I’ve moved to Chrome and Safari as my primary browsers, but nothing compares to Firefox when it comes to functionality and plugin support. Shown below are the information security related plugins I recommend any infosec professional (or enthusiast) install upon spinning up a new Firefox instance.

XSS Me

This plugin discovers all the fields on the current page, and gives you the option to launch targeted attacks on each field, or to launch all of its attacks against all fields.

SQL Inject Me

From the same group as XSS Me, this plugin finds all fields on the page you’re on and let’s you launch the most common SQL injection attacks against them.

Live HTTP Headers

See exactly what your browser is sending and receiving in real-time.

User Agent Switcher

Change your user-agent on the fly. So, you can make it look like you’re coming from Lynx running on AIX, or like you’re the GoogleBot.

Web Developer

Modify all sorts of options related to the site you’re viewing. Disable scripting, modify forms, etc., etc. Trust me–good stuff.

Tamper Data

Lets you view the data that’s being passed back and forth between you and the web server…and let’s you mess with it. Think “WebScarab”, but far simpler, and as a Firefox plugin.

ASnumber

Find the Autonomous System Number (ASN) of the network that your current site is served from. Simple. Useful.

DT Whois

Do a domaintools.com lookup of the site you’re currently visiting. If you haven’t used domaintools.com yet, you’ll be even more impressed.

Firebug

Gives you a developer’s view into the page you’re viewing, showing exactly what scripts are running, what the stylesheet is, etc. Oh, and let’s you change them and see what the result would be. Not really a security thing, but strong enough to be included in a list of musts.

SwitchProxy Tool

Allows you to quickly switch back and forth between multiple proxies, or between using your main proxy and going straight out to the Internet. My configuration always includes at least one proxy: localhost:8008 for WebScarab.

Hackbar

This tool, added on Zach’s (@quine’s) request, is kind of interesting. It allows a lot of functionality from a very simple interface. Essentially, it presents you with the ability to modify the current URL in a number of interesting ways, including giving access to a number of simple tools for translating data formats. Worth adding to the list of essentials.

So there they are. If you have any I should add to this list of essentials, do let me know in the comments or via email. ::

(Thanks to those who helped me build this list including Johannes Ulrich and Steve Crapo)

Related

[ Information Security Posts | dmiessler.com ]

Well, that didn’t take long. One word — WordPress.

If you use Safari you can’t use the WordPress editor to post to your blog. You can’t add images. You can’t even insert line breaks between paragraphs. It’s a soup sandwich.

This is a deal-breaker for Safari until WordPress gets its act together.

Until then I’ll be using Camino. The tagline is “Mozilla Power, Mac Style”, and that’s fairly accurate. It’s 70% as nice feeling as Safari, and it has 70% of the power of Firefox.

It’s not a total win but it’s good enough until one of those become a complete solution. I’m betting on Safari since the main holdup is actually on WordPress’s side.

Life goes on.:

[ By the way, if you use Camino all of your Firefox Quick Searches will automatically work after you import your bookmarks ]

I’ve been getting more and more frustrated with Firefox over the months. It’s been getting to the point where I’ve been considering moving to Safari a few times, but I never had the eggs to pull it off.

Well, Ken mentioned today that he’s going make the switch for a whole month. I told him I couldn’t do it because of Quick Searches, and he replied that they probably had that functionality in Safari through extensions by now.

He was right. I just configured my Google and Wikipedia Quick Searches in Safari. Game over.

Safari is so much tighter than Firefox to me, and now that it has THE piece of functionality that matters most to me in a browser (searching websites from the URL bar) there’s just no need to go without Safari’s advantages any longer. We’ll see how it goes… 

Here I just searched for Ron Paul related information on Google. The trick is the first character — in this case “g” — that tells Firefox where to send the query. To set this up just right-click any search field online and select the “Add a Keyword for this search” option. Then give the Quicksearch a good keyword that you’ll remember.

Here are the 7 that everyone should have as a minimum:

1. Google — “g” for google, or “s” for search (Google is the new Kleenex)
2. You Tube –”v” for video
3. Images — “i” for images (searches Google Images)
4. Maps — “m” for maps (searches Google Maps)
5. Dictionary.com — “d” for dictionary
6. Thesaurus.com — “t” for thesaurus
7. Bookmarks — “b” for bookmarks (how to search your online bookmarks)

Remember to keep the keyword intuitive. I like using the actual content being searched as a keyword rather than the name of the site, e.g. “v” for You Tube instead of “y”. I think it’s easier to remember.

The trick is to customize your set of Quicksearches according to how you use the Internet. Remember that you can add complexity as needed. I search my own website, for example, by sending a site:dmiessler.com query along with whatever I search for, and I use “dm” for my keyword.

So right from the URL bar I can search my entire site using the power of Google. If you have any questions on setting these up, including the customized Google queries, drop me an email.:

Related: Get Local Time from Google (+ Quicksearch) Combining Quicksearchs with Google Keywords

Well, it dawned on me that there’s a much better way to do this. After remembering that I use Firefox Quicksearches to make my searching tasks more efficient, I went back to my Google Bookmarks page and simply right-clicked in the search field, elected to create a new quicksearch, and gave it the quicksearch keyword ‘b’. This lets me do this:

b screenshot

…which yields the link on how to take a screenshot in OS X that I saved months ago. The key here is that I just searched all of my own custom bookmarks — all of which I added tags and wrote a description for. This is so powerful because I have already narrowed down what I find interesting within my bookmarks. Now, using this technique, I can search within that highly distilled list of resources directly from the address bar.

