This past Tuesday I presented to a crowd of about 35 people at the Austin OWASP Meeting.  The title of my presentation was "Using Proxies to Secure Applications and More".  Since so many people came up to me afterward telling me what a great presentation it was and how they learned something they can take back to the office, I decided (with a little insistance from Ernest) that it was worth putting up on SlideShare and posting to the Web Admin Blog.

The presentation starts off with a brief description of what a proxy is.  Then, I talked about the different types of proxies.  Then, the bulk of the presentation was just me giving examples and demonstrating the various proxies.  I included anonymizing proxies, reverse proxies, and intercepting proxies.  While my slides can't substitue for the actual demo, I did try to include in them what tool I used for the demo.  If you have any specific questions, please let me know.  All that said, here's the presentation.

I don't claim to be an expert on proxies, but I have used several in the past including OWASP WebScarab and Paros. While both of these tools provide features as described above, Ratproxy takes a very different approach. You start up your proxy and tell the browser to pass requests through it. Simple enough. Then you just start surfing your website as though you were a regular user. In the background, Ratproxy is collecting all sort of useful information about the website. When you're done surfing the site, you run the report which comes out as a nice web page full of useful information about the site. It'll show you pages vulnerable to CSRF, XSS, and a host of other security vulnerabilities. It ranks then based on high, medium, and low impact and provides very good explanations of the issues it has found.

The Ratproxy tool has ports for Mac OS/X, Linux, and Cygwin (Windows). When I first tried to compile it in Cygwin, I had all sorts of error messages, but then I found this very help web page that told me exactly what libraries Cygwin was missing in order for me to compile it correctly. Part two of that article even goes on to tell you how to begin using Ratproxy.

To many, Web Application Security is a scary thing that takes a lot of time and effort to figure out how to do things right, but it doesn't have to be. You also don't have to pay an arm and a leg to do a decent security audit of your website. Start today by downloading Ratproxy and get a feel for how secure your site is without paying a dime.