OWASP WebScarab NG Project

This project is part of the OWASP Breakers community. Feel free to browse other projects within the Defenders, Builders, and Breakers communities.

Main

Welcome to the WebScarab (Next Generation) Project

WebScarab-NG logo

WebScarab-NG is a complete rewrite of the old WebScarab application, with a special focus on making the application more user-friendly. To this end, WebScarab-NG makes use of the Spring Rich Client Platform to provide the user interface features. By using the Spring Rich Client Platform, WebScarab-NG automatically gains things like default buttons, keyboard shortcuts, support for internationalisation, etc.

Another new feature is that session information is now written into a database, rather than into hundreds or thousands of individual files. This makes disk space utilisation and things like archiving of sessions a lot easier.

Ultimately, WebScarab-NG will have all the significant functionality that the old WebScarab had, although it will be reorganised quite significantly, in order to make the application more user friendly.

New User Interface

As mentioned above, the user interface has changed quite a lot from the old WebScarab. Apart from the new default Look&Feel (JGoodies), you will see that the conversation viewer has changed quite a lot. The old "Raw" view is still there, but the Parsed version has changed quite dramatically - for the better, I hope you'll agree!

The Parsed view now shows the request and response details in a tree form, rather than in individual text boxes. This makes the interface look a lot cleaner, and more importantly, is a lot more compact. It also makes it a lot easier to include features like automatically breaking out URL parameters, and multiple cookies into their own nodes, where it is a lot easier to view the individual parameters. We also show the request and the response next to each other, rather than one above the other, since most people seem to have more horizontal real-estate than vertical. The split between request and response can easily be adjusted by dragging, as can the split between the headers and the message content.

Current status

At this stage, WebScarab-NG primary feature is the intercepting proxy that allows the operator to observe and modify requests from a browser or other client passing through the proxy. A new feature is the Proxy Control Bar, which is implemented as a "stays on top" tool bar that floats above your browser or other thick client, and allows you to quickly enable or disable request intercepts. It also allows you to annotate or describe the requests as they pass through the proxy. If you type some text into the annotation field, that text will be linked to the next conversation that passes through the proxy, and can later be viewed as part of the conversation history. this can be very helpful to keep track of what you were doing in a multi-step procedure.

For example: Selecting a menu item, entering a value, submitting that value, etc. Often sites are built in such a way that they can result in dozens of conversations resulting from a single action. Annotating that conversation that initiated all the rest makes it very easy to identify them at a later stage.

Error feedback

One of the neat features provided by the Spring Rich Client Platform is the ability to check that the inputs actually make sense, and to provide automated "as you type" feedback to the user.

For example, look at the "Intercept Request" window:

We can see that the user tried to change the method from "POST" to "PROST". WebScarab-NG has no idea how to execute a "PROST" method, and so provides an error message to inform the user. Additionally, the OK button is automatically disabled, until the error is corrected.

Obtaining WebScarab-NG

WebScarab-NG is distributed via Google Code, and can be obtained here.

After extraction of files user need to run following command:

java -jar WebScarab-ng-X.X.X.one-jar.jar

where X.X.X is downloaded version or use one of scripts (start.sh for Linux, start.bat for Windows).

Technical information

Technical information for those interested in digging into it can be found here.

This page lists the differences between WebScarab Classic and WebScarab NG, including a ToDo list of work still to be done on WebScarab NG.

Tips & Tricks

WebScarab NG already contains a lot of functionality but some of them are well hidden beneath the GUI and nowhere documented. A list of such functions can be found in the Tips & Tricks of WebScarab NG section.

Bugs

Any found bugs should be reported via WebScarab NG Google Code issues page. Such mechanism allows us to keep track of all found problems so we can WebScarab-NG better.

Feedback

If you have any comments or suggestions for WebScarab-NG, please feel free to post them on WebScarab NG Google Code issues page or send them to the OWASP WebScarab mailing list

Your feedback is much appreciated, and will be carefully considered for future releases of WebScarab-NG.

Project Contributors

The WebScarab-NG project is run by Daniel Brzozowski. He can be contacted at .

Project About

PROJECT INFO What does this OWASP project offer you?

RELEASE(S) INFO What releases are available for this project?

what is this project? Name: OWASP WebScarab NG Project (home page) Purpose: WebScarab NG is a robust tool that assists the user in penetration test. This is a complete rewrite of the old WebScarab application, with a special focus on making the application more user-friendly. License: GNU General Public License v2 who is working on this project? Project Leader(s): Daniel Brzozowski @ Project Contributor(s): Rogan Dawes (Past Contributor) @ how can you learn more? Project Pamphlet: Not Yet Created Project Presentation: Mailing list: Mailing List Archives Project Roadmap: Not Yet Created Main links: OWASP WebScarab NG Project OWASP WebScarab Differences (Classic vs NG) OWASP WebScarab NG Project Technical Info OWASP WebScarab NG Google Code OWASP WebScarab Roadmap Key Contacts Contact Daniel Brzozowski @ to contribute to this project Contact Daniel Brzozowski @ to review or sponsor this project

current release WebScarab-Ng-0.2.1 - 22 January 2011 - (download) Release description: Version 0.2.1 with spider functionality - jar with run scripts. New functionality: cookie manager manual spider pider plugin with: automatic discovery integration with cookie manager automatic form submission flexibility to define request headers integration with proxy and websitemap Rating: Not Reviewed - Assessment Details last reviewed release Not Yet Reviewed other releases WebScarab-NG-0.3.0 WebScarab-Ng-0.2.1