September 29, 2015 By Shane Schick 2 min read

System administrators can never be sure of where the next online attack will come from, which is why Yahoo has released a Web application security scanner that could help automate the process of inspecting and detecting potentially problematic URLs.

In a page posted to the open-source code repository GitHub, Yahoo offered details on how organizations can freely use what it describes as a large-scale Web application security scanner, dubbed Gryffin. Available via a BSD-style license, Gryffin will allow admins to look at a wide range of their Web applications, from publicly facing things like load balancers of Web servers or mail gateways to corporate sales and procurement applications. The tool could spot vulnerabilities that leave such applications open to cross-site scripting attacks or SQL injections, among other dangers.

As The Hacker News reported, Gryffin is Yahoo’s attempt to demonstrate some leadership in the security scanner space by addressing the problem of looking at hundreds of thousands of URLs. It also performs functions called crawling, which refers to looking at the entirety of a Web app, and fuzzing, which involves examining and testing various parts of the app.

Though other firms have offered a Web application security scanner before, Yahoo’s focus on this area reflects its ongoing interest in technical areas that later attract mainstream interest, Softpedia News said. For example, Yahoo’s early involvement in Hadoop paved the way for how big data is tackled by many organizations. Similarly, Gryffin could become a common way for companies to proactively defend themselves against major security risks.

The Register took a closer look at the GitHub document and suggested that Yahoo may not only be providing the bare bones of a security scanner, but also a product that contains some of the company’s own code at some point. For now, the beta version of Gryffin includes a combination of Go and JavaScript, requiring prospective users to make use of sqlmap, Kibana, Elastic Research and the NSQ distributed messaging system, among other things.

According to Infosecurity Magazine, choosing a Web application security scanner comes down to a combination of how simple it is to use, the coverage it provides and the complexity of an organization’s website. It may take some time to see whether Yahoo’s Gryffin meets these expectations, but it’s there for anyone to try.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today