Schneier on Security

I knew it. This Firefox is nothing more than a hacker tool!

This is not just useful as a "Hacker" extension. I develop Web Applications for a living and I find it incredibly useful on a daily basis. Not just for manipulating POST parameters, but for quickly listing all browser requests/repsonses, their durations, headers etc...

Unfortunately, SwitchProxy has some stability problems; the longer your browser has been running, the more time the "New Window" and "New Tab" actions will take to produce a result. It's a shame, because it's a really useful extension, but the long pauses finally drove me nuts and I deactivated it.

Great stuff, for a demonstrator on how much info leaves the browser, and as an awareness-raiser on the concept of a Man-in-the-Browser (note: concept, not detail).

So... Can we still use firefox in Germany?

As someone who uses these sorts of tools often, I'd also suggest:

Edit Cookies
https://addons.mozilla.org/en-US/firefox/addon/4510

Selenium IDE (for when you get tired of doing this all manually)
https://addons.mozilla.org/en-US/firefox/addon/2079

View Source Chart (also useful for dissecting web pages, as it shows the effects of javascript on the HTML after the pages has already loaded)
https://addons.mozilla.org/en-US/firefox/addon/655

Another useful proxy is WebScarab:
http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project

There's tons of other tools out there, as well. cURL is great for spidering and mirroring. CAL9000 is great for encoding and decoding strings. And don't forget LibWWWPerl.

Nope greg, not together with these tools.

But you have to explain to our dear audience that "Hacker tools" are illegal in Germany, no matter who uses them (more or less) or why you use them (security audit) because the law is so poorly formulated.

@TheDoctor: "illegal in Germany, no matter (...) why you use them because the law is so poorly formulated"

If you read the law, you will find that preparation of a computer crime is a prerequisite for the illegality of the tools.
http://dejure.org/gesetze/StGB/202c.html

Web Developer:
https://addons.mozilla.org/en-US/firefox/addon/60

and Firebug:
https://addons.mozilla.org/en-US/firefox/addon/1843

I use Chris Pederick's Web Developer extension: http://chrispederick.com/work/web-developer/ to change session cookies and look at hidden form fields. Besides the "hacking" functionality, it also does other handy stuff such as putting hairlines around divs and table cells to help you troubleshoot your HTML and CSS.

I'm going to have to check this out. Looks like it would be tremendously useful in my day job, where I often have to write scripts to emulate browser behavior in order to automate systems that the short-sighted designers never realized someone would want to automate.

@Brent Nordquist

Try Foxy Proxy instead of Switch Proxy.

It feature rule based, on the fly proxy swithching.

I use Muffin Proxy http://muffin.doit.org/ for years and I didn't know, that there is another product out there which has an equivalent preview function. - Thanks for the links. This proxies are exactly what I need.
Maybe (if you not already knew) you should keep an eye on muffin because you can easily write customizations for it.!

I'm a regular user of Tamper Data and have to agree it is very useful.

One should always bear in mind that Firefox extensions act in chrome: context and can execute arbitrary code on your system. So be sure you know what you're installing, and if you're a code auditor, do everyone a favor and take a look at the source.

Tools like this are great to explain to developers why they should place an HMAC over fields that are to be echoed back from the browser - and the HMAC must contain a user identity and should contain session info.

People just don't realize how easy it is to manipulate this stuff.

which one is better? firefox or opera?

We have recently released a tool named PbProxy under an open-source license at (http://http://www.phishbouncer.com/trac) . PbProxy allows interception of HTTP and HTTPS data, is written in Java, and allows customization via a plugin-architecture.

PbProxy is great for intercepting web requests and subjecting them to security checks. By default, it comes
with a set of behavioral phishing checks.

TamperData has been a very useful tool in assessing possible security risks as well as in plain old debugging when developing web sites. It even lets you add headers to the request, which makes it very convenient when simulating specific types of requests from other servers.

@Chris S
How about never sending any data that needs to be "echoed" back from the browser ? Doesn't your server environment keep a "session" in which you can store data between requests ?

I found it easier to tell developpers to never read from the client things the server already knows.

Tamper Data looks like the replacement to HTMLBar for firefox that I've been looking for for a long time. If you need to debug something in IE, that's the plugin you can't live without.

I believe that what you mean to say was "H@ve phun"...