I’ve moved to Chrome and Safari as my primary browsers, but nothing compares to Firefox when it comes to functionality and plugin support. Shown below are the information security related plugins I recommend any infosec professional (or enthusiast) install upon spinning up a new Firefox instance.

XSS Me

This plugin discovers all the fields on the current page, and gives you the option to launch targeted attacks on each field, or to launch all of its attacks against all fields.

SQL Inject Me

From the same group as XSS Me, this plugin finds all fields on the page you’re on and let’s you launch the most common SQL injection attacks against them.

Live HTTP Headers

See exactly what your browser is sending and receiving in real-time.

User Agent Switcher

Change your user-agent on the fly. So, you can make it look like you’re coming from Lynx running on AIX, or like you’re the GoogleBot.

Web Developer

Modify all sorts of options related to the site you’re viewing. Disable scripting, modify forms, etc., etc. Trust me–good stuff.

Tamper Data

Lets you view the data that’s being passed back and forth between you and the web server…and let’s you mess with it. Think “WebScarab”, but far simpler, and as a Firefox plugin.

ASnumber

Find the Autonomous System Number (ASN) of the network that your current site is served from. Simple. Useful.

DT Whois

Do a domaintools.com lookup of the site you’re currently visiting. If you haven’t used domaintools.com yet, you’ll be even more impressed.

Firebug

Gives you a developer’s view into the page you’re viewing, showing exactly what scripts are running, what the stylesheet is, etc. Oh, and let’s you change them and see what the result would be. Not really a security thing, but strong enough to be included in a list of musts.

SwitchProxy Tool

Allows you to quickly switch back and forth between multiple proxies, or between using your main proxy and going straight out to the Internet. My configuration always includes at least one proxy: localhost:8008 for WebScarab.

Hackbar

This tool, added on Zach’s (@quine’s) request, is kind of interesting. It allows a lot of functionality from a very simple interface. Essentially, it presents you with the ability to modify the current URL in a number of interesting ways, including giving access to a number of simple tools for translating data formats. Worth adding to the list of essentials.

So there they are. If you have any I should add to this list of essentials, do let me know in the comments or via email. ::

(Thanks to those who helped me build this list including Johannes Ulrich and Steve Crapo)

Related

[ Information Security Posts | dmiessler.com ]

Well, that didn’t take long. One word — WordPress.

If you use Safari you can’t use the WordPress editor to post to your blog. You can’t add images. You can’t even insert line breaks between paragraphs. It’s a soup sandwich.

This is a deal-breaker for Safari until WordPress gets its act together.

Until then I’ll be using Camino. The tagline is “Mozilla Power, Mac Style”, and that’s fairly accurate. It’s 70% as nice feeling as Safari, and it has 70% of the power of Firefox.

It’s not a total win but it’s good enough until one of those become a complete solution. I’m betting on Safari since the main holdup is actually on WordPress’s side.

Life goes on.:

[ By the way, if you use Camino all of your Firefox Quick Searches will automatically work after you import your bookmarks ]

I’ve been getting more and more frustrated with Firefox over the months. It’s been getting to the point where I’ve been considering moving to Safari a few times, but I never had the eggs to pull it off.

Well, Ken mentioned today that he’s going make the switch for a whole month. I told him I couldn’t do it because of Quick Searches, and he replied that they probably had that functionality in Safari through extensions by now.

He was right. I just configured my Google and Wikipedia Quick Searches in Safari. Game over.

Safari is so much tighter than Firefox to me, and now that it has THE piece of functionality that matters most to me in a browser (searching websites from the URL bar) there’s just no need to go without Safari’s advantages any longer. We’ll see how it goes… 

If you’re not yet using Firefox Quicksearches you’re missing out. Quicksearches allow you to search virtually anything directly from the Firefox URL field.

Here I just searched for Ron Paul related information on Google. The trick is the first character — in this case “g” — that tells Firefox where to send the query. To set this up just right-click any search field online and select the “Add a Keyword for this search” option. Then give the Quicksearch a good keyword that you’ll remember.

Here are the 7 that everyone should have as a minimum:

1. Google — “g” for google, or “s” for search (Google is the new Kleenex)
2. You Tube –”v” for video
3. Images — “i” for images (searches Google Images)
4. Maps — “m” for maps (searches Google Maps)
5. Dictionary.com — “d” for dictionary
6. Thesaurus.com — “t” for thesaurus
7. Bookmarks — “b” for bookmarks (how to search your online bookmarks)

Remember to keep the keyword intuitive. I like using the actual content being searched as a keyword rather than the name of the site, e.g. “v” for You Tube instead of “y”. I think it’s easier to remember.

The trick is to customize your set of Quicksearches according to how you use the Internet. Remember that you can add complexity as needed. I search my own website, for example, by sending a site:dmiessler.com query along with whatever I search for, and I use “dm” for my keyword.

