3 ms·
When you say "we use ruby for automation" do you mean using something like buby with Burp, or something custom? I find myself writing a lot of custom fuzzers i
by ontoillogical 14y ago
When you say "we use ruby for automation" do you mean using something like buby with Burp, or something custom?
I find myself writing a lot of custom fuzzers in python, and am looking to improve my toolkit.
- tptacek 14y agoA long time ago, Eric Monti, then a member of our team and now at a big startup in SF, wrote a Burp/Ruby bridge called Buby. For a long time, and maybe still, another team member --- Timur Duehr, who also wrote the first version of our Ragweed native code debugger DSL --- maintained it. A lot of people on our team use Buby to automate. Another faction of our team uses Mike Tracy's WWMD toolkit, which does some of what Burp does but from an irb prompt. I'm allergic to both approaches and tend to just start from EventMachine and ev-http-request. Good example of the kind of scenario that'll get me into "writing code to test web apps" mode: testing those goofy cryptographic tokens applications send via email to reset passwords.
- ScottBurson 14y ago"Goofy" cryptographic tokens? Is there a better way?
- tptacek 14y agoNot having the tokens be replayable, rewritable to different user IDs, or decryptable would be a good start, right? Yes: the better approach is to have the token be a 256 bit cryptographically strong random number that corresponds to a row in the database with metadata sufficient to expire the token and invalidate it on password reset.
- ScottBurson 14y agoAh. So it's not the use of cryptographic tokens per se that you're objecting to -- just that they're not generated and/or handled correctly.
- tptacek 14y agoI object in general to the widespread practice of using tokens that contain semantically interesting information protected by encryption.
- ScottBurson 14y agoGot it. Didn't realize that was so widespread.
- ontoillogical 14y agoYou'd be surprised to know how often it's just the username encoded in base64...
- eru 14y ago> I find myself writing a lot of custom fuzzers in python, and am looking to improve my toolkit. Have you looked into Haskell's QuickCheck? It's essentially a fuzzer for unit testing. You might find some interesting ideas there.
- ontoillogical 14y agoThanks for the tip. I've just been looking at Learn You a Haskell, it's nice to have some specific usecases when learning a new language