Comments on: Google Ratproxy http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/ Real Web Admins. Real World Experience. Thu, 22 Jul 2010 22:44:25 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: Josh http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/comment-page-1/#comment-515 Josh Mon, 11 May 2009 21:32:34 +0000 http://webadminblog.com/?p=30#comment-515 Sure, feel free to quote me in your report for school and please let me know if you have any questions. Sure, feel free to quote me in your report for school and please let me know if you have any questions.

]]> By: Proxy Guy http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/comment-page-1/#comment-512 Proxy Guy Mon, 11 May 2009 05:22:33 +0000 http://webadminblog.com/?p=30#comment-512 Can I quote you in my report for school? Can I quote you in my report for school?

]]> By: Josh http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/comment-page-1/#comment-74 Josh Sun, 27 Jul 2008 16:41:10 +0000 http://webadminblog.com/?p=30#comment-74 Good point, Victor. There are actually some very good Firefox plugins that you can use to test the security of your web applications. These includes "Add N Edit Cookies" (to modify your cookie info), HackBar (HTML encoding, XSS, SQL Injection), Tamper Data (modify POST parameters), and Live HTTP Headers (view HTTP headers). As Ernest said, the problem with these tools is that while they allow you to test web application security, the user using them has to actually know what they are doing. If you don't know what you are looking for, then a proxy tool like RatProxy helps to fill in those knowledge gaps. Good point, Victor. There are actually some very good Firefox plugins that you can use to test the security of your web applications. These includes “Add N Edit Cookies” (to modify your cookie info), HackBar (HTML encoding, XSS, SQL Injection), Tamper Data (modify POST parameters), and Live HTTP Headers (view HTTP headers). As Ernest said, the problem with these tools is that while they allow you to test web application security, the user using them has to actually know what they are doing. If you don’t know what you are looking for, then a proxy tool like RatProxy helps to fill in those knowledge gaps.

]]> By: Ernest http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/comment-page-1/#comment-72 Ernest Thu, 24 Jul 2008 21:07:48 +0000 http://webadminblog.com/?p=30#comment-72 I think the deal with ratproxy is it's good for less advanced users. You just set up a proxy and browse and then it gives you lovely reports on what's wrong. If you "know what you're doing" you can use WebScarab or any number of other tools, but unfortunately the number of developers that "know what they're doing" in a security sense is low. I think the deal with ratproxy is it’s good for less advanced users. You just set up a proxy and browse and then it gives you lovely reports on what’s wrong. If you “know what you’re doing” you can use WebScarab or any number of other tools, but unfortunately the number of developers that “know what they’re doing” in a security sense is low.

]]> By: Victor Trac http://www.webadminblog.com/index.php/2008/07/22/google-ratproxy/comment-page-1/#comment-71 Victor Trac Wed, 23 Jul 2008 07:21:11 +0000 http://webadminblog.com/?p=30#comment-71 Thanks for posting about Ratproxy. It seems like it could be a useful tool, especially if you're managing a network and trying to figure out the vulnerabilities of your users. For a single user though, it seems to me like a simple browser-side extension could work just as well. Firebug probably has the capability of doing this, although the plugins I've seen are generally geared for web development. It would at least save you the trouble of running a proxy and reconfiguring your browser to use it. Thanks for posting about Ratproxy. It seems like it could be a useful tool, especially if you’re managing a network and trying to figure out the vulnerabilities of your users.

For a single user though, it seems to me like a simple browser-side extension could work just as well. Firebug probably has the capability of doing this, although the plugins I’ve seen are generally geared for web development. It would at least save you the trouble of running a proxy and reconfiguring your browser to use it.

]]>