在 Firefox 中测试 ASP.NET 安全性
我不确定这个问题属于 StackOverflow 还是 SuperUser，但这里什么也没有......
我正在尝试在我的个人 ASP.NET 网站上测试一些基本的安全问题，以了解自定义验证器等的确切工作原理当篡改数据时。我一直在研究 Firefox 扩展 TamperData，它似乎可以解决问题，但感觉一点也不专业。
我在使用 TamperData 时遇到的问题是 POST 数据的文本框太小，无法容纳 ASP.NET 视图状态，因此我必须将该数据复制到 Emacs 中，然后再复制回来才能提高工作效率。我也不喜欢似乎没有一个选项只能篡改来自/到 localhost 的数据。
关于更好地扩展任务或更好的测试方法有什么想法吗？
I'm not sure whether this question belongs on StackOverflow or SuperUser, but here goes nothing...
I'm trying to test out some basic security problems on my personal ASP.NET website to see exactly how the custom validators, etc. work when tampering with the data. I've been looking at the Firefox extension TamperData which seems to do the trick, but it doesn't feel very professional at all.
The issues I'm having with TamperData is that the textbox for the POST data is way too small to hold the ASP.NET view-state, so I have to copy that data into Emacs and then back again to be productive at all. I also don't like that there doesn't seem to be an option to only tamper with data which is from/to localhost.
Any ideas on better extensions for the task or better methods to test it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你尝试过Fiddler吗？ http://www.fiddlertool.com/fiddler2/version.asp
Have you tried Fiddler? http://www.fiddlertool.com/fiddler2/version.asp
我也无法在 Firefox 中找到任何像样的黑盒测试（尝试过 HackBar 和 Tamperdata），所以现在我只是编写自己的黑盒测试便捷方法并在 IPython。我认为这是唯一正确的方法，因为不同站点的攻击理由完全不同，并且在不断发展；当有人编写一个漂亮的 UI 应用程序进行测试时，它已经过时了。如果你真的需要一个 UI，也许你应该尝试 Burp Suit，不过我从来没有尝试过。
I've also been unable to find anything decent for blackbox testing in Firefox (tried HackBar and Tamperdata), so now I just write my own convenience methods for blackbox testing and invoke them in IPython. I think this is the only proper way to do it actually since the grounds for attack are completely different from site to site and are constantly evolving; by the time someone writes a nice UI app for testing, it's already obsolete. If you really need a UI, maybe you should try Burp Suit, I've never tried it though.