Firefox Plugins for Pentester

Hackers we have to know some of the useful firefox plugins which help greatly for Web Application Pentester. Here some of the plugins i want to share with you ...

1. Firebug
Firebug integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page...

2. User Agent Switcher 
The User Agent Switcher extension adds a menu and a toolbar button to switch the user agent of a browser.

3. Hackbar 
Simple security audit / Penetration test tool.

4. HttpFox
An HTTP analyzer addon for Firefox.

5. Live HTTP Headers 
View HTTP headers of a page and while browsing.

6. Temper Data 
Use tamperdata to view and modify HTTP/HTTPS headers and post parameters...

7. ShowIP
Show the IP address(es) of the current page in the status bar. It also allows querying custom information services by IP (right click) and hostname (left click), like whois, netcraft, etc. Additionally you can copy the IP address to the clipboard.

8. OSVDB
Open Source Vulnerability Database Search.

9. Packet Storm Search Plugin
This plugin lets you search on Packet Storm - www.packetstormsecurity.org - database. Packet Storm offers an abundant resource of up-to-date and historical security tools, exploits, and advisories.

10. Offsec Exploit-db Search
This plugin lets you search on Offsec Exploit archive - http://exploit-db.com. Offsec Exploit archive, also known as Explo.it, is the replacement of Milw0rm archive.

11. Security Focus Vulnerabilities Search Plugin
This plugin lets you search on Security Focus Vulnerabilities.

12. Cookie Watcher
Cookie Watcher is a tool to watch selected cookie in a statusbar.

13. Header Spy
Shows HTTP headers on statusbar.

14. Groundspeed
Groundspeed is an add-on that allows security testers to manipulate the application user interface to eliminate annoying limitations and client-side controls that interfere with the web application penetration tests.

15. CipherFox
Displays the current SSL/TLS cipher and certificate chain in the Add-on bar and Site ID dialog.

16. XSS Me
Cross-Site Scripting (XSS) is a common flaw found in todays web applications. XSS flaws can cause serious damage to a web application. Detecting XSS vulnerabilities early in the development process will help protect a web application from unnecessary flaws. XSS-Me is the Exploit-Me tool used to test for reflected XSS vulnerabilities.

17. SQL Injection Me
SQL Injection vulnerabilites can cause a lot of damage to a web application. A malicious user can possibly view records, delete records, drop tables or gain access to your server. SQL Inject-Me is Firefox Extension used to test for SQL Injection vulnerabilities.

18. Wappalyzer
Wappalyzer is a browser extension that identifies software on websites.

19. Poster
A developer tool for interacting with web services and other web resources that lets you make HTTP requests, set the entity body, and content type. This allows you to interact with web services and inspect the results...

20. Javascript Deobfuscator
This add-on will show you what JavaScript gets to run on a web page, even if it is obfuscated and generated on the fly. Simply open JavaScript Deobfuscator from the Tools menu and watch the scripts being compiled/executed.

21. Modify Headers 
Add, modify and filter the HTTP request headers sent to web servers. This addon is particularly useful for Mobile web development, HTTP testing and privacy.

22. FoxyProxy
FoxyProxy is an advanced proxy management tool that completely replaces Firefox's limited proxying capabilities. It offers more features than other proxy addons.

23. FlagFox
Displays a country flag depicting the location of the current website's server and provides a multitude of tools such as site safety checks, whois, translation, similar sites, validation, URL shortening, and more...

24. Greasemonkey
Customize the way a web page displays or behaves, by using small bits of JavaScript.

25. Domain Details
Displays Server Type, Headers, IP Address, Location Flag, and links to Whois Reports. Shows links to check server status and cache when page fails to load.

26. Websecurify 
Websecurify is a powerful cross-platform web security testing technology designed from the ground up with simplicity in mind.

27. XSSed Search 
Search the cross-site scripting database at XSSed.Com

28. ViewStatePeeker 
This add-on can decode and show viewstate contents of an *.aspx page. Once you intall this add-on, it shows up a 'Show Viewstate' item in context menu of Firefox. When this menuitem is clicked, a popup comes up showing the viewstate details.

29. CryptoFox
CryptoFox is an encryption/decryption tool for Mozilla Firefox, with dictionary attack support for cracking MD5 passwords.

30. WorldIP
REAL location of web server,IP,Datacenter,Ping,Traceroute,RDNS,AS. Often shows different countries from similar add-ons,because it is based on data from core routers worldwide,and not on whois data.Real Google's data centers.Providers looking glasses.

31. Server Spy
Server Spy indicates what brand of HTTP server (e.g. Apache, IIS, etc.) runs on the visited sites.

32. Default Passwords
Search CIRT.net default password database.

33. Snort IDS Rule Search
Search for Snort IDS Rules.

Keep Learning friends ......

Windows Security Architecture

To Be a Security Professional it is necessary to Know about Different - Different OS,s & where there security operations

So Let's Start.....

Windows Security Architecture :
 Basically Windows Security Architecture Can be Divided into 3 Parts

1. LSA  : Local Security Authority
2. SRM : Security Reference Monitor
3. SAM : Security Account Manager

Local Security Authority : In this Session you Protect your System using  BIOS Password and Now you understand how to set this password . If you Don't Know then i will explane you How to Setup this password  you can set this password in The BIOS menu option by pressing F2 or F8 either F12 (Depending upon the manufacturer). If this Password can be Broken . I will thell you How to Breake the BIOS Password later in my other Posts . This is our Local Security Authority . After This there will be Next Level of security and that is SRM (Security Reference Monitor).

Security Reference Monitor : This is our Windows login Screen Password . Friend at this point i will tell you a Secrete . Here I think you all think i will tell you the password in windows xp can be setup by going to control panel . yes the password is same but it is unsecured when you set password by just from control panel and i thing it is so much easy to break in window xp by just pressing F8 and going to safe mode but i will tell you how to set secure password at this point . Here i want to say you that in window 7 this is a secure password it is not so easy to break this password by just by going to secure mode .
So if you are using window xp then be aware & set your password by just going to Desktop > My Computer>right click > Manage users>Local User and Groups .

Security Account Manager : This is a file in the windows in which the Administrator password  can  be store in in encrypted form. File Location at  C:\Windows\System32\drivers\etc  this file can never be open if the system is running . Here is a Question how to open this SAM file so that windows Administrator Password can be Broken . Think think deep how to open  & try to open this file then . if you are unable to open this file . Then i will tell you later that How to open this SAM file .
But here i want to explane you One more password to secure your system and it is SYSKEY password can you know about syskey . to set syskey just press win+r i.e just open RUN and type syskey . This is SAM file Management Tool and it is default tool for windows now just update it . Here we Have One more Question that How to Break Syskey Password ??

Note : syskey is highest level of windows security must remember syskey password in case if u don't have enough time to break syskey be careful