Using Firefox to audit Web2.0 application security

We know that unlike traditional Web applications, Web 2.0 applications are typically built on Ajax and interactive Web services, a technology that transforms security professionals into new security challenges.

First, Introduction

This article provides security professionals with a detailed description of the methods, tools, and techniques used to analyze Web2.0 applications using Firefox and its plug-ins. By reading this article, you can learn:

WEB 2.0 Application architecture and its security considerations.

The challenges faced by hackers, such as the discovery of hidden calls, crawling problems, and the discovery of Ajax logic.

Use the Firebug tool to find XHR calls.

Use the Chickenfoot plug-in to simulate browser events automatically.

Use the Firebug debugger to debug your application from a security perspective.

A systematic detection method for security vulnerabilities.

II. WEB 2.0 Application Overview

The recent popular Web 2.0 refers to a new generation of Web applications that are driven by XML, such as soap, RPC, and rest. By using Ajax and Rich Internet application (Flash) components, these new Web applications provide a more powerful and flexible user interface for end users.

The replacement of this technology has a great impact on the overall structure of the Web application and the communication mechanism between the client and the server, as well as a number of new security challenges. For example, some new worms use the client AJAX framework to steal confidential information.

Figure 1 Architecture diagram for WEB 2.0

As shown in Figure 1, the browser process on the left can be divided into the following levels:

The presentation layer--html/css provides the overall appearance of the application in the browser window.

Logical processing layer-JavaScript that runs in the browser allows the application to perform business logic and communication logic. Ajax-driven components are at the bottom.

Transport Layer--xmlhttprequest (XHR). This object enables asynchronous communication between the client and the server through HTTP (S) and the exchange of XML.

As shown in Figure 1, the server-side components on the right are typically located in the enterprise infrastructure behind the firewall, including deployed Web services and traditional Web application resources. Ajax resources running on browsers can communicate directly with xml-based WEB services and exchange information without refreshing the page. All of these communications are transparent to the end user, in other words, the end user does not feel that any redirection has occurred. In fact, "refresh" and "redirect" are an integral part of the first generation of Web application logic. In the Web 2.0 framework, the use of refreshes and redirects is greatly reduced through Ajax.