Google Gruyere is a small, intentionally vulnerable codelab application for learning how web bugs are found and fixed. The official hosted lab is the simplest and most reliable path; this guide also provides an exact local Python 3 setup using a clearly labeled compatibility fork for readers who need an offline copy.
What is Google Gruyere?
Google Gruyere is a web-security codelab built around a deliberately insecure “cheesy” application. It teaches cross-site scripting, cross-site request forgery, access-control failures, information disclosure, denial of service, and other foundational web-security ideas.
The best first experience is the official hosted Appspot lab, which creates a unique sandbox instance in the browser. Google’s original downloadable source targets Python 2.7, so the local modern-Python commands below use the community compatibility fork and label it clearly.
Download, install, run and test Google Gruyere
Google Gruyere is a deliberately vulnerable web-security codelab. The hosted Google instance is the simplest and most reliable choice. The local option below downloads Google’s original source and runs its required Python 2.7 environment in an isolated container on Linux, or with the final Python 2.7 installer on Windows.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
A beginner-friendly Gruyere walkthrough
Start with the setup and “Using Gruyere” sections of the codelab. Create a disposable account, publish one harmless text snippet, upload a harmless text file, and observe the URL and cookie changes. These normal actions give you the baseline needed for later security tasks.
Work through one vulnerability family at a time. Read the defensive explanation after each challenge instead of treating the solution as the finish line. Gruyere is old, but the underlying lessons—untrusted output, ambient browser credentials, unsafe path handling, and excessive server capability—remain relevant.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| Hosted page redirected to a long URL | Expected sandbox behavior | Save the full redirected URL; the identifier separates your instance from other learners. |
| Local page does not open | Python process and log | Check |
| Python reports a missing future module | Virtual environment dependency | Activate the virtual environment and run |
| PowerShell blocks Activate.ps1 | Shell choice | Use the Command Prompt installation method above. It does not require changing the PowerShell execution policy. |
How Ammune helps with production risks represented by Google Gruyere
Gruyere focuses on foundational browser and server weaknesses. The same root causes can affect API-backed applications when user-controlled data, session context, and sensitive responses cross service boundaries.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| Cross-site scripting | An API stores or returns untrusted content that a browser later renders. | Inspect responses for unexpected executable content and connect the response to the endpoint, input, identity, and stored workflow that produced it. |
| CSRF and unsafe state change | A browser sends an authenticated request the user did not intend. | Surface unusual state-changing request patterns and origin or session context; secure anti-CSRF design remains necessary. |
| Access control and information disclosure | A caller reaches another user’s content or receives internal details. | Analyze user-to-object behavior and inspect responses for sensitive fields, tokens, secrets, or excessive data. |
| Denial-of-service patterns | A valid endpoint is called repeatedly or with expensive input. | Use behavior and rate context to identify abnormal request volume, resource-intensive patterns, and repeated error responses. |
Related Ammune guidance: API response data leakage API rate limiting vs behavior detection API authorization vs authentication OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Why is Google Gruyere named after cheese?
The application uses a cheese-themed interface and intentionally contains security holes, matching the holes associated with Gruyere cheese.
Do I need the local source to complete the codelab?
No. The hosted sandbox is enough for most exercises; the source is mainly useful for white-box review and debugging.
What is the difference between black-box and white-box tasks?
Black-box tasks rely on application behavior and traffic, while white-box tasks also require reading the source code.
Why does each hosted learner receive a unique instance?
A unique sandbox separates learner state and limits interference between users.
Is Python knowledge required?
Basic Python helps with source-review exercises, but many lessons can be completed by observing browser behavior and HTTP traffic.
How does Ammune relate to Gruyere?
Ammune applies similar defensive thinking to production API traffic by inspecting behavior, inputs, responses and sensitive data exposure.
Apply the lessons from Google Gruyere to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.