SecFox is collection of addons which can be used to customize any firefox to a security assessment tool. At the time of writing this collection has 40+ addons which can help the web app sec testers during their assessments.

An ‘addon collector‘ addon is to be installed to get the SecFox updates. So if any new addon added to SecFox collection gives an alert to the subscriber.

Check the video below which explains how.

Download Secfox Collection :

These addons can be of huge help when we perform the type of tests mentioned below.

• Cookie Prediction
• Session Fixation
• Cookie Persistence/Expiration
• Broken Session Management

Traditional Method

We use a proxy interceptor like Paros/Burp/WebScarab to trap the HTTP requests and modify the values during its transit. For this to happen, we need to setup a proxy and ensure that it listens to the browser traffic. An additional step is required if the application uses an SSL connection, i.e. to store the Proxy’s forged certificate in the browser. The intercepted request enables us to add new cookies or modify the existing ones. We can also check when exactly are the cookie values issued and whether it is getting flushed upon session expiration.

Usage of Addons

We have various addons for firefox which makes the tasks mentioned above easier. Certain addons allow to view the cookies stored in the browser and others allows us to edit it. The advantage – we don’t need any proxy to do this job, we can view/edit from the browser itself.

1. View Cookies

This addon adds a tab in the ‘Page Info’ box available on the Firefox context menu.

View Cookies Addon

Download Link:

2. Add N Edit Cookies

This addon integrates a Cookie Editor to firefox. This also allows us to edit the attributes of the cookie.

Add n Edit Cookies Addon

Download Link:

3. FireCookie

If you are using Firebug a lot, then cookies are easily accessible inside firebug tabs if you have FireCookie installed.

FireCookie Addon

Download Link:

4. Cookie Swap

This is an amazing addon which helps us to switch between various cookie profiles. This addon saves all the cookies for a particular domain to the chosen profile. These profiles can be managed through a Profile Manager which comes with the tool. One can add and organize the profile which can be easily swapped from the Firefox status bar. This is of great use if you are testing the application which has multiple login credentials.

Cookie Swap - Status Bar

Cookie Swap - Manage Profiles

Download Link:

5. WebDeveloper – View Cookies

Web developer has a built-in cookie viewer and editor. Once you select on ‘View Cookies’ available under the ‘Cookies’ menu, a new tab is displayed with a big list of cookies for that particular domain and options to edit it. I prefer using ‘Add n Edit Cookie’ to this addon.

WebDeveloper - View Cookies

Download Link:

Video Demo

Watch the following video. Here, I quickly go through each of the addon I’d mentioned above.

Stay tuned… Secfox will continue….

Pen testers fondly use webproxy a lot to manipulate the HTTP requests created by the browser before it is sent to the web sever. This helps us to verify the the absence of any server side validations or flaw in the client side validations. But feel lucky if you are using Firefox while performing web app security assessments, ’cause we have a cool extension ‘GroundSpeed’ which exactly does that.

I dont want to blabber much on describing how it works since the author has a nice writeup in his GroundSpeed homepage.

“Groundspeed is an open-source Firefox extension that manipulates the interface of web applications in order to make the life of the security tester easier. It allows security testers to manipulate the way they interact with the web application’s user interface by manipulating the forms and form elements, eliminating annoying limitations and client-side controls.

Some of the practical uses of Groundspeed include changing the types of form fields, like for example changing hidden fields into text fields, removing size and length limitations on input fields and modifying any JavaScript event handlers to bypass client side validation.

Groundspeed works by dynamically modifying the Document Object Model (DOM) of the page after Firefox has finished loading and rendering it. The changes take effect immediately and, since it happens entirely on the client side without generating new requests to the server, it is completely transparent to the application.”

Check the video

Conclusion

Whatever GroundSpeed can do can be done with Firebug, but this makes life super easy. We might tend to mess the HTML code displayed in the firebug window. But with GroundSpeed, we exactly achieve want we want. Another advantage of this addon compared to firebug is that this helps us to minimize the time wasted in searching for the variable names and the attributes which we intend to change if we had used Firebug.

