I'm looking into writing a security tool to test web pages that send post data upon form submit. In a basic .Net WebBrowser control, when the user submits a form, I want my program to capture the post string before it is sent, display it to the user where they can add in a pre-made hack string (sql injection, java alter scripts ect..) and submit the newly edited post string to check against their web site for vulnerabilities
What I can't seem to find is information on is how to capcher that post string. I know it can be done because there is a tool out there called TamperIE that does what I want my program to do but TamperIE is a IE add-on and I'm looking to make a stand-alone winform.
Any tips, helpful links, direction or guidance would be great.
Thanks,
-J
Loading
theLizardPosted Jan 26, 2010, 4:08 PM
You want to find! vulnerabilities, I want to Eliminate vulnerabilities...
That said, Go to this site for the core libraries to integrate HTTP/HTTPS traffic viewing and modification capabilities into your .NET application
And be aware that tools you are trying to develop may be subject to prosecution by federal and state laws for one of many reasons.
Don't worry, I will not post to your q's agin, good luck in your quest.
Jacob RPosted Jan 26, 2010, 9:54 AM
theLizardPosted Jan 26, 2010, 4:27 AM
What is the difference between a vulnerability tool and hacking tool? Nothing! I shouldn't have to explain why I need it or who is going to be using it, but if you must know, I will be using it and I need it because I'm building my own security tools.
True, True and curious, anyway, keep an eye out in this forum and other ASP.NET forums for my $500.00 challenge to anyone who succeeds in getting past a new website security system that is impervious to Brute Force, SQL Injection and other scripting attacks, well at least I am sure it is, hence the challenge I am making.
From what your description of the tools you want to build, they will be of no value in intercepting the string you mention, yes you will be able to see plain text in the html, but things are not what they seem so I would be more than interested in your analysis of my security system.
Brute force, sql injection and scripting attacks can only work if used to access vulnerabilities in databases and/or poor coding techneques, these cannot work on my system simply because validation occurs before any database connection is established, you will see from the outset that attempting to use these methods to penetrate my system will be futile.
I am currently finishing of a couple of things before posting the website address for the challenge but should be ready in two or three days.
We live in a multi dimensional world yet we think only in two dimensions, why is that?
Websites are vulnerable to attack because we follow text book methods to protect them and hackers use text book methods to crack them, throw the text books away and we enter a whole new universe.
Finally, I recon that there should be a whole lot of clever people out there who want to tell me 'I'm going to crack your system because you recon it can't be cracked" :)
Are you up-to the challenge?
Jacob RPosted Jan 26, 2010, 12:17 AM
theLizardPosted Jan 25, 2010, 10:43 PM
Seems to me that this is more a hacking tool than a vulnerability tool.
Jacob RPosted Jan 25, 2010, 6:14 PM
mihir soniPosted Jan 25, 2010, 4:54 PM