Comments on: ratproxy 1.51 tutorial http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/ Information Systems and Internet Security Sat, 26 Sep 2009 11:11:21 -0400 http://wordpress.org/?v=2.8.5 hourly 1 By: Udhaya Kumar http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-3349 Udhaya Kumar Fri, 15 May 2009 04:40:22 +0000 http://isisblogs.poly.edu/?p=118#comment-3349 Hi, I like to know what type of inputs are injected in the web application using RatProxy. Where I can see the inputs that are injected in the web application. Hi,

I like to know what type of inputs are injected in the web application using RatProxy. Where I can see the inputs that are injected in the web application.

]]> By: fengcj http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-435 fengcj Wed, 20 Aug 2008 09:24:38 +0000 http://isisblogs.poly.edu/?p=118#comment-435 I got the answer, so please ignore this question I got the answer, so please ignore this question

]]> By: fengcj http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-434 fengcj Wed, 20 Aug 2008 08:31:34 +0000 http://isisblogs.poly.edu/?p=118#comment-434 I am sorry for another question: How to make XSS work after html report being built? I am sorry for another question: How to make XSS work after html report being built?

]]> By: fengcj http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-433 fengcj Wed, 20 Aug 2008 06:22:45 +0000 http://isisblogs.poly.edu/?p=118#comment-433 Got it ！Thanks！ Got it ！Thanks！

]]> By: Dan Guido http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-432 Dan Guido Wed, 20 Aug 2008 04:00:16 +0000 http://isisblogs.poly.edu/?p=118#comment-432 AFAIK ratproxy only listens on localhost. AFAIK ratproxy only listens on localhost.

]]> By: fengcj http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-431 fengcj Wed, 20 Aug 2008 03:59:14 +0000 http://isisblogs.poly.edu/?p=118#comment-431 I set my proxy in Firefox to be xxxx.xxxx.xxxx.xxxx:8080, xxxx.xxxx.xxxx.xxxx is the server where ratproxy was installed. when I use the command : netstat | grep 8080 on ratproxy server, I can see the connection from me. I set my proxy in Firefox to be xxxx.xxxx.xxxx.xxxx:8080,
xxxx.xxxx.xxxx.xxxx is the server where ratproxy was installed.

when I use the command : netstat | grep 8080 on ratproxy server, I can see the connection from me.

]]> By: Dan Guido http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-427 Dan Guido Tue, 19 Aug 2008 13:36:35 +0000 http://isisblogs.poly.edu/?p=118#comment-427 @fengcj With that command line, you set up ratproxy to work as a local proxy on port 8080 and to analyze the traffic it receives from fxtest.bestwiz.cn. Did you correctly connect your proxy? Did you browse to the fxtest.bestwiz.cn website? @fengcj

With that command line, you set up ratproxy to work as a local proxy on port 8080 and to analyze the traffic it receives from fxtest.bestwiz.cn. Did you correctly connect your proxy? Did you browse to the fxtest.bestwiz.cn website?

]]> By: fengcj http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-425 fengcj Tue, 19 Aug 2008 08:08:06 +0000 http://isisblogs.poly.edu/?p=118#comment-425 Hi, I use command: ./ratproxy -v dumps -w mobile.log -d fxtest.bestwiz.cn -lextifscgjm but when finished, the file size of mobile.log is 0, why? Hi, I use command:
./ratproxy -v dumps -w mobile.log -d fxtest.bestwiz.cn -lextifscgjm

but when finished, the file size of mobile.log is 0, why?

]]> By: funnygirl http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-398 funnygirl Thu, 07 Aug 2008 18:04:05 +0000 http://isisblogs.poly.edu/?p=118#comment-398 +100. Respect. ;) +100. Respect. ;)

]]> By: Dan Guido http://isisblogs.poly.edu/2008/07/05/ratproxy-151-tutorial/comment-page-1/#comment-377 Dan Guido Thu, 17 Jul 2008 22:33:47 +0000 http://isisblogs.poly.edu/?p=118#comment-377 From the manual: 1) Ratproxy can be compiled with make and requires a reasonably configured build environment similar to what is required for any other application. It does not depend on any arcane libraries or non-standard tools; you might have to remove the -Wno-pointer-sign from Makefile on older systems, but that's about it. If you still need help setting up such an environment and running ratproxy on Windows, there is a nice third-party guide prepared by David Marginian: http://butterdev.com/web-security/2008/07/google-ratproxy-web-application-security-audit-tool/ http://butterdev.com/dwr/2008/07/google-ratproxy-part-2-running-and-using-ratproxy/ Please be advised, however, that ratproxy is not meant to be a point-and-click tool - if you have a difficulty running it in the first place, you may also have a hard time understanding its output and verifying it. From the manual:

1) Ratproxy can be compiled with make and requires a reasonably configured build environment similar to what is required for any other application. It does not depend on any arcane libraries or non-standard tools; you might have to remove the -Wno-pointer-sign from Makefile on older systems, but that’s about it. If you still need help setting up such an environment and running ratproxy on Windows, there is a nice third-party guide prepared by David Marginian:
http://butterdev.com/web-security/2008/07/google-ratproxy-web-application-security-audit-tool/
http://butterdev.com/dwr/2008/07/google-ratproxy-part-2-running-and-using-ratproxy/

Please be advised, however, that ratproxy is not meant to be a point-and-click tool – if you have a difficulty running it in the first place, you may also have a hard time understanding its output and verifying it.

]]>