASP LAPSE Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-lapses subscription page.]
 
  
==== Project Details ====
+
==Licensing==
{{:GPC Project Details/OWASP LAPSE Project | OWASP Project Identification Tab}}
+
The OWASP Lapse Project is free to use. It is licensed under the GNU General Public License version 3.0 (GPLv3).
  
[[Category:OWASP Project|LAPSE Project]]
 
[[Category:OWASP Download]]
 
[[Category:OWASP Tool]]
 
  
 +
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
 +
== What is the OWASP Lapse Project? ==
  
 +
The OWASP Lapse Project provides:
  
__NOTOC__ <headertabs />
+
* Static Analysis (code analysis) for Java EE Applications
 +
 
 +
== Code ==
 +
LAPSE+ on Google Code [https://code.google.com/p/lapse-plus/ https://code.google.com/p/lapse-plus/].
 +
 
 +
== Project Leader ==
 +
 
 +
Gregory Disney-Leugers
 +
 
 +
== Related Projects ==
 +
 
 +
* [[OWASP_CISO_Survey]]
 +
 
 +
| valign="top"  style="padding-left:25px;width:200px;" |
 +
 
 +
== Quick Download ==
 +
 
 +
* LAPSE+ can be downloaded at http://evalues.es/?q=node/14
 +
 
 +
 
 +
 
 +
== News and Events ==
 +
* 2/16/2014 - Gregory Disney-Leugers adopts the OWASP LAPSE Project
 +
* 4/15/2011 - [http://evalues.es/?q=node/14 LAPSE+] released.
 +
* 8/23/2006 - [http://suif.stanford.edu/~livshits/work/lapse/download.html LAPSE 2.5.5] released.
 +
* 8/22/2006 - OWASP LAPSE Project Created.
 +
 
 +
 
 +
== In Print ==
 +
This project can be purchased as a print on demand book from Lulu.com
 +
 
 +
 
 +
==Classifications==
 +
 
 +
  {| width="200" cellpadding="2"
 +
  |-
 +
  | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]] 
 +
  |-
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Project_Type_Files_TOOL.jpg|link=]]
 +
  |}
 +
 
 +
|}
 +
 
 +
=FAQs=
 +
 
 +
; Q1: What should you do to avoid these vulnerabilities in your code?'' - ''How do we protect Web applications from exploits?
 +
: A1: The proper way to deal with these types of attacks is by '''sanitizing the tainted input.''' Please refer to the [http://www.owasp.org/index.php/OWASP_Guide_Project#tab=Home OWASP Guide] to find out more about Web Application Security.''
 +
 
 +
LAPSE+ is inspired by existing lightweight security auditing tools such as [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike this tool, however, LAPSE+ addresses vulnerabilities in Web Applications. LAPSE+ is not intended as a comprehensive solution for Web Application Security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Ounce Labs.
 +
 
 +
; Q2
 +
: A2
 +
 
 +
= Acknowledgements =
 +
==Volunteers==
 +
The OWASP Lapse Project is developed by a worldwide team of volunteers. The primary contributors to date have been:
 +
* Gregory Disney-Leugers
 +
 
 +
 
 +
==Others==
 +
* Pablo Martin Perez
 +
* Jose Maria Sierra
 +
 
 +
= Road Map and Getting Involved =
 +
As of February 2014, the priorities are:
 +
* We hope you find the OWASP LAPSE Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected].  To join the OWASP LAPSE Project mailing list or view the archives, please visit the [https://lists.owasp.org/mailman/listinfo/owasp-lapse subscription page.]
 +
 
 +
Involvement in the development and promotion of OWASP Lapse Project is actively encouraged!
 +
You do not have to be a security expert in order to contribute.
 +
Some of the ways you can help:
 +
* xxx
 +
* xxx
 +
 
 +
 
 +
 
 +
 
 +
=Project About=
 +
{{:Projects/OWASP_LAPSE_Project}} 
 +
 
 +
__NOTOC__ <headertabs />  
 +
 
 +
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Tool]][[Category:SAMM-CR-2]]

Latest revision as of 17:12, 2 February 2017

OWASP Inactive Banner.jpg

OWASP Lapse Project

LapseLogo.png

The OWASP Lapse Project is LAPSE+: The Security Scanner for Java EE Applications. OWASP LAPSE Project is an initiative to make available to developers and auditors a tool for detecting vulnerabilities in Java EE Applications. The project aims to put at their disposal a tool based on the static analysis of code, due to the importance and difficulty of this type of analysis to detect security flaws in Java EE Applications. The difficulty of this analysis increases when they face applications consisting of thousands of lines of code or having a complex structure with many Java classes. Hence, OWASP LAPSE Project offers a tool that helps the developer and auditor to carry out the static analysis of code in the most effective and efficient way. The tool that is provided and gives the name to the project is LAPSE+.

Introduction

LAPSE+ is a security scanner for detecting vulnerabilities of untrusted data injection in Java EE Applications. It has been developed as a plugin for Eclipse Java Development Environment, working specifically with Eclipse Helios and Java 1.6 or higher. LAPSE+ is based on the GPL software LAPSE, developed by Benjamin Livshits as part of the Griffin Software Security Project. This new release of the plugin developed by Evalues Lab of Universidad Carlos III de Madrid provides more features to analyze the propagation of the malicious data through the application and includes the identification of new vulnerabilities.

LAPSE+ is based on the static analysis of code to detect the source and the sink of a vulnerability. The source of a vulnerability refers to the injection of untrusted data, e.g. in the parameters of an HTTP request or a Cookie. The sink of a vulnerability refers to the process of data modification to manipulate the behaviour of the application, such as a servlet response or a HTML page. The vulnerability sources can lead to sinks by simple assignments, method calls or parameters passing. When it is possible to reach a vulnerability sink from a vulnerability source then we have a vulnerability in our application.


Description

LAPSE+ in action (click to see a bigger image)

The vulnerabilities detected by LAPSE+ are related to the injection of untrusted data to manipulate the behavior of the application. This type of vulnerabilities are the most common in web applications. The vulnerability categories detected by LAPSE+ are enumerated below:

  • Parameter Tampering.
  • URL Tampering.
  • Header Manipulation.
  • Cookie Poisoning.
  • SQL Injection.
  • Cross-site Scripting (XSS).
  • HTTP Response Splitting.
  • Command Injection.
  • Path Traversal.
  • XPath Injection.
  • XML Injection.
  • LDAP Injection.

Three steps are needed in LAPSE+ for the detection of this kind of vulnerabilities:

  • Vulnerability Source. The first step involves the detection of the points of code that can be source of an attack of untrusted data injection.
  • Vulnerability Sink. After detecting the points of code that can be target of data injection, LAPSE+ identifies the points that can propagate the attack and manipulate the behaviour of the application.
  • Provenance Tracker. Finally, we check if it is possible to reach a Vulnerability Source from a Vulnerability Sink performing the backward propagation through the different assignations. If this occurs, we have a security vulnerability in our code.


Licensing

The OWASP Lapse Project is free to use. It is licensed under the GNU General Public License version 3.0 (GPLv3).


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

What is the OWASP Lapse Project?

The OWASP Lapse Project provides:

  • Static Analysis (code analysis) for Java EE Applications

Code

LAPSE+ on Google Code https://code.google.com/p/lapse-plus/.

Project Leader

Gregory Disney-Leugers

Related Projects

| valign="top" style="padding-left:25px;width:200px;" |

Quick Download


News and Events

  • 2/16/2014 - Gregory Disney-Leugers adopts the OWASP LAPSE Project
  • 4/15/2011 - LAPSE+ released.
  • 8/23/2006 - LAPSE 2.5.5 released.
  • 8/22/2006 - OWASP LAPSE Project Created.


In Print

This project can be purchased as a print on demand book from Lulu.com


Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files TOOL.jpg

|}

Q1
What should you do to avoid these vulnerabilities in your code? - How do we protect Web applications from exploits?
A1: The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP Guide to find out more about Web Application Security.

LAPSE+ is inspired by existing lightweight security auditing tools such as FlawFinder. Unlike this tool, however, LAPSE+ addresses vulnerabilities in Web Applications. LAPSE+ is not intended as a comprehensive solution for Web Application Security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Ounce Labs.

Q2
A2

Volunteers

The OWASP Lapse Project is developed by a worldwide team of volunteers. The primary contributors to date have been:

  • Gregory Disney-Leugers


Others

  • Pablo Martin Perez
  • Jose Maria Sierra

As of February 2014, the priorities are:

  • We hope you find the OWASP LAPSE Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected]. To join the OWASP LAPSE Project mailing list or view the archives, please visit the subscription page.

Involvement in the development and promotion of OWASP Lapse Project is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

  • xxx
  • xxx



PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP LAPSE Project (home page)
Purpose: LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java EE Applications for common types of security vulnerabilities found in Web Applications. LAPSE was developed by Benjamin Livshits as part of the Griffin Software Security Project. The project's second push is being led by Pablo Martín Pérez, Evalues Lab ICT Security Researcher, developing LAPSE+, an enhanced version of LAPSE.
License: GNU General Public License v3
who is working on this project?
Project Leader(s):
  • Gregory Disney-Leugers @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Main links:
Key Contacts
  • Contact Gregory Disney-Leugers @ to contribute to this project
  • Contact Gregory Disney-Leugers @ to review or sponsor this project
current release
LapsePlus 2.8.1 - March 2011 - (download)
Release description: LAPSE+ is a security scanner for detecting vulnerabilities of untrusted data injection in Java EE Applications. It has been developed as a plugin for Eclipse Java Development Environment, working specifically with Eclipse Helios and Java 1.6 or higher. LAPSE+ is based on the GPL software LAPSE, developed by the SUIF Compiler Group of Stanford University. This new release of the plugin developed by Evalues Lab of Universidad Carlos III de Madrid provides more features to analyze the propagation of the malicious data through the application and includes the identification of new vulnerabilities.
Rating: Yellow button.JPG Not Reviewed - Assessment Details
last reviewed release
Not Yet Reviewed


other releases