WebScarab — Web Application Analysis Tool

September 20, 2022

As WebScarab’s default configuration, it uses port 8008 to capture HTTP requests, so we need to configure our browser to use that port in localhost as a proxy. We need to follow the similar steps to configure our browser’s proxy as we did for the Burpsuite only the default port will be 8008.

WebScarab comes pre-installed with Kali Linux 2020 full version,or we can use following command to install it:

sudo apt-get install webscarab

We can find it on application menu.

After opening WebScarab we got it’s main screen like following screenshot:

Now we will test it against bwapp on our localhost. We found the request on the “Summary” tab.

Now we right click on the folder and click on “Spider tree” to see all the requests on the network.

Now in the “Proxy” Tab we found the listener. Here we can start or stop the listener.

Whenever we do any post request we can see WebScarab’s request editor will come in front of us just like BurpSuite as we can see in the following screenshot:

Here we change some data on post request and click on “Accept” to forward the request.

Here in the following screenshot we can see that we have successfully changed the post request.

Not only changing post requests this tool can do a lot of things. We just gave this example

According to WebScarab’s official website it’s main features are following:

• Fragments – extracts Scripts and HTML comments from HTML pages as they are seen via the proxy or other plugins.
• Proxy – observes traffic between the browser and the web server. The WebScarab proxy is able to observe both HTTP and encrypted HTTPS traffic by negotiating an SSL connection between WebScarab and the browser, instead of simply connecting the browser to the server and allowing an encrypted stream to pass through it. Various proxy plugins have also been developed to allow the operator to control the requests and responses that pass through the proxy.
• Manual intercept – allows the user to modify HTTP and HTTPS requests and responses on the fly, before they reach the server or browser.
• Beanshell – allows for the execution of arbitrarily complex operations on requests and responses. Anything that can be expressed in Java can be executed.
• Reveal hidden fields – changes all hidden fields found in HTML pages to text fields, making them visible and editable. Sometimes it is easier to modify a hidden field in the page itself, rather than intercepting the request after it has been sent.
• Bandwidth simulator – allows the user to emulate a slower network in order to observe how their website would perform when accessed over, say, a modem.
• Spider – identifies new URLs on the target site, and fetches them on command.
• Manual request – allows editing and replay of previous requests, or creation of entirely new requests.
• Session ID analysis – collects and analyzes a number of cookies to visually determine the degree of randomness and unpredictability. Note that this analysis is rather trivial, and does not do any serious checks, such as FIPS, etc.
• Scripted – operators can use BeanShell (or any other BSF supported language found on the classpath) to write a script to create requests and fetch them from the server. The script can then perform some analysis on the responses, with all the power of the WebScarab Request and Response object model to simplify things.
• Parameter fuzzer – performs automated substitution of parameter values that are likely to expose incomplete parameter validation, leading to vulnerabilities like Cross Site Scripting (XSS) and SQL Injection.
• Search – allows the user to craft arbitrary BeanShell expressions to identify conversations that should be shown in the list.
• Compare – calculates the edit distance between the response bodies of the conversations observed and a selected baseline conversation. The edit distance is “the number of edits required to transform one document into another.” For performance reasons, edits are calculated using word tokens, rather than byte by byte.
• SOAP – parses WSDL and presents the various functions and the required parameters, allowing them to be edited before being sent to the server. Note: This plugin is deprecated, and may be removed in the future. SOAPUI is way beyond anything that WebScarab can do, or will ever do, and is also a free tool.
• Extensions – automates checks for files that were mistakenly left in the web server’s root directory (e.g. .bak, ~, etc). Checks are performed for both files and directories (e.g. /app/login.jsp will be checked for /app/login.jsp.bak, /app/login.jsp~, /app.zip, /app.tar.gz, etc). Extensions for files and directories can be edited by the user.
• XSS/CRLF – a passive analysis plugin that searches for user-controlled data in HTTP response headers and body to identify potential CRLF injection (HTTP response splitting) and reflected cross-site scripting (XSS) vulnerabilities.       

WebScarab’s spider, similar to the Burp Suite, is useful for discovering all referenced files in a website or directory without having to manually browse all possible links and to deeply analyze the requests made to the server and use them to perform more sophisticated tests.

WebScarab is a good alternative of infamous Burp Suite. Follow us on GitHub and Twitter we post updates about our new articles there.

All opinions and thoughts are welcome in the comment section. We always reply.