I’ll start with the obvious candidates that you probably already have installed if you’re a developer. I’ve also added a few that are useful for post-hack diagnostics and recovery.

General

Firebug – Firebug is great for web development in general, but the debugging tools can help track down calls to rogue javascript on external servers, among many other things.

Web Developer Toolbar – Another great web dev tool, the Web Developer Toolbar makes it easy to turn javascript and cookies on and off selectively, view form fields and disable restrictions and much, much more.

DNS Cache – simple addon that lets you clear or disable Firefox’s DNS cache. Not specifically for pen testing, but useful nonetheless.

Notable - love this addon, which lets you do a full-page screenshot with annotations over at notableapp.com. As you’re testing, there’s a good chance you’re going to need to show your other devs or account managers a screenshot so they can see the vulnerability being exploited. While something simple like Fireshot would work fine (or native screenshots), I like using Notable for complex situations that require explanations on multiple points on the page. Exports to annotated PDF.

Groundspeed – simple form toolkit that allows you to edit form fields (hidden to text, etc), remove length restrictions, change/remove javascript event handlers, and change form target so that it opens in a new tab.

Code Injection

SQL Inject Me – helps test for SQL injection vulnerabilities.

XSS Me – used to test for reflected Cross-Site Scripting (XSS). It does NOT currently test for stored XSS.

Access Me – used to test some access vulnerabilities related to web applications. The tool works by sending several versions of the last page request. A request with the session removed will be sent. A request using the HTTP HEAD verb and a request using a made up SECCOM verb will be sent. A combination of session and HEAD/SECCOM will also be sent.

JS Deobfuscator – many attacks inject obfuscated javascript into a page so that it becomes harder for you to simply grep the source for something obvious, like the domain name to which the bad script is redirecting the user. This addon helps deobfuscate the javascript so you can see what’s really going on.

Hackbar – helps with testing sql injections, XSS holes and site security. Ugly as sin, but it works well.

Header and URL Monitoring/Tampering

Note that some of these addons do similar things – try them and stick with whichever one you like best.

HttpFox – monitors and analyzes all incoming and outgoing HTTP traffic between the browser and the web servers.

Live HTTP Headers – view HTTP headers of a page and while browsing.

Modify Headers – add, modify and filter http request headers. You can modify the user-agent string, add headers to spoof a mobile request (e.g. x-up-calling-line-id) and much more.

Tamper Data – use tamperdata to view and modify HTTP/HTTPS headers and post parameters, trace and time http response/requests and security test web applications by modifying POST parameters.

User Agent Switcher – allows you to easily toggle between pre-set user agent strings, or set your own.

Environment Detection

Header Spy – lightweight addon that displays information about the website’s server in your statusbar. This is not as useful for pen testing as it is for impressing the crap out of clients who don’t know what server they’re running.

Host Spy – integrated shortcut to show you who a website’s IP neighbors are on shared hosting.

ShowIP – Small addons that shows the IP address of the website in your statusbar and a link to some additional tools.

URL Flipper – quickly and easily increment and decrement numbers and strings in URLs for navigating through URL sequences (for example, user ids or session info in the query string.)

Wappalyzer – uncovers the technologies used on websites. It detects CMS and e-commerce systems, message boards, JavaScript frameworks, hosting panels, analytics tools and several more.

Searching

Offensive Security Exploit Database – this adds the excellent database of exploits at exploit-db.com as one of your search engine options.

I’ve also just created a search plugin for XSSed.Com, but it’s pending approval at Mozilla, so not sure when that will be ready for you which can be downloaded here. It’s not exactly rocket science to add a new search site to your browser search bar, but I figured it was quick and easy to whip up. Feel free to check out the source code for the plugin here.

Too Many Addons Got You Down?

If you’re finding your plugins are slowing down Firefox too much, you might want to create a separate Firefox profile specifically for testing, and switch to that profile when you’re ready to start hammering away. Also bear in mind that you might need to tweak some settings on these, or only enable them right before you use them, as the toolbars and sidebars can be a bit bulky.

