What is Tamper Data?
Tamper data, an add-on (extension) for Mozilla Firefox, is a fast, simple yet effective tool which can used to do penetration testing.
Tamper Data basically gives us the power to view, record and even modify outgoing HTTP requests. Since Tamper data is integrated into the browser, so it has no problems with the HTTPS connections, client authentication certificates or other features that the browser supports. We can trace and time the http/https connections, responses and parameters being sent.
How to use Tamper Data?
Tamper Data is a plugin available for Firefox. We can easily download the xpi from Mozilla and install it. After installation of the add-on it would ask for restarting the Firefox.
Now once we have restarted the Firefox we can visit the Tamper Data by going to TOOLS -> Tamper Data
After clicking the Tamper Data the “Tamper Data - Ongoing Requests” window opens up.
As soon as this window is opened, Tamper data will start reading the HTTP requests. The window will look like this when it starts reading the requests.
On selection of an item, its HTTP Request and Response information’s are opened on the lower two left and right panes respectively.
Here we get a detailed view of what is going on in the request. If the selected request contains cookie information then we will see a cookie line in the left side pane or set cookie line in the right side pane or both.
Now if we double click an entry then the “Tamper Details” window opens up, which provides us easy access to that request element’s data.
Thus using the above process we can easily monitor what is going on during the browsing session.
However till now we have just monitored the request. Tamper data can certainly do more than that. Now comes the sweet part of tampering the requests being made.
To begin we have to click on the option “Start Tamper”.
From now on whenever the browser will make a request we will be prompted with three options…
The three options are :
Submit -> This just sends the request as it is without modifying it.
Abort Request -> This, as the name suggests, will abort the request, i.e. will stop the request from being sent.
Tamper -> This is the option which has made Tamper Data so famous and handy as well. When we click on this option, i.e. we want to tamper with the data, then a new window opens up.
On the top of the window (starting with the HTTP) is the URL the request is being sent to. On the left hand side pane we have the Request headers and their values. We can not only read them but also modify them as per our needs. On the right hand side pane we have the POST data of the request. Here we can see what POST fields are being sent and what are its values. We have a number of options here. On right clicking in the right hand pan we get the option to include our own elements which were not there earlier. Also on right clicking on the elements present we again get a handful number of options. These are very useful in manipulating the form in our own way and wish.
These numerous optionssaves us the effort of bypassing client side restrictions on what values may be sent or to submit an element not part of the form.
The only limitation of Tamper data is that it can’t modify http GET parameters. Otherwise Tamper Data is a neat tool by which we can easily see what our web application is doing, what are the parameters being passed etc.. With the help of this tool parameter manipulation has become literally a piece of cake.
Thus install this Firefox extension and enjoy the various offerings it has to offer.
|Ramesh Chandra Bhattacharjee
Ramesh works for Infosys and is a beginner to information security domain