Web Penetration Testing with Tamper Data (Firefox Add-on)

Tampering is the way of modifying the request parameters before request submission. Tampering can be achieved by various methods and one of the ways is the through Tamper Data. Tamper data is one of the highly used extensions in Firefox. It allows tampering the data that is sent between client and the server as well as an easy access to GET and POSTING element’s data.

Installing Tamper Data Add-On

 Select the menu bar on the right end in Firefox. Click on Add-ons.

In the search bar field, search for Tamper Data add-on. Click on Install after installing the add-on, restart the Firefox Browser.

Displaying clear text password in Facebook using Tamper Data

 Now I am trying to login into my Facebook account and when I typed my password I see the “password in dotted form” so I wanted to know whether the password typed is correct or not. Click on tools option from menu bar and select tamper data to capture the request.

A pop will get open for tamper data click on start tamper which start capturing the ongoing request as we know that the username and password typed in the fields go through POST method. Now After that click on Login button to send the data through POST method.

When the request will send through browser to web server a pop up will appear, now hit Tamper, which will start capturing the sending request.

Now you can see from given image on the right half of Tamper Popup window it is showing the email and pass in clear text.

HTML Injection – Reflection POST method with Tamper Data

 I have installed bWAPP on my wamp server running on localhost. It can be accessed through browser. Navigate to login page using url “localhost/bWAPP/login.php”.

 Login into web application server by typing bee: bug as login credential, now choose your bug” html injection-reflected (post)” from given list of bugs and click on hack.

In given text field enter first name: kunal and last name: bhal.

Before clicking Go; again start tamper data to change the field values. After that we can see the post values and now modify it to change the username of any person.