I’ve been really surprised that for as long as I’ve been active with OWASP, I’ve never seen a proxy presentation.\u00a0 After all, they are hugely beneficial in doing web application penetration testing and they’re really not that difficult to use.\u00a0 Take TamperData for example.\u00a0 It’s just a firefox plugin, but it does header, cookie, get, and post manipulation just as well as WebScarab.\u00a0 Or Google Ratproxy, which works in the background while you browse around QA’ing your web site and gives you a nice actionable report when you’re done.\u00a0 I decided it was time to educate my peers on the awesomeness of proxies.<\/p>\n
This past Tuesday I presented to a crowd of about 35 people at the Austin OWASP Meeting.\u00a0 The title of my presentation was “Using Proxies to Secure Applications and More”.\u00a0 Since so many people came up to me afterward telling me what a great presentation it was and how they learned something they can take back to the office, I decided (with a little insistance from Ernest) that it was worth putting up on SlideShare and posting to the Web Admin Blog.<\/p>\n
The presentation starts off with a brief description of what a proxy is.\u00a0 Then, I talked about the different types of proxies.\u00a0 Then, the bulk of the presentation was just me giving examples and demonstrating the various proxies.\u00a0 I included anonymizing proxies, reverse proxies, and intercepting proxies.\u00a0 While my slides can’t substitue for the actual demo, I did try to include in them what tool I used for the demo.\u00a0 If you have any specific questions, please let me know.\u00a0 All that said, here’s the presentation<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" I’ve been really surprised that for as long as I’ve been active with OWASP, I’ve never seen a proxy presentation.\u00a0 After all, they are hugely beneficial in doing web application penetration testing and they’re really not that difficult to use.\u00a0 Take TamperData for example.\u00a0 It’s just a firefox plugin, but it does header, cookie, get, […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[96,4],"tags":[201,204,100,12,200,101,90,203,102,202],"class_list":["post-159","post","type-post","status-publish","format-standard","hentry","category-software-and-tools","category-web-app-sec","tag-applications","tag-firefox","tag-google","tag-owasp","tag-proxies","tag-ratproxy","tag-secure","tag-tamperdata","tag-web","tag-webscarab"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t