September 29, 2015 By Shane Schick 2 min read

System administrators can never be sure of where the next online attack will come from, which is why Yahoo has released a Web application security scanner that could help automate the process of inspecting and detecting potentially problematic URLs.

In a page posted to the open-source code repository GitHub, Yahoo offered details on how organizations can freely use what it describes as a large-scale Web application security scanner, dubbed Gryffin. Available via a BSD-style license, Gryffin will allow admins to look at a wide range of their Web applications, from publicly facing things like load balancers of Web servers or mail gateways to corporate sales and procurement applications. The tool could spot vulnerabilities that leave such applications open to cross-site scripting attacks or SQL injections, among other dangers.

As The Hacker News reported, Gryffin is Yahoo’s attempt to demonstrate some leadership in the security scanner space by addressing the problem of looking at hundreds of thousands of URLs. It also performs functions called crawling, which refers to looking at the entirety of a Web app, and fuzzing, which involves examining and testing various parts of the app.

Though other firms have offered a Web application security scanner before, Yahoo’s focus on this area reflects its ongoing interest in technical areas that later attract mainstream interest, Softpedia News said. For example, Yahoo’s early involvement in Hadoop paved the way for how big data is tackled by many organizations. Similarly, Gryffin could become a common way for companies to proactively defend themselves against major security risks.

The Register took a closer look at the GitHub document and suggested that Yahoo may not only be providing the bare bones of a security scanner, but also a product that contains some of the company’s own code at some point. For now, the beta version of Gryffin includes a combination of Go and JavaScript, requiring prospective users to make use of sqlmap, Kibana, Elastic Research and the NSQ distributed messaging system, among other things.

According to Infosecurity Magazine, choosing a Web application security scanner comes down to a combination of how simple it is to use, the coverage it provides and the complexity of an organization’s website. It may take some time to see whether Yahoo’s Gryffin meets these expectations, but it’s there for anyone to try.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today