k‎ > ‎


credkaspersky.png Kaspersky Netflix has released 'Sleepy Puppy,' XSS flaw detection software, to the open-source community for further development.

Cross-site scripting is a web application vulnerability which allows attackers to execute arbitrary code client-side in a victim's browser, which can lead to browser session hijacking or the theft of sensitive data. XSS flaws compile a wide range of hacking techniques and buggy code issues which can compromise a web page, and while there are a number of tools available to mitigate the problem, XSS vulnerabilities remain a persistent problem for webmasters to cope with.

On Monday, Netflix team members Scott Behrens and Patrick Kelley revealed the open source release of the firm's cross-site scripting (XSS) payload management framework. Dubbed Sleepy Puppy, Netflix says the tool goes beyond only testing main applications for XSS flaws and also encompasses scans for secondary applications which may provide the conduit for XSS security flaw exploit.

In other words, Sleepy Puppy keeps an eye out for XSS payloads which may be injected within primary applications -- but not trigger an alert -- before shifting to a secondary area and executing. The Netflix team call this "delayed" XSS testing.

Sleepy Puppy is designed to simplify the process of capturing, managing, and tracking XSS propagation over periods of time and testing sessions. The configurable tool leverages an assessment model to categorize XSS strings and injections and allows users to subscribe to email notifications when delayed cross-site scripting events are triggered.

Sleepy Puppy comes with a number of payloads, as well as an API for users who wish to develop plugins to support scanners such as Burp or Zap.

What's Hot on ZDNet

  • Apple to live stream September 9 event: How you can watch
  • Could a $50 Amazon Fire tablet reignite stagnant tablet sales?
  • This official touchscreen can turn your Raspberry Pi into a tablet
  • One simple trick to speed up your old iPhone or iPad

The default "PuppyScript," a Java-based script which collects information on an executed payload, captures metadata including the URL, DOM, user-agent, cookies, referer header, and a screenshot of the application where a payload executed. The team explained:

"As payloads propagate throughout a network, the tester can trace what applications the payload has executed in.

For more advanced use cases, security engineers can chain PuppyScripts together and even leverage the generic collector model to capture arbitrary data from any input source."

The XSS flaw detection tool also makes use of Python 2.7 with Flask, SQLAlchemy with configurable backend storage, the Ace Javascript editor and Html2Canvas JavaScript for screenshot capture, as well as the optional use of AWS Simple Email Service (SES) for email notifications.

"Sleepy Puppy is helping the Netflix security team identify XSS propagation through a number of systems even when those systems aren't assessed directly. We hope that the open source community can find new and interesting uses for Sleepy Puppy, and use it to simplify their XSS testing and improve remediation times," the team says.

Sleepy Puppy, available from the Netflix Open Source website, comes with built-in payloads, PuppyScripts and a default assessment scheme.

Last month, the Core Infrastructure Initiative asked for input from the open-source community concerning what standards should be in place to measure the security, quality and stability of open-source software.

Read on: Researcher lashes out at Hacking Team over open-source code discovery

20 must-have back to school, college gadgets... SEE FULL GALLERY 1.jpg 2.jpg 3.jpg 4.jpg 5.jpg 6.jpg 7.jpg 7.jpg 8.jpg 10.jpg 11.jpg 12.jpg 13.jpg 14.jpg 15.jpg 16.jpg 17.jpg 18.jpg 19.jpg 20.jpg 1 - 5 of 20 NEXT PREV

Read on: Top picks

  • How to access Wi-Fi anonymously from miles away
  • Apple OS X zero-day flaw hands over root access without system passwords
  • Getting physical: A $10 device to clone RFID access keys on the go
  • Amazon dreams of drones-only airspace
  • Strike the source: RIAA targets BitTorrent protocol to block pirate content
  • Three top tips to keep connected cars safe from hackers

In pictures:

  • Top 5 security practices in staying safe online: From the experts
  • Cybersecurity reads which belong on every bookshelf
  • Must-have iOS, Android productivity apps
  • Safari browser extensions you never knew you needed


Subpages (8): 6 a b g h i q x