HTML-Debug v3.0

[Ncqr]

Wow i was absolutly amazed that i havent found this tool sooner.

Completly stunned at this tool. I have been looking for something like this for along time that can manipulate cookie + header data really fast and on the same tab. If ya dont know what im talkin about then dont worry this tool isnt for you.

But wow.


http://www.ken78x.com/index.php?page=downloadHD

If when you install it, it begins to crash the just go into the data folder and have a muck around with the config settings. I think the problem is the defualt site setting. Change it to a real site and ya will have no problems.

Worked with me.

[Permutant]

That sounds handy, thanks a lot for sharing the fun, Ncqr

[FlowerHorn]

ken78x makes many good tools. I love his html debugger, been using it like forever :)

[thchog]

Curious if anyone knows before I seek the answer out what the Trojan-Spy in the download really is?
I downloaded a few of Ken78's tools and this was the only one that came up as infected (not to mention he's supported @ some other very big and knowledgable, securi minded boards) so I presume it must either be due to its name or its functions (what ncqr's main reasons for liking the proggie) so I would not worry anyone reading this, just curious. I attached a screen shot of what occured when I scanned the zip/rar file before opening.....

Its 1 zip/rar with 1 word doc and 2 screen shots pasted on that word doc, no more.l
http://rapidshare.de/files/29081030/HTML_Debugger.rar

OH NCQR check this out, seems in the vicinity of your interests?

http://suif.stanford.edu/~livshits/work/lapse/

Below is a description of the tools use, for your interest perhaps use it in reverse, and could be quite fun/useful

LAPSE stands for a Lightweight Analysis for Program Security in Eclipse. LAPSE is designed to help with auditing Java J2EE applications for common types of security vulnerabilities. LAPSE was developed as part of the Griffin Software Security Project.

LAPSE targets the following Web application vulnerabilities:
Parameter manipulation
Header manipulation
Cookie poisoning
Command-line parameters SQL injections
Cross-site scripting
HTTP splitting
Path traversal




What should you do to avoid these vulnerabilities in your code? How do we protect Web applications from exploits? The proper way to deal with these types of attacks is by sanitizing the tainted input.

If you are interested in auditing a Java Web application, LAPSE helps you in the following ways:
Identify taint sources
Identify taint sinks
Find paths between sources and sinks

LAPSE is inspired by existing lightweight security auditing tools such as RATS, pscan, and FlawFinder. Unlike those tools, however, LAPSE addresses vulnerabilities in Web applications. LAPSE is not intended as a comprehensive solution for Web application security, but rather as an aid in the code review process. Those looking for more comprehensive tools are encouraged to either read our Usenix Security '05 paper or to look at some of the tools produced by Fortify or Secure Software.

[Ncqr]

Hmm very interesting about the Trojan-Spy in the program. I suspect that it is due to what the program does. I.e if i was to download a root kit onto my computer just to check it out... my AV would warn me and then try to delete it becasue it is a root kit and the AV thinks that the root kit is trying to own my box but infact i downloaded it myself. I could be wrong... very wrong. But i havnt heard many bad things about it and many of us here have been using it for a long time with out any problems.

And a very nice find thchog with the other program...i will deffently give it a bash.

[thchog]

Yeah I get similar warnings from KAV on formfinal and form@, I am not worried, I suspect you are correct.

[thchog]

Another you may enjoy Ncqr

Lazy Authorization Forcer

http://www.gnucitizen.org/projects/javascript-authorization-forcer/

This is an idea I am still developing but here you go POC is available
and it works. The malicious JavaScript presented here will try to
guess URLs that contain credentials. It is sort of Basic
Authentication/FTP Authentication bruteforcer.

The POC works well in IE6, IE7, Firefox and Opera. I wasn't able to
suppress the Basic Authentication dialog when trying to create Basic
Authentication Bruteforcer. However, I came up with this lazyForce
implementation. A typical attack vector will be as the following:

1. The attacker discovers your internal IP
2. Based on your IP a class C range is enumerated using the Port
Scanning or Visited Link Scanning technique.
3. Once a target is discovered a large enough dictionary is used to
find valid credentials associated with each IP.

In order to make IE work a style sheet that is embeded inside the
current document needs to be reused. Read the provided source code for
more information.

Visited Link Scanner

http://www.gnucitizen.org/projects/javascript-visited-link-scanner/

This is a technique that I've learned from Jeremiah Grossman

(http://jeremiahgrossman.blogspot.com/)

and his presentation on
JavaScript malware. Please, keep all the credits for this finding to
Jeremiah.

http://www.gnucitizen.org/projects/javascript-visited-link-scanner/visitedlinkscanner.js

The POC presented here is my improved version of the POC presented in
BlackHat. I made it work well in IE6, IE7, Firefox and Opera. IE6 has
very nasty disabilities when dealing with dynamically generated style
sheets. However, these can be easy sorted out by reusing the current
style sheet. If you are interested how it works just read the provided
source code.

Well, this is it.

--
pdp (architect)

http://www.gnucitizen.org