the-web-application-hackers-handbook

772 Chapter 20 n A Web Application Hacker’s Toolkit
required. What these browser extensions do is provide a quick and easy way to
instrument the functionality of a standard browser without interfering with the
network-layer communications between the browser and server. This approach
therefore enables you to submit arbitrary requests to the application while
allowing the browser to use its normal means of communicating with the
problematic application.
Numerous extensions are available for both Internet Explorer and Firefox
that implement broadly similar functionality. We will illustrate one example
of each. We recommend that you experiment with various options to find the
one that best suits you.
You should note that the functionality of the existing browser extensions is
very limited in comparison to the main tool suites. They do not perform any
spidering, fuzzing, or vulnerability scanning, and you are restricted to working
completely manually. Nevertheless, in situations where you are forced to use
them, they will enable you to perform a comprehensive attack on your target
that would not be possible using only a standard browser.
Tamper Data
Tamper Data, shown in Figure 20-15, is an extension to the Firefox browser.
Anytime you submit a form, Tamper Data displays a pop-up showing all the
request details, including HTTP headers and parameters, which you can view
and modify.
Figure 20-15: Tamper Data lets you modify HTTP request details within Firefox
TamperIE
TamperIE, shown in Figure 20-16, implements essentially the same functionality
within the Internet Explorer browser as Tamper Data does on Firefox.