Turning FireFox To An Auditing Platform

Auditing exTensions for FireFox

Firefox offers nowadays much more than browsing the web, but auditing the targets. A lot of extensions (and much more to come) exist and lead security auditors to reveal hidden or misc information undetected by traditional application scanners.

The fact is that firefox and its extensions act as an in-between layer collecting all traffic sent and received from the targets.

Here are some useful extensions I am aware of which I use in my regular security testing.

FoxyProxy: FoxyProxy is an advanced proxy management tool that completely replaces Firefox’s proxy configuration. It offers more features than SwitchProxy, ProxyButton, QuickProxy, xyzproxy, ProxyTex, etc

HeaderMonitor: This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content-Encoding, Content-Type, X-Powered-By and others.

HostIP.info Geolocation Plugin: Displays Geolocation information for a website using hostip.info data. Works with all versions of Firefox.

QArchive.org web files checker: llowing people to check web files for any malware (viruses, trojans, worms, adware, spyware and other unwanted things) inclusions.

Bibirmer Toolbar: An all-in-one extension. But auditors need to play with the toolbox. It includes ( WhoIs, DNS Report, Geolocation , Traceroute , Ping ). Very useful for information
gathering phase.

View Dependencies: View Dependencies adds a tab to the "page info" window, in which it lists all the files which were loaded to show the current page. (useful for a spidering technique)

Active Whois plugin for Firefox: Starting Active Whois to get details about any Web site owner and its host server.

SwitchProxy Tool: SwitchProxy lets you manage and switch between multiple proxy configurations quickly and easily. You can also use it as an anonymizer to protect your computer from prying eyes

RefControl: Control what gets sent as the HTTP Referer on a per-site basis.

Fire Encrypter: FireEncrypter is an Firefox extension which gives you encryption/decryption and hashing functionalities right from your Firefox browser, mostly useful for developers or for education & fun.

Shazou: The product called Shazou (pronounced Shazoo it is Japanese for mapping) enables the user with one-click to map and geo-locate any website they are currently viewing.

JSView: The ’view page source’ menu item now opens files based on the behavior you choose in the jsview options. This allows you to open the source code of any web page in a new tab or in an external editor.

View Cookies: It adds a tab to the Page Info dialog box, which shows the cookies of the current webpage. This is interesing for developers, privacy-concious users and others.

Tamper Data: Use tamperdata to view and modify HTTP/HTTPS headers and post parameters.

Cert Viewer Plus: Adds two options to the certificate viewer in Firefox or Thunderbird: an X.509 certificate can either be displayed in PEM format (Base64/RFC 1421, opens in a new window) or saved to a file (in PEM or DER format - and PKCS#7 provided that the respective patch has been applied - cf.

refspoof: Easy to pretend to origin from a site by overriding the url referrer (in a http request). — it incorporates this feature by using the pseudo-protocol spoof:// .. thus it’s possible to store the information in a "hyperlink" - that can be used in any context .. like html pages or bookmarks

SpiderZilla: Spiderzilla is an easy-to-use website mirror utility, based on Httrack from www.httrack.com.

HackBar: This toolbar will help you in testing sql injections, XSS holes and site security. It is NOT a tool for executing standard exploits and it will NOT learn you how to hack a site. Its main purpose is to help a developer do security audits on his code.

People Search and Public Record Toolbar: This Firefox extension is a handy menu tool for investigators, reporters, legal professionals, real estate agents, online researchers and anyone interested in doing their own basic people searches and public record lookups as well as background research.