As the author quotes, Firebug is meant for Developers and GroundSpeed for PenTesters. We hope that there will be many enhancements in the future so as to make this a full fledged PenTest addon.

Gallery

GroundSpeed Conversions

GroundSpeed - Remove Max Length

Install GroundSpeed Firefox Addon:

Using Speedyfox is easy.

1. Download SpeedyFox
2. Run the program and click on ‘Speed Up My Firefox’ button, thats it!

TIP! : For Portable Firefox Users

1. Choose Custom from the Profile dropdown.
2. Browse to ‘PortableFirefox\Data\profiledir’ on your portable drive
3. Now Click on the ‘Speed Up My Firefox’ button

Download SpeedyFox :

Go To SpeedyFox Homepage

Now-a-days most of the feature rich sites interact with the Gears installed in the PC and makes our browsing experience better. But what if we frequently switch our PCs and use portable version of Firefox! what if we dont have admin privileges in the PC we are currently working with? Gears Portable Addon can save our day.

This add-on is an unmodified repackaging of Google’s binaries via the official Windows installer/updater. (In other words, it’s the official releases, simply ZIP’d into an XPI file.)

Installation

1. Download and install Google Gears Portable (This is an experimental addon so check ‘Let me install this experimental add-on‘ to install this addon
2. Restart your firefox.
3. Go to the site you want to enable Gears and click on the Gears icon.
4. As shown in the below screenshot Allow the Gears Access.

Download Gears Portable :

“The tool works by submitting your HTML forms and substituting the form value with strings that are representative of an XSS attack. If the resulting HTML page sets a specific JavaScript value (document.vulnerable=true) then the tool marks the page as vulnerable to the given XSS string. The tool does not attempting to compromise the security of the given system. It looks for possible entry points for an attack against the system” – Security Compass

XSSMe addon is a sidebar tool where we can see all the details of the forms in the current page and select the fields we want to test for XSS. To make things simpler, we have 2 buttons which can be used to test all the fields for Top/All XSS tests.

Click on the image at the right to view it larger

Once we click on test button, we get a dialog box which displays the progress of the running tests. It takes few minutes to complete the tests and depends on the Internet connection speed. We can easily tweak the options if we need this to run quickly and is explained in the latter part of the post.

Working

XSSMe detects the XSS vulnerabilities by automatically submitting the forms which has its field values tampered with XSS scripts and then analyses the response to check whether the output was encoded or not. Each page is loaded in a new tab and then the values are submitted and the tab are closed automatically before testing for the next script.

XSSMe in Action

XSSMe Options

There are few options available in this addon which can help us tweak the results we are looking for. We can change the character set, which XSSMe uses by default, to speed up the process. We can add/remove custom XSS vectors (XSS scripts). The whole list can be exported so that it can be reused later.

Final Report

Once the assessment is complete, final report is displayed which gives us the information on which fields are vulnerable and which XSS scripts got executed. At a quick glance we can check the characters which came out unencoded from the ‘XSS Heuristic Test Results’ section. From the below screenshot, we can find that all the special characters which are used for constructing malicious scripts were found to be unencoded when passed through field1. This implies that field1 is vulnerable to XSS attacks.

Download XSSMe :

(To be continued…)

Firefox is an amazing browser whose features can be extended by installing addons or tweaking the browser itself. This feature of it is utilized to the max for building a powerful hacking/testing tool, SecFox.

This articles(split into sections) details the process of creating SecFox and also includes the usage of various security related firefox addons with relevant examples and screencasts.

“Leave me alone” says Firefox (Create a new profile and let your default Firefox alone)

Before turning Firefox to Secfox, we need to make sure that we don’t mess up with the settings of the existing firefox browser (default profile). For that, we will have to create a new profile called ‘SecFox’. Any modifications, like installing addons or change browser settings, we make while using the SecFox profile will not affect the default profile.

