Tools Part 1 - The Intercept Proxy

I was doing an inventory of all of the tools I currently have on my systems that are outside of a standard build (this is business unit requirement for me) and man do I have alot of stuff! So I decided, (in addition to the suggestion from other readers) to include a list of all of the tools I currently use, where you can get them and what I think of them. This list will be specifically web application vulnerability related as that is really my forte and what I am most interested in currently. There may be a few network tools but they will in some way be related to web app security. And this will be a list not of commercially known tools but tools I have amassed from readings, industry events and searches. I will categorize them and dedicate whole postings to a single tool group as the list is long and the postings will be to large to search through. This may take a bit of time and if broken down a bit will be easier to manage for all of us. So here goes we will start with Intercepting Proxies:

Intercept Proxies - An intercept proxy is a tool which combines a proxy server (the server in this case is the application not a physical server) with a gateway. It sits between your browser and your internet connection. Connections made by client browsers are redirected through the proxy with/without client-side configuration allowing the transmission of the request/response to be altered, usually in a way NOT intended by the developer/protocol. This is by far the most valuable tool you will use in your web application vulnerability assessments/attacks. If you have never used this tool imagine you have total control of time; the time between the submission from your browser to the receiving server and from the receiving server back to your browser. This completely opens up the apps for intense inspection and manipulation. Here is my list of Intercept Proxies:

1. Fiddler 2 - http://www.fiddler2.com/fiddler2/ - I found this one by accident in searching for an addon to Internet Explorer as that is the only browser allowed in my professional environment. I use this one all the time as it requires no connection configuration, it is really easy to use and has a bunch of great addons. This is really a developer tool for web code debugging, as really they all are, but works great as a tool of mischief but only for Internet Explorer... It has some really good tutorials online as well.

2. Burpe Suite 1.01 - http://www.portswigger.net/ - This is really the BEST of the best in it's category. It was written by Dafydd Stuttard, the author of "The Web Application Hacker's Handbook - Discovering and Exploiting Security Flaws (ISBN 978-0-470-17077-9 Wiley)" which is the defacto standard in web app security exploits so it makes sense that it would be a great tool. It is full featured but does require configuration (as do the rest of the tools listed) to be used properly.

3. Webscarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project - Taken from the OWASP site: "...WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation, implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser. WebScarab is able to intercept both HTTP and HTTPS communication. The operator can also review the conversations (requests and responses) that have passed through WebScarab..." Enough said... it also has a good spider... this is a good one too!

Paros - www.parosproxy.org/ - I really like Paros because it has a great spider tool as well as the proxy. This spider is great for finding all directories/files on a web server, which in turn is great to use in combination with very specific Google search strings to find all kinds of data leakage. But always remember that spiders make noise, usually alot of noise so be carefull who you unload it on as they will hear/see you, which is why Google is such a valuable tool, but that is for another posting altogether.

Summary:

This are the Interpect Proxies I use, there may be more out there but these are the tools I know and use daily for fun and for security engagements.

Hack this!

So, like me, you have decided to take over the world as a hacker, right? Me too and I have been trying for nearly 10 years. So what am I doing wrong? Let me start this off differently. Do you get “nervous in your pee-pee” when you visit a financial institutions website, type in a bogus name only to see it auto fill the exact character length of the field for you with zeros? Or how about a totally vulnerable URL field in your browser? If this describes you, then this blog is for you. People just have an instinctive curiosity about errors and problem solving; most people want to fix them while others want to move in the other extreme by leveraging the error to its most granular source, complete compromise or failure. We are the “others.” I am not going to impress anyone one with magical code or scripts here, because I am not a wizard (literally), if I were I would not need to be a hacker. I am not a genius (I misspelled this word until I gave up and let spellchecker tell me how to spell it…so there you have it!) but that in my opinion is not the point. I am, however, extremely relentless in my pursuit of virtually anything I ”get into.” This is not really a technical manual either. I will, however, provide EXACT code strings that will leverage the different exploits that I have come across where applicable. This blog is to be a collection of “real world” events that I have encountered in my life that show what a hacker really is all about. I want your feedback in the same way. It’s not about the scripts or the code or the next hot vulnerability, there are plenty of blogs for that already. It is a mind-set that yields pleasure just from the encounter. It is also a real script blog not some jargon filled crap that never really tells you anything useful, aside from extreme concepts clouded by a lack of or poor technical writer. I have been looking for something like this for years, which is why I decided to start it…makes sense. The point is that there is no defined way to hack, it is a language and some people have a better grasp of the vocabulary than others. Just like in programming there are multiple ways to accomplish the same task, some arguably better than others, but nonetheless they all work. Lets not get into the semantics of this right now, for security sake. The idea is that you must understand the thought process more than anything else, which can be perceived as the boring part, until you understand what it is. That is what will allow you to leverage opportunities, which present themselves in the real world everyday. So lets get this started and see what happens and if I get enough good material I will make it into a book. Post away.