So that’s it:

1. Set up Google Bookmarks and import your old stuff.
2. Go to the Google Bookmarks search field and right-click to add a custom keyword.
3. Assign “b” for bookmarks as the shortcut key.

From that point on you’re now searching through your bookmark titles, tags, and descriptions just by typing “b foo” directly from the Firefox URL field.:

g ron paul

…to search for Ron Paul using Google.

But now it’s even more powerful due to the Google command line. Instead of just doing regular searches, we can now pass along which type of search we want to do. Here’s how to search for a map of San Francisco, for example:

…and you can do the same with /img, /title, etc.:

But still — 62% vs. 23% is insanely high.

bs linux security

…to find recent Linux/security oriented blog content.

<borat>Very nice…</borat>

What’s really cool, though, is that on the left side of your search results you get an RSS option. You can subscribe to these blog searches and use your newsreader to monitor what people in the blogsphere are saying about a given topic.

Pretty cool stuff. Anyway, I just found it interesting that the natural keyword for a blog search is “bs”.

That’s cool and everything, but it doesn’t get really sick until you combine it with Firefox’s Quicksearches. Quicksearches let you configure keywords that you type right into Firefox’s address bar. You can, for example, search Google for “cars” just by typing “g cars” into the URL field. The results will exactly the same as if you had gone to the Google homepage, typed in the word “cars”, and pressed enter.

So since Google is so good at search, and since it’s crawling your site constantly anyway, why not let Google do all the work when you’re looking for links on your own site? That’s what this little shortcut does — it uses a Quicksearch to find exactly what you’re looking for on your site — all without going to your site or to Google.

Adding The Quicksearch Bit

To make this work you just have to make yourself a new bookmark with the correct properties, like so:

1. Go to Bookmarks –> Organize Bookmarks
2. On the top left, select “New Bookmark”
3. Give the bookmark a name — something like, “Site Quicksearch”
4. Give it a keyword (this is what you’ll type into the URL bar). Try “ss”.
5. In the Location field, paste the following:

http://www.google.com/search?hl=en&q=site:dmiessler.com%20%s

Then, simply replace “dmiessler.com” with your own site and you’re done. Now hit ctrl-L to get to the address bar and type:

ss linux firewalls (then press enter)

What you’ll get back is Google’s results for “linux firewalls” coming from your page.:

Peanut Butter + Chocolate

The cool thing about Del.icio.us is that it combines two really cool technologies: RSS and Tags. This functionality is really sick just by itself; it lets you subscribe to your friends’ bookmarks via a news aggregator, search for interesting bookmarks on a certain subject, etc.

But when you combine that power with Firefox you get something truly brutal — searching bookmarks from the address bar.

Here’s how you do it:

1. Log in to your Del.icio.us page
2. Right-click in the search-field
3. Select “Add a Keyword for this Search”
4. Give it a keyword of “b” (for bookmarks)
5. Name it “Bookmarks Quicksearch”, or whatever

Now simply go to your address bar (ctrl/cmd-L from the keyboard) and type: b searchterm

So simple, yet so powerful.:

If you try to use Microsoft’s flagship browser with the current version of their web-based email application, the program will crash.

I know two people who have tried this — me and another guy. Both of us saw the exact same issue. Is it just me or are these people on the ropes? I mean, damn…the new browser doesn’t work with OWA? How can you miss that? Is that considered minor by any stretch of the imagination?

So I’m left using Firefox (a free program) with OWA because if I use Microsoft’s own brand-new browser (with a vulnerability released on the same day it launched) it doesn’t work.

In. Sane. The best programmers in the world and billions of dollars, and I have to use a free product to get mail from OWA. The fall of Microsoft is upon us.

That’s a solid 64% of all people coming to my site in 2006 thus far. IE got only 21%.

Go Firefox.

** Firefox only

1. Go to google.com and right click in the search field
2. Select “Add a Keyword For This Search…”
3. In the name field type, “Bugtraq Vulnerability Quicksearch” (or whatever)
4. In the keyword field, enter “bid” or “vuln” — again, up to you. This is your shortcut.
5. Save the bookmark and then go to Bookmarks –> Organize Bookmarks and edit the properties of the bookmark you just made.
6. In the properties field, replace what’s there with the following URL: http://search.securityfocus.com/swsearch?query=bid%20%s&sbm=bid&metaname =alldoc&sort=swishrank (all one line)
7. Save your bookmark again and prepare to be impressed.

Now, just go to your address bar (cmd/ctrl-L) and type bid 1499 , like so:

The results are beautiful:

They’ve done some work on the look (icons and such), and it seems to be a bit faster as well. Definitely check it out if you’re into the beta thing.

I am currently using the Firefox 2.0 Beta and something just happened to me that just changed my life. I misspelled something while writing my Boston post below, and it put a red line under it.

I optimistically right-clicked the text and it gave me the correct spelling — just like Word does. So brutal. I have so been craving this feature and I didn’t even know we were getting it with Firefox 2.0.

If you misspell like I do, write a lot online, and are a Firefox user — you may want to look into getting in on the beta. It’s wicked cool.