Tweak Firefox Config. (Enable profilemanager)

1. Type about:config in the addressbar
2. In the filter, type ‘profile’ and change profile.manage_only_at_launch to true (default is false).
3. Close firefox

Now create a shortcut of firefox in your desktop and RightClick and open the properties. Now modify the target parameter as shown below.
%Firefox_Installation_Directory%firefox.exe -P -no-remote

Create a new profile ‘SecFox’ with Profile Manager.

To Run the New Profile, create a new shortcut and use the following command
%Firefox_Installation_Directory% firefox.exe -P SecFox -no-remote

You can create 2 shortcuts, one for your default ‘firefox’ and other for ‘secfox’ by using the above command.

Note: -no-remote parameter is used to run mutiple firefox instances simultaneously.

Are you SecFox or Firefox? (How to identify)

While running Secfox and default profile simultaneously, we will have trouble in identifying and switching to the profile required profile. So we need to modify the GUI and other properties of the profiles so that the difference is very much visible and the needed is easily accessible.

Change Desktop Icons

The first activity in this step would be setting different icons for the 2 profiles. Try changing the Secfox to some geeky looking dark icon. IÂ used the icon from crystalXp, which can be downloaded from here.

Differentiate with help of themes

Once you have your firefox windows open, while switching the browser windows (during Alt-tab), you will still find difficulty in mapping browser window and its corresponding profile. So the best option would be to put easily identifiable theme on SecFox. I used black version of the default theme for my new Sec profile, which you can get it from here.

Change Firefox Title

Tweak your titlebar so that you can identify your profile even if Firefox windows are minimized. Download and install Titlebar Tweaks in both the profiles. After installation go to Titlebar Tweak Options and select ‘Browser Name – Webpage Title’ layout. Click on the Browser Name tab and type in ‘S’ and ‘F’ as Browser names, for SecFox profile and default profile respectively.

Install ‘Must Have’ Addons:

Before installing addons which can help us with testing the web applications, we would want to install couple of addons which will definitely help us at later point of time.

FaviconizeTab :

As a tester you might need to keep loads and loads of tabs open that means less space to work and more confusion. FaviconizeTab helps in reducing the size of the tabs and thereby helping us to keep more tabs in little space. Download FaviconizeTab.

Check the post, Ultimate Clutter reduction with Favicons, for amazing tips with FaviconizeTab.

FireGestures :

Control your Firefox with mouse gestures. This can be very useful when you want to do some quick browser navigation (like switching tabs, close tabs, open link in new tab etc). This again will be of great use once we start testing websites. Download FireGestures

GreaseMonkey :

Write custom scripts to modify the way in which the website works. Or load any existing greasemonkey scripts, which can be obtained from various repositories like userscripts.org, to enhance our testing. Download GreaseMonkey

Stylish :

This is similar to greasemonkey. Some cool Stylish scripts are available for download so we need this installed. Download Stylish.

Tweak Firefox Toolbar, Increase your work area:

• ‘Use Small Icons’

RightClick on the toolbar and select ‘Customize’. Check ‘Use small icons’, this reduces the width of the firefox toolbar thereby increasing the vertical space.

• Remove Home Button

We rarely use home button in present in the toolbar by default. We can remove the same by following simple steps. Open ‘Customize’ (check the above bullet) and drag-n-drop the home button from the navigation toolbar into the Customize Toolbars Window.

• Hide the Menus Toolbar (PersonalMenu)

Install Personal Menu (from here), so that we can completely replace the Menu Toolbar with a tiny menu button.

• Combine Stop & Reload Button

We can combine Stop & Reload buttons in the navigation bar by adding a small Stylish scriptfound here (check ‘Must Have’ addons section above to install Stylish). This will display stop icon while loading the page and changes to reload once the page has loaded.

