lainchan / sec

2021 and pentesting in the browser

Nemissa · 2021-05-24 20:06
Tamper data. Hackbar. User agent switcher. The good 'ole day of pentesting via the web browser. Then, Firefox went quantum, lots of add-ons died. What are good pentesting add-ons for firefox in 2021 ? Is pentesting from the browser dead, and if so, what is the replacement ? Proxies like ZAP ? Burp Suite ? The links I find in the "ultimate bestest list ever" are either dead, or just link to the same privacy add-ons, which are not relevant here. What do you lains use for your 1337 website haxs, CTFs, challs, whatever ? I'm going to pursue my research. I have a VM to pwn. If I don't come back with more info, please avenge me.
Jens Hansen · 2021-05-31 14:46
>>15907 I use FoxyProxy, Cookie-Editor and Burp Suite.
kushmasta420 · 2021-05-31 19:08
I used to think user agent switchers were some really cool high tech soykaf but all it does is spoof HTML request headers which you can easily write a script for. Nothing's changed. Some other tools include TamperMonkey, burp suite, etc. Most pentesting that I've done could be done using just the stock firefox dev tools (F12)
Jane Doe · 2021-06-02 23:59
>>15907 The only real "pentesting" addon i have is foxy proxy so I can switch to burb or zap if I have to brute force passwords, fuarrrk throttling
Vasya Pupkin · 2021-06-07 18:36
curl is more than enough, also a bit of python and go
Delilah · 2021-06-17 18:01
for security reasons, experts recommend you use Google Chrome instead of Firefox.
Judge Fang · 2021-06-17 19:03
>>16203 lol, neither is particularly safer than the other and they're both pretty horrible for privacy as well.