471034 - Use ratproxy to test all of Mozilla's websites

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Applications, task)

Description

[Reed Loden [:reed]]

I had seen ratproxy mentioned before, but it got lost in the back of my head until I just ran across it again just now. Seems simple to use, and if it finds anything, it'd be worth the trouble of setting it up. We could run it against our staging sites or even the live sites.

What is ratproxy?

"Ratproxy is a semi-automated, largely passive web application security audit tool. It is meant to complement active crawlers and manual proxies more commonly used for this task, and is optimized specifically for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments."

Comment 1

[Chris Lyon [:clyon]]

hm. this is just another tool. we will prob use this but looking for something more automated and something that we can build custom use cases around.