The majority of the penetration testers are using the Mozilla Firefox as a web browser for their pentest activities.This article will introduce the firefox addons that can be used for a web application penetration test.
You can use this extension to change the user agent of your browser.Useful for web application penetration tests that you want to check and the mobile versions of the websites.
Useful for SQL injection and XSS attacks.It includes also tools for URL and HEX encoding/decoding and many more.
Monitor and analyze all the incoming and outgoing HTTP traffic between your browser and the web server.
View the HTTP headers of a website instantly.
6) Tamper Data
View and modify HTTP/HTTPS headers and post parameters.
Shows the IP of the current page in the status bar.It also includes information like the hostname,the ISP,the country and the city.
Open Source Vulnerability Database Search.
Search the packet storm database for exploits,tools and advisories.
Search the Exploit-db archive.
Search for vulnerabilities in the Security Focus
12) Cookie Watcher
Watch the selected cookie in the status bar.
13) Header Spy
Shows HTTP Headers on status bar
Manipulate the application user interface.
Displays the current SSL/TLS cipher and certificate on the status bar.
16) XSS Me
Tool for testing reflected XSS vulnerabilities.
17) SQL Inject Me
Extension to test SQL Injection vulnerabilities.
Discover technologies and applications that are used on websites.
Make HTTP requests,interact with web services and watch the output.
21) Modify Headers
Modify HTTP request headers.
Advanced proxy management tool.
Displays a country flag for the location of the web server.It also includes tools such as Whois,Geotool,Ping,Alexa etc.
25) Domain Details
Displays Server Type, Headers, IP Address, Location Flag, and links to Whois Reports.
Useful for security assessments in web applications.
27) XSSed Search
Search the cross-site scripting database at XSSed.Com
ASP.NET viewstate viewer.
CryptoFox is an encryption/decryption tool for cracking MD5 passwords.
Location of the web server,IP,Datacenter,Ping,Traceroute,RDNS,AS etc.
31) Server Spy
Unveils the technology of the web server (Apache, IIS etc.)
Search CIRT.net default password database.
Search for Snort IDS Rules.