Cloud Security Scanner

Google Cloud Security Scanner (now Web Security Scanner) is a web application vulnerability scanner that automatically scans and detects common vulnerabilities in your App Engine, GKE, and Compute Engine web applications.

Detected Vulnerability Types:

1. Cross-site scripting (XSS) - Detects reflected and DOM-based XSS vulnerabilities.

2. Mixed content - Identifies HTTP resources loaded from HTTPS pages.

3. Outdated libraries - Flags JavaScript libraries with known vulnerabilities.

4. Clear-text passwords - Detects passwords submitted over non-HTTPS connections.

5. Flash injection - Detects Flash-based injection vulnerabilities.

The below example shows how to create and run a scan using the Web Security Scanner API.

It gives the following output,

Scan Configuration created: projects/my-project/scanConfigs/12345

Scan Run: 67890
State: FINISHED
URLs crawled: 847
URLs tested: 1,203

Findings:
SEVERITY  TYPE                    URL
HIGH      XSS_REFLECTED           /search?q=