Firefox Web Browser Weaponization Redux

I've written about the Samurai Web Testing Framework (WTF) LiveCD project and some of the Firefox Add-Ons that can be used to transform Firefox into a highly capable Web application penetration testing tool. Now the Add-Ons included in Samurai and a few others have been bundled together into the Samurai WTF Firefox Collection--essentially, a one-stop shop for Web browser weaponization.Raul Siles created the Add-Ons Collection and said in his blog that "the goal of this Firefox collection is to include the best add-ons for Web application penetration testing and offensive security analysis, to convert your browser into the ultimate pen-testing tool." And that goal is definitely achieved with add-Ons like Firebug, Tamper Data, Web Developer, HackBar, SQL Inject Me, and much more -- 19 in total.

Although I highly recommend using the Samurai WTF LiveCD, the collection gives security professionals one place to go and install the latest versions of some of the best Firefox add-Ons right in their browser without booting to a LiveCD. It's certainly a time-saver and great resource for new pen-testers.

There are a few small differences between the collection and LiveCD. Right now, the collection includes View Dependencies, JavaScript Deobfuscator, and Advanced Dork, which are not on the LiveCD. Raul also opted to include FoxyProxy Standard instead of SwitchProxy.

While I'm talking about free tools, I want to mention briefly a tool I just came across this morning called turbodiff from CoreLabs, a research group from Core Security. The Website explains it best: "Turbodiff is a binary diffing tool developed as an IDA plugin. It discovers and analyzes differences between the functions of two binaries."

Remember the buzz around reverse engineering security patches in order to discover the vulnerability being patched so an exploit can be developed? While not automated like a research paper promised last year, it can certainly cut down the time needed to find where changes were made and help exploit developers to hone in on the area of interest. This is project worth keeping an eye on if you do any reverse engineering and vulnerability research.

Meanwhile, I could mention something about a certain open source exploit development and penetration testing tool and project being sold, but that's been covered well already.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.