WebScarab is a tool that we can use in web security testing. It acts like a web proxy and allow user to intercept the request (HTTP and HTTPS) and web server replies. Sounds familiar? Oh Burp ? Yah, we can consider WebScarab as a alternative of BurpSuite.
WebScarab is an open source tool developed by The Open Web Application Security Project (OWASP), and was implemented in Java so it could run across multiple operating systems.
As WebScarab’s default configuration, it uses port 8008 to capture HTTP requests, so we need to configure our browser to use that port in localhost as a proxy. We need to follow the similar steps to configure our browser’s proxy as we did for the Burpsuite only the default port will be 8008.
WebScarab comes pre-installed with Kali Linux 2020 full version,or we can use following command to install it:
sudo apt-get install webscarabWe can find it on application menu.
After opening WebScarab we got it’s main screen like following screenshot:
Now we will test it against bwapp on our localhost. We found the request on the “Summary” tab.
Now we right click on the folder and click on “Spider tree” to see all the requests on the network.
Now in the “Proxy” Tab we found the listener. Here we can start or stop the listener.
Whenever we do any post request we can see WebScarab’s request editor will come in front of us just like BurpSuite as we can see in the following screenshot:
Here we change some data on post request and click on “Accept” to forward the request.
Here in the following screenshot we can see that we have successfully changed the post request.
Not only changing post requests this tool can do a lot of things. We just gave this example
According to WebScarab’s official website it’s main features are following:
- Fragments – extracts Scripts and HTML comments from HTML pages as they are seen via the proxy or other plugins.
- Proxy – observes traffic between the browser and the web server. The WebScarab proxy is able to observe both HTTP and encrypted HTTPS traffic by negotiating an SSL connection between WebScarab and the browser, instead of simply connecting the browser to the server and allowing an encrypted stream to pass through it. Various proxy plugins have also been developed to allow the operator to control the requests and responses that pass through the proxy.
- Manual intercept – allows the user to modify HTTP and HTTPS requests and responses on the fly, before they reach the server or browser.
- Beanshell – allows for the execution of arbitrarily complex operations on requests and responses. Anything that can be expressed in Java can be executed.
- Reveal hidden fields – changes all hidden fields found in HTML pages to text fields, making them visible and editable. Sometimes it is easier to modify a hidden field in the page itself, rather than intercepting the request after it has been sent.
- Bandwidth simulator – allows the user to emulate a slower network in order to observe how their website would perform when accessed over, say, a modem.
- Spider – identifies new URLs on the target site, and fetches them on command.
- Manual request – allows editing and replay of previous requests, or creation of entirely new requests.
- Session ID analysis – collects and analyzes a number of cookies to visually determine the degree of randomness and unpredictability. Note that this analysis is rather trivial, and does not do any serious checks, such as FIPS, etc.
- Scripted – operators can use BeanShell (or any other BSF supported
language found on the classpath) to write a script to create requests
and fetch them from the server. The script can then perform some
analysis on the responses, with all the power of the WebScarab Request
and Response object model to simplify things. - Parameter fuzzer – performs automated substitution of parameter
values that are likely to expose incomplete parameter validation,
leading to vulnerabilities like Cross Site Scripting (XSS) and SQL
Injection. - Search – allows the user to craft arbitrary BeanShell expressions to identify conversations that should be shown in the list.
- Compare – calculates the edit distance between the response bodies
of the conversations observed and a selected baseline conversation. The
edit distance is “the number of edits required to transform one
document into another.” For performance reasons, edits are calculated
using word tokens, rather than byte by byte. - SOAP – parses WSDL and presents the various functions and the
required parameters, allowing them to be edited before being sent to the
server. Note: This plugin is deprecated, and may be removed in the future. SOAPUI is way beyond anything that WebScarab can do, or will ever do, and is also a free tool. - Extensions – automates checks for files that were mistakenly left
in the web server’s root directory (e.g. .bak, ~, etc). Checks are
performed for both files and directories (e.g. /app/login.jsp will be
checked for /app/login.jsp.bak, /app/login.jsp~, /app.zip, /app.tar.gz,
etc). Extensions for files and directories can be edited by the user. - XSS/CRLF – a passive analysis plugin that searches for
user-controlled data in HTTP response headers and body to identify
potential CRLF injection (HTTP response splitting) and reflected
cross-site scripting (XSS) vulnerabilities.
WebScarab’s spider, similar to the Burp Suite, is useful for discovering all referenced files in a website or directory without having to manually browse all possible links and to deeply analyze the requests made to the server and use them to perform more sophisticated tests.
WebScarab is a good alternative of infamous Burp Suite. Need more articles? Make sure to follow us to get all our articles directly on notification. We are also available on Twitter and GitHub, we post article updates there. To join our KaliLinuxIn family, join our Whatsapp Channel & Telegram Group. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.