WebScarab-NG: Autumn of Code 2006 Project Presenter: Dave Wichers OWASP Conferences Chair COO, Aspect Security dave.wichers@aspectsecurity.com WebScarab Project Lead: Rogan Dawes rogan@dawes.za.net

What is WebScarab? A tool for anyone involved with HTTP-based applications (e.g. web applications) Key features Full visibility into the HTTP protocol Ability to modify HTTP requests in any way Also supports HTTPS (incl client certs) Persistent audit trail can easily be reviewed Primary uses Security analysis, Web Application debugging This is talking about OLD WebScarab

Who is writing WebScarab-NG? Rogan Dawes rogan@dawes.za.net Lives in South Africa (Just had his first baby May 3rd (Connor Michael Hastings Dawes), otherwise he’d be here!!) Has been developing proxy tools for a while First Mangle (in perl), then Exodus (in Java) Then WebScarab and now WebScarab-NG Currently works for Aspect Security

What is wrong with WebScarab? “Plainly put - WebScarab’s UI is a disaster!” – Rogan Dawes – Author of WebScarab One of the major reasons for a rewrite of WebScarab was the user interface. In the first place, all the functionality (plugins) can be quite intimidating for a newcomer. There have also been many complaints about non-intuitiveness of the interface, and even little things like “right-click copy and paste menus” were not available. Going through the entire application and trying to retro-fit this seemed like a huge task, for little reward. Another reason was the close coupling between the underlying data model and the presentation layer, as well as the thousands of files that WebScarab typically writes while recording a session (even temporary sessions!) Unfortunately, these design decisions are not easy to fix in the existing code.

WebScarab Deficiencies - Summary UI – Not Intuitive Expected UI sugar, like “right-click copy and paste menus”, etc. not available Trying to retro-fit a huge task Extensive functionality (plugins) intimidating Close coupling between underlying data model and the presentation layer 1000s of files WebScarab writes to record a session (even temporary sessions!)

The solution: WebScarab-NG WebScarab makes use of an application framework called the Spring Framework, as well as the Spring Rich Client Platform (RCP). This gives us tons of (Human Interface Guidelines-compliant) stuff, almost without effort: Easy internationalisation of text Automatic “copy and paste” menus Robust command framework – automatic activation and deactivation of commands when appropriate Intuitive separation of View from Model/Data Layer Spring JDBC code is very easy to write etc, etc You might want to point out that you can select which columns you are interested in in the “Conversations” view

WebScarab-NG Benefits Using Spring we get tons of (Human Interface Guidelines-compliant) stuff, almost without effort Easy internationalization of text Automatic “copy and paste” menus Robust command framework – automatic activation and deactivation of commands when appropriate Intuitive separation of View from Model/Data Layer Spring JDBC code also very easy to write

Current WebScarab-NG features Intercepting Proxy Intercept and modify HTTP(S) conversations Manual Request Modify and replay requests Flexible perspectives Eclipse-like Can choose which views to include Data written to a local in-process database Runs using Java Web Start Automatic updates! But lots of WebScarab Features not yet ported Perspectives are still under development. Interesting statistic: WS-NG is seeing quite extensive use from 390 unique IP addresses over the last 32 days. 1 person/organisation has run it at least 200 times!

WebScarab-NG special features Proxy control bar Stays on top Drop down control of request intercept Annotate the next conversation to be made Docking framework Validation The Proxy Control Bar stays on top of all windows, and can be easily positioned e.g. over the title bar of your browser The description entered is used to document the next conversation to pass through the proxy. This helps to explain why certain series of requests were made. E.g. “Pressed login button” The docking framework allows the user to configure WS-NG to their layout preferences (although it doesn’t currently record those preferences!) The dynamic validation prompts the user when they have entered invalid data, and automatically disables buttons/commands

WebScarab-NG – finding conversations Select URL(s) to filter conversation list Filter further by keyword or search (Ctrl-F) Clicking on one or more URL’s in the site map will restrict the conversations shown to those “under” the selected hierarchies. This helps to exclude sites that you are not interested in. Typing text into the “filter” text field dynamically (as you type) restricts the results to those that contain the desired string You can also search for text in the table via the Ctrl-F find dialog At this stage, you can demonstrate WS-NG in action, accessing WebGoat, for example. E.g. Show how the proxy tool bar works, enable and disable intercepts, make an annotation in the toolbar, and show how it appears in the conversation list. Edit the annotation and show that it gets updated. Show the immediate validation in the “Intercept Request” function (when editing in the tree mode, it only kicks in after the cell is finished being edited)

So why use the old WebScarab? Reliability – extensive testing over 4 years More features Web Services support Transcoder (An encoder / decoder) Include/Exclude Filters Reverse proxy Spider XSS/CRLF injection tests Session ID Analysis Scripting engine Fuzzer Advanced Search SSL Client certificate support More testing of WS-NG is obviously appreciated – report findings to the owasp-webscarab mailing list You may want to show some of the features of old WS at this point. I don’t want to make slides for this, since it is kind of silly to switch from WS to Powerpoint just to advance to another “Demonstration: “ slide, and switch back to WS.

The future of WebScarab (-NG) Significant new development only on –NG Unless we get patches  OWASP Spring of Code 2007 Implementation of automated testing Record and replay test cases Reimplementation of major features Spider (incl forms!) Web Services Reverse Proxy Improved Session ID analysis Scripting Engine Automated identity tracking The automated identity tracking will be able to associate an identity with a conversation, based on session id (with lifetime management), Basic Auth, etc. A request might end up with multiple identities if conflicting identifiers are sent. This should make it easy to automate identification of the site’s access control matrix

Questions and Answers Q & Q U E S T I O N S A N S W E R S A