System administrators can never be sure of where the next online attack will come from, which is why Yahoo has released a Web application security scanner that could help automate the process of inspecting and detecting potentially problematic URLs.
In a page posted to the open-source code repository GitHub, Yahoo offered details on how organizations can freely use what it describes as a large-scale Web application security scanner, dubbed Gryffin. Available via a BSD-style license, Gryffin will allow admins to look at a wide range of their Web applications, from publicly facing things like load balancers of Web servers or mail gateways to corporate sales and procurement applications. The tool could spot vulnerabilities that leave such applications open to cross-site scripting attacks or SQL injections, among other dangers.
As The Hacker News reported, Gryffin is Yahoo’s attempt to demonstrate some leadership in the security scanner space by addressing the problem of looking at hundreds of thousands of URLs. It also performs functions called crawling, which refers to looking at the entirety of a Web app, and fuzzing, which involves examining and testing various parts of the app.
Though other firms have offered a Web application security scanner before, Yahoo’s focus on this area reflects its ongoing interest in technical areas that later attract mainstream interest, Softpedia News said. For example, Yahoo’s early involvement in Hadoop paved the way for how big data is tackled by many organizations. Similarly, Gryffin could become a common way for companies to proactively defend themselves against major security risks.
The Register took a closer look at the GitHub document and suggested that Yahoo may not only be providing the bare bones of a security scanner, but also a product that contains some of the company’s own code at some point. For now, the beta version of Gryffin includes a combination of Go and JavaScript, requiring prospective users to make use of sqlmap, Kibana, Elastic Research and the NSQ distributed messaging system, among other things.
According to Infosecurity Magazine, choosing a Web application security scanner comes down to a combination of how simple it is to use, the coverage it provides and the complexity of an organization’s website. It may take some time to see whether Yahoo’s Gryffin meets these expectations, but it’s there for anyone to try.