Access vulnerabilities in an application can allow an attacker to access resources without being authenticated. Access-Me is a Firefox extension used to test for Access vulnerabilities.
Tamper Data is a Firefox Extension which gives you the power to view, record and even modify outgoing HTTP requests. This is extremely useful when trying to answer questions like:
- What cookies are being sent to the browser, and what is the browser returning?
- Are the Cookies marked "secure"?
- When a redirect happens, is it an HTTP 302?
- What kind of HTTP Authentication is happening?
Tamper Data can help answer each of these and other puzzling website behavior questions.
Contents
- 1 Getting Started
- 2 Recording Transactions
- 3 Graphing Results
- 4 Tampering
- 5 Summary
- 6 License
- 7 Comments
|
Getting Started
Since it's a Firefox extension, you'll first need to download and install Firefox (if you haven't already). Then visit the Tamper Data project page and click the link that reads "Install Now".
Finally, restart Firefox and open Tools → Tamper Data. This will bring up the "Tamper Data - Ongoing Requests" window.
Recording Transactions
As soon as the Ongoing Requests window is up, Tamper Data will start recording HTTP requests. Here's what the window looks like after requesting blogger.com's main page.
The columns in the main window pane are:
- Time - When the request happened.
- Duration - How long it took to be retrieved.
- Total Duration - How long it took to render (includes response download time of item and all sub-items)
- Size - Size of received content (-1 indicates the item was loaded from the cache)
- Method - The HTTP method issued (GET or POST)
- Status - HTTP Status code received or "Loaded from cache"
- Content Type - Type of data received (aka Mime-Type)
- URL - Fully qualified URL of request.
- Load Flags - Additional HTTP information used in retrieving or rendering content.
Selecting an item brings its HTTP Request and Response information to the lower two left and right panes respectively.
This gives you a more detailed view into what the request is doing. If the request you selected happened to contain Cookie information, you'll see a Cookie line in the left-hand pane or a Set-Cooke line in the right hand pane or both.
Double-clicking an entry will bring up the "Tamper Details" window, which provides easy access to that request element's data. Here, I've opened the Tamper Details for the Cookie header of the initial blogger.com home page request.
Using the process outlined above, it's easy to inspect what's going on during a browsing session.
Though the data is pretty to look at inside the Tamper Data shell, it's often convenient to move that data into an external file for viewing. To do this, return to the Ongoing requests window, right-click and choose "Copy all".
This will place all the request information into your clipboard so you can paste it into your favorite text editor.
Graphing Results
To graph the recorded results, in the Ongoing Requests window, select the desired results, right-click and choose "Graph selected" or "Graph all".
The columns of the graph are:
- URL - Fully qualified URL for the Item
- Status - HTTP Stats Code
- Duration - How long it took to download
- Time - A Gantt chart of requests.
In the Time chart, you'll notice dark-blue and light-blue bars. The darker blue bars represent the Duration, while the lighter blue signifies the duration of all included components. For example, an HTML page would have a light-blue bar spanning all of its CSS, JavaScript and Image inclusions.
Mousing over a URL reveals more information about that component.
Clicking the URL link opens a tab with that item's contents.
Tampering
"Tampering" is the act of modifying request parameters before request submission. To begin Tampering, in the Ongoing Requests window, click the "Start Tamper" button in the upper-left corner.
From here on out, whenever a top-level request is issued, you'll be prompted to tamper with the request. Selecting the Tamper button will launch the Tamper Popup.
Traditional HTTP header fields are to the left, while any POST data is to the right. If the request uses the GET method, then the right-hand side of the dialog will be empty.
After changing any request parameters, clicking OK will execute the request. In the Tamper Popup window, right-clicking a field reveals shortcut methods for a number of neat tricks such as URL encoding/decoding, Base64 encoding/decoding and HTML character removal.
Summary
Tamper Data is an excellent Firefox extension that matches IBM Page Detailer in features and utility. When Firefox is a permissible browser, Tamper Data is the clear choice between the two. However, there are cases when a non-Mozilla based browser is required (read: IE). In those rare instances, IBM Page Detailer is the way to go.
