Difference between revisions of "OWASP LAPSE Project"

From OWASP
Jump to: navigation, search
(Added to make the internal links work better)
 
Line 1: Line 1:
#REDIRECT [[Category:OWASP LAPSE Project]]
+
==== Main  ====
 +
 
 +
'''LAPSE: Web Application Security Scanner for Java'''
 +
== News ==
 +
* 8/23/2006 - version 2.5.5 released (see http://suif.stanford.edu/~livshits/work/lapse/download.html)
 +
* 8/22//2006 - OWASP LAPSE Project Created
 +
 
 +
== Overview ==
 +
 
 +
LAPSE stands for a <u>L</u>ightweight <u>A</u>nalysis for <u>P</u>rogram <u>S</u>ecurity in <u>E</u>clipse. LAPSE is designed to help with the task of auditing <b>Java J2EE</b> applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by [http://suif.stanford.edu/~livshits/ Benjamin Livshits] as part of the [http://suif.stanford.edu/~livshits/work/griffin/ Griffin Software Security Project].
 +
 
 +
[[Image:screenshot.jpg|thumb|300px|right|LAPSE in action (click to see a bigger image)]]
 +
LAPSE targets the following Web application vulnerabilities:
 +
 
 +
    * Parameter manipulation        * SQL injections
 +
    * Header manipulation          * Cross-site scripting
 +
    * Cookie poisoning              * HTTP splitting
 +
    * Command-line parameters      * Path traversal 
 +
 
 +
What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.
 +
 
 +
If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:
 +
 
 +
* Identify taint sources
 +
* Identify taint sinks
 +
* Find paths between sources and sinks
 +
 
 +
LAPSE is inspired by existing lightweight security auditing tools such as [http://www.securesw.com/rats RATS], [http://www.striker.ottawa.on.ca/~aland/pscan/ pscan], and [http://www.dwheeler.com/flawfinder/ FlawFinder]. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Ounce Labs.
 +
 
 +
For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/
 +
 
 +
== Contributors ==
 +
* [http://suif.stanford.edu/~livshits/ Benjamin Livshits]
 +
 
 +
== Feedback and Participation: ==
 +
 
 +
We hope you find the OWASP LAPSE Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org.  To join the OWASP LAPSE Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-lapses subscription page.]
 +
 
 +
==== Project Details ====
 +
{{:GPC Project Details/OWASP LAPSE Project | OWASP Project Identification Tab}}
 +
 
 +
[[Category:OWASP Project|LAPSE Project]]
 +
[[Category:OWASP Download]]
 +
[[Category:OWASP Tool]]
 +
 
 +
 
 +
 
 +
 
 +
__NOTOC__ <headertabs />

Revision as of 10:35, 2 March 2011

Main

LAPSE: Web Application Security Scanner for Java

News

Overview

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by Benjamin Livshits as part of the Griffin Software Security Project.

LAPSE in action (click to see a bigger image)

LAPSE targets the following Web application vulnerabilities:

   * Parameter manipulation        * SQL injections
   * Header manipulation           * Cross-site scripting
   * Cookie poisoning              * HTTP splitting
   * Command-line parameters       * Path traversal  

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

  • Identify taint sources
  • Identify taint sinks
  • Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as RATS, pscan, and FlawFinder. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Ounce Labs.

For now, LAPSE is housed at http://suif.stanford.edu/~livshits/work/lapse/

Contributors

Feedback and Participation:

We hope you find the OWASP LAPSE Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org. To join the OWASP LAPSE Project mailing list or view the archives, please visit the subscription page.

Project Details

PROJECT INFO
What does this OWASP project offer you?
what is this project?
OWASP LAPSE Project

Purpose: N/A

License: N/A

who is working on this project?
Project Leader: Pablo Martín Pérez

Project Maintainer:

Project Contributor(s): N/A

how can you learn more?
Project Pamphlet: N/A

3x slide Project Presentation: N/A

Mailing list: N/A

Project Roadmap: N/A

Main links: N/A

Project Health: Yellow button.JPG Not Reviewed (Provisional)
To be reviewed under Assessment Criteria v2.0

Key Contacts
  • Contact Pablo Martín Pérez to contribute, review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.