Also keep in mind that the Net option on the web developers toolbar, or any of the header analyzer addons can be very helpful in general testing between dev and live environments (load the page on live and make sure nothing is being pulled from the dev address) and also to make sure your SSL requests are being handled correctly.

Some Additional Thoughts…

When folks ask me how I do penetration testing – whether I use software, or do it by hand – the best way I can answer is “both”. Software will only ever get you so far, but it’s a critical tool in helping you figure out where the vulnerabilities are. It’s not unlike using a metal detector to find treasure. When the metal detector is doing its job, it finds, well, metal. Not necessarily treasure, although fancier metal detectors have additional software that helps try to identify the buried object by shape and size. You still have to physically dig up the item and rely on your knowledge and experience to determine whether or not it really is treasure, or just junk. The metal detector simply finds something that meets a basic set of requirements, to save you from having to dig up every square inch of the beach.

When testing web applications for vulnerabilities, software does very much the same thing. It simply automates tasks that you could do by hand but that would take an unreasonable amount of time, but ultimately when it finds something, you still need to know enough about what you’re looking at to determine how big a threat it actually is. Most of the time the software will attempt the to try the lowest-level exploit, for example, the ability to execute arbitrary javascript in a page. Your testing tools may demonstrate that you can create a javascript alertbox on the page, but it’s your knowledge and experience that will help you determine the full extent of the vulnerability, for example whether that arbitrary javascript could be used to redirect a user to a new page, hijack the user’s session data, etc.

The reason I ended this post with a long-winded ramble is because I wanted to make it clear that just having the tools isn’t enough. Actually using them, and knowing what to do with the results are important. Understanding the basic mechanics of how exploits work is the only way you can make sure your applications are written to mitigate them. Having the tools installed but never understanding or using them is like buying a metal detector and keeping in the closet and then wondering why you haven’t found anything valuable yet.

If you’re interested in learning more about web application penetration testing and security, check out the following books:

• The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
• Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
• Foundations of Security: What Every Programmer Needs to Know
• Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques

How Do You XSS?

These addons are not obviously meant to be a replacement for more capable and thorough penetration testing tools such as metaploit, netsparker, etc. They’re just meant to be a convenient way for developers to test code during and after development.

There is a more comprehensive collection of addons listed here, but this is what I use. If you’ve got a favorite that I’ve missed, please be sure to share in the comments!

Also check out:

Firefox 3 handles “invalid” and self-signed SSL certificates differently than Firefox 2. In an effort to help the user take control of their own security, Firefox 3 will block the page with an error explaining why the certificate is invalid (“The certificate is not trusted because it is self signed.  Error code: sec_error_ca_cert_invalid”) – and provides a link (albeit a tiny one) that will allow the user to add an exception, allowing that SSL certificate to be accepted and the page to load.

If you have ErrorZilla installed and are running Firefox 3, you’ll actually get stuck and won’t be able to add the exception and therefore won’t be able to load the page. This can be a big problem if you’re running self-signed certificates to encrypt your cpanel/webmin/<other hosting management software> administration areas. Instead, what you see is something like this:

No option to add the exception.

Its unfortunate, since the ErrorZilla developers took the time to update the add-on to “work” with Firefox 3 (meaning it is able to be installed and doesn’t throw a version error), but I’m going to have to disable it until they have the SSL exceptions stuff sorted out.

On the plus side, Jay Baldwin posts to his blog (dated June 30, 2008) that he grok’s why it’s not working:

The main concern is that the error page is not considered trusted, so it has no ability to access resource:// script files, the local file system, chrome:// script files, direct to chrome:// pages, or the like, which means it is on the same security level as a foreign “public” website — it has no access to read from a config file in your Firefox profile or from the Preferences Service (about:config).

I’m still working on finding a way around this . . .  Hit me up in the comments if any of you could suggest a solution. 

