Sunday, April 17, 2005

Debugging HTTP traffic

Are you trying to figure out why your webpage is so slow even after you switched from that old slow host to a new host that is supposed to be so much better? It could be that your website is producing bad header information or other wierdness in the HTTP traffic. Fear not! Programs such as Fiddler, Netmon and Achilles can help. Fiddler is described as:

Fiddler is a HTTP Debugging Proxy which logs all HTTP traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP Traffic, set breakpoints, and "fiddle" with incoming or outgoing data. Fiddler is designed to be much simpler than using NetMon or Achilles, and includes a simple but powerful JScript.NET event-based scripting subsystem.
Fiddler can help with performance testing by revealing missing headers that would allow client or proxy caching.
Additionally, by exposing HTTP Headers in the Session list, the user can see whether pages are missing HTTP Expiration headers that permit client or proxy caching. If a response does not contain Expires or Cache-Control headers, it might not be cached by the client.
Fiddler can help debug and enhance security for your website by using its "break points" feature.
When the Enable Single Step Debugging option is checked on the Rules menu, or when the properties of the HTTP Request or Response match the target criteria, Fiddler can pause HTTP traffic and allow edits. This feature proves useful for security testing, as well as for general functionality testing, because all code paths can be exercised.
Fiddler has flexibility and can be extended via the .NET framework. See more information on MSDN.

A 2003 survey lists the Top 75 Security Tools (go to their site for wonderful descriptions including clarification of cost and platform (Linux/BSD/Windows):
  1. Nessus
  2. Ethereal
  3. Snort
  4. Netcat
  5. Tcpdump / Windump
  6. hping2
  7. DSniff
  8. GFI LANguard
  9. Ettercap
  10. Whisker/Libwhisker
  11. John the Ripper
  12. OpenSSH / SSH
  13. Sam Spade
  14. ISS Internet Scanner
  15. Tripwire
  16. Nikto
  17. Kismet
  18. SuperScan
  19. L0phtCrack 4 (now called "LC4")
  20. Retina
  21. Netfilter
  22. traceroute/ping/telnet/whois
  23. Fport
  24. SAINT
  25. Network Stumbler
  26. SARA
  27. N-Stealth
  28. AirSnort
  29. NBTScan
  30. GnuPG / PGP
  31. Firewalk
  32. Cain & Abel
  33. XProbe2
  34. SolarWinds Toolsets
  35. NGrep
  36. Perl / Python
  37. THC-Amap
  38. OpenSSL
  39. NTop
  40. Nemesis
  41. LSOF
  42. Hunt
  43. Honeyd
  44. Achilles
  45. Brutus
  46. Stunnel
  47. Paketto Keiretsu
  48. Fragroute
  49. SPIKE Proxy
  50. THC-Hydra
  51. OpenBSD
  52. TCP Wrappers
  53. pwdump3
  54. LibNet
  55. IpTraf
  56. Fping
  57. Bastille
  58. Winfingerprint
  59. TCPTraceroute
  60. Shadow Security Scanner
  61. pf
  62. LIDS
  63. hfnetchk
  64. etherape
  65. dig
  66. Crack / Cracklib
  67. cheops / cheops-ng
  68. zone alarm / Kerio Personal Firewall
  69. Visual Route
  70. The Coroner's Toolkit (TCT)
  71. tcpreplay
  72. snoop
  73. putty
  74. pstools
  75. arpwatch
Fyodor has done a wonderful job putting this list together. Using such tools as Fiddler and tools that Fyodor lists will certainly aid you in making a more secure web application.
djuggler's personal blog is Reality Me and consults as Superior Internet Designs.


Posted by: djuggler | 10:34 PM |