To excel in your work, you must first sharpen your tools, and Firefox has always been an essential tool for penetration testers. Here, I recommend 34 Firefox penetration testing plugins, which include functionalities such as penetration testing, information gathering, proxy, and encryption/decryption.
1: Firebug
One of Firefox’s five-star highly recommended plugins, needs no further explanation.
2: User Agent SwitcherA plugin to change the client User Agent.
3: HackbarA must-have tool for pentesters, providing SQL injection and XSS attacks, capable of encoding strings quickly in various ways.
4: HttpFoxMonitors and analyzes the HTTP traffic between the browser and the web server.
5: Live HTTP HeadersView HTTP headers of a website in real-time.
6: Tamper DataView and modify HTTP/HTTPS headers and POST parameters.
7: ShowIPDisplays information such as the current page’s IP address, hostname, ISP, country, and city in the status bar.
8: OSVDBOpen Source Vulnerability Database search.
9: Packet Storm search pluginPlugin provided by Packet Storm, which allows searching for vulnerabilities, tools, exploits, etc.
10: Offsec Exploit-db SearchSearches for Exploit-db information.
11: Security Focus Vulnerabilities Search PluginSearches vulnerabilities on Security Focus.
12: Cookie WatcherDisplays cookies in the status bar.
13: Header SpyDisplays HTTP headers in the status bar.
14: GroundspeedManipulate the application user interface.
15: CipherFoxDisplays the encryption algorithm and certificate of the current SSL/TLS in the status bar.
16: XSS MeXSS testing extension.
17: SQL Inject MeSQL injection testing extension.
18: WappalyzerView the applications used by a website.
19: PosterSend HTTP requests to interact with the web server, and view the output results.
20: Javascript DeobfuscatorDisplays the Javascript code running on the webpage.
21: Modify HeadersModify HTTP request headers.
22: FoxyProxyProxy tool.
23: FlagFoxDisplays the country flag of the website’s location in the address bar or status bar. Additionally, it offers more functions: double-clicking the flag can implement the WOT function, and middle-clicking enables the whois function. Users can also set shortcuts in options for actions such as IP copy and Wikipedia queries.
24: GreasemonkeyGreasemonkey allows you to add DHTML statements (user scripts) to any web page to change how they are displayed. Just like CSS enables you to take control of a webpage’s style, user scripts allow you to easily control any aspect of webpage design and interaction. For example:
copy
* Make URLs on the page clickable links.* Enhance web usability to better align frequently visited sites with your habits.* Bypass annoying bugs often found on websites.
25: Domain DetailsShow server type, IP address, domain registration information, etc.
26: WebsecurifyWebsecurify is a web security testing software extension for Firefox, capable of performing security assessments on web applications.
27: XSSed SearchSearches the cross-site script database at XSSed.com.
28: ViewStatePeekerView ASP.NET’s ViewState.
29: CryptoFoxCrack MD5, encryption/decryption tool.
30: WorldIPDisplays server IP, address, PING, Traceroute, RDNS, etc.
31: Server SpyA plugin to identify the type, version, and IP address of the web server you are accessing.
32: Default PasswordsSearch the default password database at CIRT.net.
33: Snort IDS Rule SearchSearch Snort’s IDS rules, useful for signature developers.
34: FireCATFireCAT (Firefox Catalog of Auditing Extensions) is a list collecting the most effective and useful security auditing and risk assessment tools in the form of Firefox plugins. The types of security tools not collected in FireCAT include fuzzer, proxy, and application scanners.