Which does, in fact, make sense.The site isn’t trusted, so its not allowed to access the styles used by ErrorZilla.

So – hit him up if you have any thoughts.

Also check out:

I was heartbroken to discover that Google had effectively abandoned the project around the time that Firefox 3 came out – so much so that I delayed upgrading Firefox for a while.  I was hoping they’d change their mind, or get around to updating it – but eventually I realized that Google Browser Sync has been discontinued, and the download has been replaced with the following text:

Google Browser Sync is no longer available for download. Instead, to get similar functionality, we suggest using Mozilla Weave, Google Toolbar for Firefox, or Foxmarks. Support for current Google Browser Sync users will continue through 2008. We’ve also posted the code to Google Code in hopes that someone will use it to develop something cool.

As such, it will not be updated for Firefox 3. However, the code has been made available to the public

Fortunately, the folks at Mozilla Labs came to the rescue, with their new project, Mozilla Weave. Mozilla Weave syncs forms, history, cookies, passwords, tabs and bookmarks – and even has support for Weave add-ins. Plus, you can mount your storage slot using WebDAV – although Mozilla strongly warns against using this space for general storage, as they may delete the contents at any time.

I’ve installed it so far on Win XP and Mac OSX (Leopard), and it’s working smashingly. Learn more about the Weave project, including the basics of how it works and the fundamental principles, at the Mozilla Labs Weave page, or try it out by downloading it today!

Also check out:

I had originally found it while trying to remember how to tweak my Firefox so that when I type in a keyword string into the address bar, it would send me to Google search results, instead of Google’s “I’m feeling lucky”. And sure enough, I found exactly what I was looking for – and tons more – in this article:

You may have noticed that if you type something into Firefox’s address bar that’s not an address (a “keyword”), Firefox typically passes it on to Google as an “I’m Feeling Lucky” search term. The exact search engine string to use is defined in the string preference keyword.URL; if you want to change it to something else, you can simply edit this string.

So I changed it to a normal Google search results string, and voila.

Even though this article was written in 2007, most of the info still applies, so its still a worthwhile article to check out. Computer World: Hacking Firefox: The Secrets of about:config

Also check out:

Also check out:

General Browsing:

URL Fixer
Seamlessly fixes the fat-fingered “.con” typos in a domain name. (Other similar extensions only suggest the alternates after the page has failed to load)

Copy Plain Text
Allows you to copy without formatting

AdBlock Plus
Blocks out inline ads, such as banner ads, Google Adwords, etc. (Note, if you’re a regular at the IWG site, please consider disabling this plugin while there. The ad revenue actually does help keep it running. Its not a lot, but its enough.)

Link Alert
Pops up a teenie icon when you mouseover a link, indicating the type of file a hyperlink goes to (.doc, .pdf, etc).  This is particularly handy if you (like me) hate clicking on a link and then waiting 10 for Adobe Acrobat to open.  Obviously, yes, you can look at the status bar and find out where it’s going – but this extension makes it much more intuitive.

URL Link
Reconnects broken links that are only broken because web-based email wrapped them, etc.  Also has some other neat features.

PDF Download
Makes FF ask you what you want to do with a PDF file, rather than automatically opening it in a browser window.  I’m on a lot of law and court websites often, and many of them offer PDFs, so this is a nice one for me.

Resizable textarea
Just what it sounds like – it lets you make a textarea box bigger for more room to type.

Aging Tabs
Changes the color of the tabs in FF based on how long they have been idle.  This isn’t a critical one, but its helpful to me, since I switch back and forth from tabs so often. At a glance, I can see which are the most active, so I know which ones to click on.

Foxmarks Synchronizer
Syncs all of your Firefox bookmarks across multiple computers.  Requires you to sign up for an account at Foxmarks, but the account sign-up is built in to the initial setup, and it literally took less than 30 seconds. As of October 2008, Foxmarks now supports browser password syncing.

Download Helper
Grab images and video from YouTube, MySpace, etc.

