spylogic.net » Application Security

Don’t Drop the SOAP: Real World Web Service Testing for Web Hackers Presentation

Tom — Wed, 31 Aug 2011 15:48:30 +0000

Sorry for the long delay on posting the slides from the presentation that myself, Josh Abraham and Kevin Johnson did at Black Hat USA and DEF CON 19. I’ve uploaded the slides from DEF CON to SlideShare (you can also download a copy there as well) and below are the links to the tools and white paper. I’m currently in the process of working with OWASP to get the testing methodology put into the next version of the OWASP testing guide (v4). If you have any comments or bug reports for the tools and vulnerable web services please let Josh and Kevin know, they would appreciate it!

Download the white paper. Download Josh’s Metasploit modules. Download Kevin’s vulnerable web services.

Don’t Drop the SOAP: Real World Web Service Testing for Web Hackers

View more presentations from agent0x0

More Firefox application testing plugins: ExploitMe

agent0x0 — Mon, 05 Nov 2007 13:21:20 +0000

I recently wrote about some other Firefox plugins which allow you to manipulate and hack web pages. Looks like there is another set of tools called “ExploitMe” which allows for SQL Injection and XSS (Cross Site Scripting), and web service testing. From the article:

“The ExploitMe tools — which are in currently in beta form — include SQL Inject-Me, which lets you right-click on an HTML field in your Firefox browser and inject it with SQL injection payloads, and XSS-Me, which works the same way, but with XSS. The tools developers also plan to release Web services exploit tools as well…”

Looks like this is becoming a new trend in application testing tools. Good to see that things are using a good framework like Firefox extensions to add useful tools for testing. Note that I just did a quick search for the ExploitMe set of of tools in the Firefox extensions database and it has not been released yet as the creators will be launching these tools at the SecTor conference later this month.

Turn Firefox into a Web Hacking Machine

agent0x0 — Thu, 18 Oct 2007 10:32:24 +0000

I have been seeing lots of recent articles about using Firefox as a hacking tool. Basically, you can download extensions (ie: plugins) for use in Firefox to manipulate and hack web pages.

I have listed some extensions that are worthwhile to use for web application testing:

Tamper Data – This extension works a lot like Paros Proxy but you don’t have to configure your proxy settings. If you don’t know what Paros Proxy is…it’s a proxy tool that allows you to intercept a request to a web server and then allow you to manipulate the request and send it on to the server.

Web Developer - A ton of features in this one! Great for taking apart a web page and manipulating stuff in a WYSIWYG.

HackBar – A nice little extension to conduct SQL injections and more.

Note: There are of many more tools!

Where to get these tools and more?
A real comprehensive list of tools is called FireCAT (now at v1.2). FireCAT is a mapping of hacking extensions for Firefox broken up into several different areas like Proxying, Auditing, Encryption, Malware Scanner, Information Gathering, Network Utilities, etc…You can easily download the html files and click on the extensions you want to install. Very easy. Even easier if you have FreeMind installed.