Introduce

Browser Extensions are add-ons that are added to your browser to help you use advanced features that the browser does not support. Users can install these extensions to tailor the browsing experience to their needs. There are many categories of Extensions available for popular browsers like Mozilla Firefox, Google Chrome, Microsoft edge, etc.

In this post, I will introduce you to some Extensions that are very helpful in finding security holes and developing web applications. My article will share the link of the Extensions available on the Mozilla Firefox browser, for other browsers, you can copy the name and go to the extension settings of those browsers to download.

1. Wappalyzer

Wappalyzer is a tool that provides initial information for the recon process. Wappalyzer helps identify programming languages, CMSs, JS libraries, Frameworks, and other technologies that websites use. The main technologies are displayed very briefly and simply, you can click to see detailed information about the technology used. Wappalyzer interface:

Link: https://addons.mozilla.org/en-US/firefox/addon/wappalyzer

2. FoxyProxy

FoxyProxy and an extension that automatically switches internet connections between one or more proxy servers. Simply put, FoxyProxy simplifies the process of manually modifying connection settings in Firefox. The utility helps to disable/enable proxy with just one click. At the same time, FoxyProxy also has the feature to bypass proxies for specific domains using Blacklist and Whitelist. It is very useful during pentesting, especially when used with BurpSuite

Link: https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard

3. PwnFox

Another extension that integrates with BurpSuite I would like to recommend is PwnFox. Similar to the Multi-Account Containers extension, PwnFox makes it possible for users to log in to many different accounts on the same website. Tabs with different accounts will be colored for easy management.

PwnFox is more suitable for security testing because it can be integrated with BurpSuite. From there, we can track the request history with the colors corresponding to the accounts installed on the extension

Link: https://addons.mozilla.org/en-US/firefox/addon/pwnfox

4. Fake Filler

The goal of this extension is to make it easier and faster for developers and pentesters to fill out forms. It helps to fill all form inputs (textboxes, text areas, radio buttons, drop downs, etc) with randomly generated data.

Link: https://addons.mozilla.org/en-US/firefox/addon/fake-filler/

5. User-Agent Switcher

Extension User-Agent Switcher helps to modify User Agent on your browser. When communicating with a web server, the browser sends a text string or HTTP Header called a User-Agent that contains information about the user’s operating system, current browser, rendering engine, and components. other importance. Based on the User Agent, the servers give a response corresponding to each platform.

During penetration testing, User-Agent Switcher helps us to monitor application activity by loading the same application in different types of operating systems, such as for Android, OS for PC, IOS, etc. This is very handy in checking for possible errors in response conversion for many different operating systems of the application.

Link:https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher

6. KNOXSS

KNOXSS is a popular tool developed by Brazilian Security Researcher @Brutelogic . This tool aims to find Cross Site Scripting vulnerabilities automatically. You just need to enter the url you want to attack and KNOXSS will do the rest for you. The tool is available in two versions, the Community-edition Version which is free to use and the Pro Version

Link: https://addons.mozilla.org/en-US/firefox/addon/knoxss-community-edition

In fact, the free version is similar to other XSS search engines. If you want a genuine XSS search engine, you should use the Pro version (paid), the Pro version is rated quite well on Bugbounty platforms.

7. Hackbar Addon

Hackbar is still a very useful and easy to use extension for pentester. When testing web applications or web servers, pentesters always change the settings of the address bar as well as constantly refresh web pages. The Hackbar Addon utility helps to reduce this time and perform its task quickly. This tool includes payloads for XSS attacks, SQL Injection, WAF Bypass Payloads, LFI Payloads, etc.

Link: https://addons.mozilla.org/en-US/firefox/addon/maxs-hackbar

Link: https://addons.mozilla.org/en-US/firefox/addon/hackbartool

This extension also needs you to pay to be able to use the best version.

8. DotGit

An Extension to check if .git files are displayed in visited web pages. This utility also checks environment files (.env), security.txt files and a few other file types. Sometimes exposing environment files and git files can have serious security implications. This extension automatically runs and searches for files as soon as we visit the website.

Link: https://addons.mozilla.org/en-US/firefox/addon/dotgit

9. Beautifier & Minify

Beautifier & Minify makes it easy to minify and simplify CSS, HTML and JavaScript code. During penetration testing, we often encounter large chunks of JavaScript code that is difficult to read and understand due to the lack of line formatting. Beautifier & Minify helps us to edit beautiful, readable code so that we can find errors in the source code. Example 1 unedited css file.

CSS file after editing.

Link: https://addons.mozilla.org/en-US/firefox/addon/beautifer-minify/

10. Email Extractor

The Email Extractor tool automatically saves email addresses from the websites we visit. The main objective of this add-on is to collect possible exposed email addresses from the source code and can assist in performing Social Engineering attacks, Credential Stuffing attacks, attacks. APT attacks targeting advanced users’ emails, etc.

Link:https://addons.mozilla.org/en-US/firefox/addon/mailshunt-email-extractor/

11. Retire.js

Old websites that have not been tested and updated for a long time may have security holes due to outdated Javascript libraries. This extension helps us find vulnerabilities in JS files from known vulnerabilities and some published CVEs.

Link: https://addons.mozilla.org/en-US/firefox/addon/retire-js/

Epilogue

The above are the utilities that I often use in the process of pentesting the website. In addition to the available utilities, we can completely create our own extensions and share them on the browser store for personal or commercial use. However, if the extension you share causes harm to the user, the browser will review and remove the extension permanently.