So right from the URL bar I can search my entire site using the power of Google. If you have any questions on setting these up, including the customized Google queries, drop me an email.:

Related: Get Local Time from Google (+ Quicksearch) Combining Quicksearchs with Google Keywords

I was looking for a bookmark of mine on Google Bookmarks a moment ago and did so in a very primitive way — I went to my bookmarks page and typed my query into the search field. Bad form.

Well, it dawned on me that there’s a much better way to do this. After remembering that I use Firefox Quicksearches to make my searching tasks more efficient, I went back to my Google Bookmarks page and simply right-clicked in the search field, elected to create a new quicksearch, and gave it the quicksearch keyword ‘b’. This lets me do this:

b screenshot

…which yields the link on how to take a screenshot in OS X that I saved months ago. The key here is that I just searched all of my own custom bookmarks — all of which I added tags and wrote a description for. This is so powerful because I have already narrowed down what I find interesting within my bookmarks. Now, using this technique, I can search within that highly distilled list of resources directly from the address bar.

So that’s it:

1. Set up Google Bookmarks and import your old stuff.
2. Go to the Google Bookmarks search field and right-click to add a custom keyword.
3. Assign “b” for bookmarks as the shortcut key.

From that point on you’re now searching through your bookmark titles, tags, and descriptions just by typing “b foo” directly from the Firefox URL field.:

Back in 2005 I wrote about how you can use Firefox Quicksearches to vastly reduce your search time. You do this by adding a key-character for searches, such as “g” for Google, and “w” for Wikipedia. Then you just do a ctrl/cmd-L to get to Firefox’s URL bar, and then type:

g ron paul

…to search for Ron Paul using Google.

But now it’s even more powerful due to the Google command line. Instead of just doing regular searches, we can now pass along which type of search we want to do. Here’s how to search for a map of San Francisco, for example:

…and you can do the same with /img, /title, etc.:

I just got curious about Firefox’s progress and was amazed to find how well it did in 2006. Of course this is for my site, so the geekiness factor of the users has to be taken into account.

But still — 62% vs. 23% is insanely high.

It’s pretty cool actually, you can set up a Firefox QuickSearch for doing on the fly searches, like:

bs linux security

…to find recent Linux/security oriented blog content.

<borat>Very nice…</borat>

What’s really cool, though, is that on the left side of your search results you get an RSS option. You can subscribe to these blog searches and use your newsreader to monitor what people in the blogsphere are saying about a given topic.

Pretty cool stuff. Anyway, I just found it interesting that the natural keyword for a blog search is “bs”.

I’ve recently started searching my site using Google rather than using the built-in Wordpress search. That’s nothing new — pretty much everyone knows that if you use site:yourdomain.com in front of a search term, it’ll search only your domain for that term.

That’s cool and everything, but it doesn’t get really sick until you combine it with Firefox’s Quicksearches. Quicksearches let you configure keywords that you type right into Firefox’s address bar. You can, for example, search Google for “cars” just by typing “g cars” into the URL field. The results will exactly the same as if you had gone to the Google homepage, typed in the word “cars”, and pressed enter.

So since Google is so good at search, and since it’s crawling your site constantly anyway, why not let Google do all the work when you’re looking for links on your own site? That’s what this little shortcut does — it uses a Quicksearch to find exactly what you’re looking for on your site — all without going to your site or to Google.

Adding The Quicksearch Bit

To make this work you just have to make yourself a new bookmark with the correct properties, like so:

1. Go to Bookmarks –> Organize Bookmarks
2. On the top left, select “New Bookmark”
3. Give the bookmark a name — something like, “Site Quicksearch”
4. Give it a keyword (this is what you’ll type into the URL bar). Try “ss”.
5. In the Location field, paste the following:

http://www.google.com/search?hl=en&q=site:dmiessler.com%20%s

Then, simply replace “dmiessler.com” with your own site and you’re done. Now hit ctrl-L to get to the address bar and type:

ss linux firewalls (then press enter)

What you’ll get back is Google’s results for “linux firewalls” coming from your page.:

Many know about the merits of Del.icio.us (no intro necessary), and plenty of others are also aware of Firefox Quick Searches, which allow you to search anything from the Firefox address bar. Very few, however, know how powerful it is to combine them.

Peanut Butter + Chocolate

The cool thing about Del.icio.us is that it combines two really cool technologies: RSS and Tags. This functionality is really sick just by itself; it lets you subscribe to your friends’ bookmarks via a news aggregator, search for interesting bookmarks on a certain subject, etc.

But when you combine that power with Firefox you get something truly brutal — searching bookmarks from the address bar.

Here’s how you do it:

1. Log in to your Del.icio.us page
2. Right-click in the search-field
3. Select “Add a Keyword for this Search”
4. Give it a keyword of “b” (for bookmarks)
5. Name it “Bookmarks Quicksearch”, or whatever

Now simply go to your address bar (ctrl/cmd-L from the keyboard) and type: b searchterm

So simple, yet so powerful.: