Firefox Addons For Penetration Testing

[DarkyAngel]

The majority of the penetration testers are using the Mozilla Firefox as a web browser for their pentest activities.This article will introduce the firefox addons that can be used for a web application penetration test.

1) Firebug

It is useful for the debugging tools that can help you tracking rogue javascript code on servers.

2) User Agent Switcher

You can use this extension to change the user agent of your browser.Useful for web application penetration tests that you want to check and the mobile versions of the websites.

3) Hackbar

Useful for SQL injection and XSS attacks.It includes also tools for URL and HEX encoding/decoding and many more.

4) HttpFox

Monitor and analyze all the incoming and outgoing HTTP traffic between your browser and the web server.

5) Live HTTP Headers

View the HTTP headers of a website instantly.

6) Tamper Data

View and modify HTTP/HTTPS headers and post parameters.

7) ShowIP

Shows the IP of the current page in the status bar.It also includes information like the hostname,the ISP,the country and the city.

8) OSVDB

Open Source Vulnerability Database Search.

9) Packet Storm search plugin

Search the packet storm database for exploits,tools and advisories.

10) Offsec Exploit-db Search

Search the Exploit-db archive.

11) Security Focus Vulnerabilities Search Plugin

Search for vulnerabilities in the Security Focus

12) Cookie Watcher

Watch the selected cookie in the status bar.

13) Header Spy

Shows HTTP Headers on status bar

14) Groundspeed

Manipulate the application user interface.

15) CipherFox

Displays the current SSL/TLS cipher and certificate on the status bar.

16) XSS Me

Tool for testing reflected XSS vulnerabilities.

17) SQL Inject Me

Extension to test SQL Injection vulnerabilities.

18) Wappalyzer

Discover technologies and applications that are used on websites.

19) Poster

Make HTTP requests,interact with web services and watch the output.

20) Javascript Deobfuscator

Show the JavaScript code that are running on web pages.

21) Modify Headers

Modify HTTP request headers.

22) FoxyProxy

Advanced proxy management tool.

23) FlagFox

Displays a country flag for the location of the web server.It also includes tools such as Whois,Geotool,Ping,Alexa etc.

24) Greasemonkey

Customize the way a webpage behaves by using small bits of JavaScript.

25) Domain Details

Displays Server Type, Headers, IP Address, Location Flag, and links to Whois Reports.

26) Websecurify

Useful for security assessments in web applications.

27) XSSed Search

Search the cross-site scripting database at XSSed.Com

28) ViewStatePeeker

ASP.NET viewstate viewer.

29) CryptoFox

CryptoFox is an encryption/decryption tool for cracking MD5 passwords.

30) WorldIP

Location of the web server,IP,Datacenter,Ping,Traceroute,RDNS,AS etc.

31) Server Spy

Unveils the technology of the web server (Apache, IIS etc.)

32) Default Passwords

Search CIRT.net default password database.

33) Snort IDS Rule Search

Search for Snort IDS Rules.

Sursa