24 October 2006 | 8,883 views

LAPSE Sourcecode Analysis for JAVA J2EE Web Applications

Acunetix Web Application Security

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with the task of auditing Java J2EE applications for common types of security vulnerabilities found in Web applications. LAPSE was developed by Benjamin Livshits as part of the Griffin Software Security Project.

LAPSE targets the following Web application vulnerabilities:

  • Parameter manipulation
  • SQL injections
  • Header manipulation
  • Cross-site scripting
  • Cookie poisoning
  • HTTP splitting
  • Command-line parameters
  • Path traversal

What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input. Please refer to the OWASP guide to find out more about Web application security.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:

  • Identify taint sources
  • Identify taint sinks
  • Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as RATS, pscan, and FlawFinder. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to look at some of the tools produced by Fortify or Secure Software.

Read more about LAPSE HERE.

You can download LAPSE here:

LAPSE: Web Application Security Scanner for Java





                

Recent in Programming:
- ODA – Online Web Based Disassembler
- Capstone – Multi-platform, Multi-architecture Disassembly Framework
- New eLearnSecurity Pen-Testing Labs Launched – Attend Live Demo Event

Related Posts:
- OWASP CodeCrawler – Static Code Review Tool
- FindBugs – Find Bugs in Java Programs
- Burp Suite v1.2 Released – Web Application Security Testing & Attack Platform

Most Read in Programming:
- FLARE – Flash Decompiler to Extract ActionScript - 61,353 views
- 4f: The File Format Fuzzing Framework - 23,807 views
- Modern Exploits – Do You Still Need To Learn Assembly Language (ASM) - 22,617 views

Low-cost VPS Hosting

Comments are closed.