[null, {"document_url": "https://holisticinfosec.blogspot.com/2009/11/watcher-spotting-dubious-webishness.html", "unformatted_src": "//4.bp.blogspot.com/_kVOWaY1TAF0/Su-vgdEFZtI/AAAAAAAAAPw/GNiG6Qaq5v0/s320/watcherXSS.png", "src": "http://4.bp.blogspot.com/_kVOWaY1TAF0/Su-vgdEFZtI/AAAAAAAAAPw/GNiG6Qaq5v0/s320/watcherXSS.png", "formatted_filename": "watcherXSS"}, null, {"document_url": "https://holisticinfosec.blogspot.com/2009/11/watcher-spotting-dubious-webishness.html", "unformatted_src": "//2.bp.blogspot.com/_kVOWaY1TAF0/Su-wy34JKYI/AAAAAAAAAP4/Nhr4V3RGR2A/s320/watcherXSS2.png", "src": "http://2.bp.blogspot.com/_kVOWaY1TAF0/Su-wy34JKYI/AAAAAAAAAP4/Nhr4V3RGR2A/s320/watcherXSS2.png", "formatted_filename": "watcherXSS"}, null, null, null, null, null, null, null, null, null, null, null, null, null, null, {"document_url": "https://holisticinfosec.blogspot.com/2009/11/watcher-spotting-dubious-webishness.html", "unformatted_src": "//4.bp.blogspot.com/-3oDu_bQerx8/VW4lOpHRlJI/AAAAAAAAB5E/01PLdTNsMfE/s300/asja_awards-prize_winning_article_small.png", "src": "http://4.bp.blogspot.com/-3oDu_bQerx8/VW4lOpHRlJI/AAAAAAAAB5E/01PLdTNsMfE/s300/asja_awards-prize_winning_article_small.png", "formatted_filename": "asja awards prize winning article small", "alt_text": "ASJA Awards Prize Winning Article", "rendered_width": 175, "rendered_height": 175}, null, null, null, null, null, null, null, null, null, null]

Watcher: Spotting dubious webishness

November's toolsmith features Watcher, a great passive security auditor from Chris Weber of Casaba Security, that detects web application security issues as well as operational configuration concerns. Watcher plugs neatly into Fiddler, an indispensable proxy that should be an inherent part of your web application assessment tool kit.
The toolsmith article covers using Watcher to detect "dubious" comments, unset HTTPOnly flags, open redirects, and bad cross domain flash policy, so I won't repeat myself here.
Watcher is also excellent for detecting likely XSS vulnerabilities, and will passively detect prospective parameters while you browse.
As an example, a visit to a site that shall remain anonymous only to those without fundamental Google skills results in Figure 1, seen by Watcher as it passively reviews a site with 37 different checks. 
Note that Watcher spots what it declares is a potentially high severity user controllable HTML element attribute. Watcher further indicates that the fourth input tag value attribute is specific to the keyword variable. A quick "active" test by the author quickly validates Watcher's assumptions as seen in Figure 2. 
Passive security auditing indeed; no effort required!
Results are easily exported as well.
Browse a client site while enjoying a good sandwich and coffee, dump the results, and build your work list as a preliminary recon step for your next penetration testing engagement.
Enjoy this excellent tool; use it in good stead.

del.icio.us | digg | Submit to Slashdot

Please support the Open Security Foundation (OSVDB)
at November 02, 2009 Labels: cross-site scripting, Flash, open redirect, open redirect vulnerability, XSS 
You might want to obscure the URL a little better next time, that page name is a googledork...

 ekse said...

"As an example, a visit to a site that shall remain anonymous"

The page name is giving the website in a simple google search. I know you can't stop someone that would really want to find it but you should make it at least a little more difficult ;-)

Nice post btw.
 Russ McRee said...

Nothing eludes you, dear readers. Yes, that was barely anonymized.
Please consider it minimalist CYA effort.
I updated the referring language accordingly.
Cheeky monkeys. ;-)
 
McRee added to ISSA's Honor Roll for Lifetime Achievement Follow @holisticinfosec ASJA Awards Prize Winning Article Subscribe To HolisticInfoSec