Secfox-Firefox Side-by-Side

Once you complete all the above mentioned steps you have 2 independent firefox windows running with 2 different profiles simultaneously.

Now the new profile, SecFox, has to be made functional with various security related addons.

Upcoming posts related to SecFox will contain Info on installing and using the those addons.

(To be Continued….)

This script comes with additional controls like slideshow, navigation, zoom options.

Keyboard shortcuts are available too…

Note: GreaseMonkey needs to be installed in your firefox so as to make this script work. Install it from here

Tip:

1. Close the lightbox containing the image by just clicking outside the image area.
2. This script can be easily enabled or disabled by right clicking GreaseMonkey Icon in the status bar and check/uncheck Greased Lightbox from the menu.

Install Greased LightMonkey :

After installation, go to the below links and click on the image thumbnails to popup the lightbox.
http://www.mozilla.org/projects/calendar/sunbird/screenshot.html
http://images.google.co.in/images?&q=31nst31n

This can be very useful for students and engineers who get the math problems from the internet and trying to use windows calc while finding out the solution.

Description

In real mode operations supported are +, -, *, /, %, ^, !(factorial) and functions are asin, acos, atan, sin, cos, tan, sqrt, log, ln, exp. Default constants available are e ,mp ,me ,mn ,h ,qe , gv, g, k, pi, ans. More functions and constants can be added using the options window. ‘%’ can be switched to be use as modulo(remainder) or percent.

10%4 = 2 (while in modulo)

10 + 10% = 11; 10+10+10% = 21; 10*10% = 1 (while in percent)

The base can also be changed from the right click options

In Complex mode operations supported are +, -, *, /, ^, and functions are sin, cos, tan, ln, exp, mod, re(real part), im(imaginary part). use ‘i’ for iota

1+i*(1+i) = i;

only three constants are available in complex mode: e, pi, ans

Download Page Status-bar Scientific Calc :

Note : You need to install Faviconize Tab before you proceed with following the below mentioned addons.

If you have faviconize tabs installed and know about it, then skip to Faviconize All Tabs Section

Faviconize Tabs

Faviconize Tab is a wonderful addon which can be helpful for the users who browse heavily with firefox. This addon provides an option to reduce the size of the tab to the favicon of the site reducing clutter.

Before Faviconize

After Faviconize

Download page for Faviconize Tab :

Faviconize All Tabs

I love using Faviconize Tabs and was thinking why is this not a default firefox feature and why in the world would I need to see ‘Site Name – Some Crap Text‘ (Like ‘Gmail – Inbox(3123) – xxx@gmail.com‘) in the tab title to know that its gmail’s tab, if I can simply understand that it is the tab for gmail from the favicon displayed in the tab.

So we can faviconize each tab and keep it simple. But the prob is, every time I have to faviconize any tab, I need to right click and select faviconize and I have to repeat for all the tabs… Is it so? Not really..

Go to Faviconize Preferences and in the Auto Faviconize, put ‘*’ as wildcard. Now every tab you open will be faviconized

Gmail FavIcon Alerts 3

But now you might ask me that the long title in the tab, Gmail – Inbox (No of Unread Messages), is very useful. Atleast you can get to know if you get a new mail, which is not possible with a faviconized tab. But there is an useful greasemonkey script which displays unread count in the tab and also the incoming chat indication in the tab…

Unread Messages

No Unread Message

Incoming Chat

Download Page :

GReader FavIcon Alerts

So what about Google Reader? Fortunately we have something for that too…

Unread Message Count

Unread Message greater than 1K

Download Page :

NOTE: You need GreaseMonkey installed to setup the above to scripts

Tree tabs

So you dont like the tabs on the top or do you think that you need to know from whether you opened this page (Parent page)? Then treetabs is there for you…  Its self explanatory, check the screenshot.

Download page :

Faviconize tabs +(Gmail +Greader) Favicon Alerts +Tree Tabs =  Ultimate Clutter Reduction in Firefox…