FavLoc
Allows you to set specific favorite folders to save your downloads.

Background Image Saver
More and more sites are utilizing a transparent gif overlay to prevent their images from being saved via the right+click “save image as”. Since Firefox doesn’t have a “Save background image as…”. this extension gives it back to you.

Google Adsense Notifier
Shows you how much you’ve earned in the status bar.  I have found a bit of a glitch with this since the last update, where I can no longer view the amount from last payment (it shows the amount for all time instead), but I am hopeful that this will get fixed soon, since I really like this extension.

Gutil!
Just a quick shortcut to Google services (mail, news, etc.)  Simple, but nice.

Read it Later
This is a handy little addon that lets you flag a page to read later. If you’re like me, you constantly find interesting pages that you want to delve into, but don’t always have time, the very moment you find them. While you could certainly just set up a Bookmarks folder for stuff you want to get to later, Read it Later adds a spiffy icon in your address bar. One click and its saved for later.

Google Preview
Provides a thumbnail screenshot next to the site link and summary in Google search results. I wouldn’t have thought I needed this when I first heard about it, but its become one of my favorites.

Web Development:

IE Tab
This is perhaps more important as a web developer, but there are times when a page won’t render correctly in FF, so it’s nice to have an alternate way of viewing it. There is also a trimmed down version of this extension available as IE Lite. Alas, for PC only.

Aardvark
This one is a must-have for all web developers.  It allows you to quickly and easily view and select distinct elements of a webpage, displaying their characteristics, including id. Great for troubleshooting HTML and CSS.

Web Developer Toolbar
This is THE first extension I go for when setting up a new computer.  Tons of web dev tools, including viewing submitted headers, debugging tools, and so on.

Firebug
This is the SECOND extension I go for when setting up a new computer. If I ever get to meet the people who came up with this, I’m going to march right up to them and plant a wet one on their face. This extension has saved me so much time and aggravation – I can’t imagine being a web developer without it. How did I do it before Firebug? Firebug gives you easy access to CSS styles, HTML attributes, even network calls for external files.

User Agent Switcher
Helps debug any weird encoding issues you might run across.

ShowIP
Shows the IP address of the website host.  Useful if you’re working with a site that does load-balancing, dev environments, and so on.

Server Spy
This addon lets you see what type of server the website you’re visiting is running, similar to Netcraft’s “What that site running” lookup.

Character Identifier
This extension adds a context menu item for selected text that provides more information (from the Unicode database) about the characters selected.

Server Switcher
If you work with a dev and live server environment, such as dev.yoursite.com and www.yoursite.com, this extension allows you to easily switch between the two servers from any page on either server.  It would have been nice if you could add one more version, such as staging, but overall its really quite handy.

Fireshot
A very slick, lightweight screenshot addon that allows simple annotations and highlight boxes. Very handy for explaining elements to clients, helping non-techy people understand what and where to click, and so on. There is a free version and a paid version, but I’ve found that the free version is more than adequate for most use. Only available for Windows… *sniffle*

Colorzilla
Great little addon that gives you the power of a color eyedropper in your browser. Need to grab a color from a website to make additional graphics? No problem. Two clicks later, you’ve got the RGB or hex color code copied to your clipboard. This addon has saved me a ton of time.

MeasureIt
Handy little addon that lets you whip out a ruler and measure the size of anything in your browser, in pixels.

HttpFox
Lets you see the headers being sent through the browser – can be helpful for debugging scripts.

The Pencil Project
Great addon that lets you plan and tweak GUI interfaces right in your browser. Click here to read more about the Pencil Project in a previous Snipe.Net article.

Social

Twitterfox
Simply THE easiest way to Twitter. There isn’t a time when I’m on the computer without a browser window open, so this slim Twitter client makes it unbelievably easy to post to and read Twitter updates. Don’t use Twitter? Click here to learn why you should!

Not at All Useful, But Still Fun

Bork Bork Bork!
Translates webpage text into Swedish Chef

Also check out: