Google open sources RatProxy security tool

Google has released the source code for its internal RatProxy security tool.

The software analyses web pages for potential security risks and reports back to the site administrator.

RatProxy can pick up cross-site scripting flaws and incomplete cross-site defence mechanisms, as well as potential data leak sources and risky code that retrieves data from outside domains.

Google hopes that developers will put the tool to use when coding new web-based services that rely on multiple sites and outside sources for data.

Michal Zalewski, a security engineer at Google, warned, however, that the tool should not be considered a substitute for a thorough analysis by a security professional.

"We feel it will be a valuable contribution to the information security community, helping to advance the understanding of security challenges associated with contemporary web technologies," he said.

"We believe that responsible security research brings a net overall benefit to the safety of the web as a whole, and have released this tool explicitly to support that kind of research."

Users can download RatProxy from the Google Code site. The tool works on Windows, Linux, FreeBSD and MacOS X operating systems.

See also:

Spammers exploit Google Docs

Cyber-crooks turn to mainstream hosted services  03 Jun 2008

Open source security improving rapidly

Two-year quality analysis studied 250 popular applications  20 May 2008

Google security tool goes beyond the network

Browser monitoring extended to roaming users and off-site workers  09 May 2008

Sloppy developers blamed for SQL attacks

Security not being built-in to applications, warns Fortify  01 May 2008

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!