Manual Request Tools
The manual request component of the integrated test suites provides the basic facility to issue a single request and view its response. Though simple, this function is often extremely beneficial when you are probing a tentative vulnerability and need to reissue the same request manually several times, tweaking elements of the request to determine the effect on the application’s behavior. Of course, you could perform this task using a standalone tool such as netcat, but having the function built in to the suite means that you can quickly retrieve an interesting request from another component (proxy, spider, or fuzzer) for manual investigation. It also means that the manual request tool benefits from the various shared functions implemented within the suite, such as HTML rendering, support for downstream proxies and authentication, and automatic updating of the Content-Length header.
The following features are implemented within the different manual request tools:
■ Integration with other suite components, and the ability to refer any request to and from other components for further investigation.
■ History of all requests and responses, keeping a full record of all manual requests for further review, and enabling a previously modified request to be retrieved for further analysis.
Shared Functions and Utilities
In addition to their core tool components, the integrated test suites provide a wealth of other value-added features that address specific needs that arise when you are attacking a web application, and that enable the other tools to work in unusual situations. The following features are implemented by the different suites:
■ Analysis of HTTP message structure, including parsing of headers and request parameters .
■ Rendering of HTML content in responses as it would appear within the browser.
■ Ability to display and edit messages in text and hexadecimal form.
■ Search functions within all requests and responses.
■ Automatic updating of the HTTP Content-Length header following any manual editing of message contents.
■ Built-in encoders and decoders for various schemes, enabling quick analysis of application data in cookies and other parameters.
■ A function to compare two responses and highlight the differences.
■ Ability to save the current testing session to disk and retrieve saved sessions.
■ Integration with the host computer clipboard, enabling fast transfer of data to and from other programs.
■ Support for downstream proxies, enabling you to chain different tools together or access an application via the proxy used by your organization or ISP.
■ In-tool support for HTTP authentication methods, enabling you to use all of the suite’s features in environments where these are used, such as corporate LANs.
■ Support for client SSL certificates, enabling you to attack applications which employ these.
■ Handling of the more obscure features of HTTP, such as gzip content encoding, chunked transfer encoding, and status 100 interim responses.
■ Extensibility, enabling the built-in functionality to be modified and extended in arbitrary ways by third-party code.
■ Persistent configuration of tool options, enabling a particular setup to be resumed on the next execution of the suite.
■ Platform-independence, enabling the tools to run on all popular operating s
