If you understand how a particular Web site works, you can gain essential clues to securing it. Paros is a tool designed to show exactly how users interact with a Web site and how attackers could exploit it.
Paros uncovers the behind-the-scenes communication between your Web browser and a Web site and stores the data for analysis. It's actually a proxy server that you install on your client computer and then configure so that your Web browser connects to it when making Web requests. In turn, Paros connects to the target Web server. In its position between the client computer and the target Web server, Paros can collect all sorts of useful information from the target Web site and present it to you for analysis.
Installing Paros
Paros is a freeware Java application with versions for Windows and UNIX (including Mac OS X). Before you download Paros, make sure you have Sun Microsystems' Java Runtime Environment (JRE) 1.4.2 or later. Visit the Java Web site, where you can verify that you have the latest version or download it (http://www.java.com/en/download/index.jsp).
After you install the JRE, you can download the latest version of the Paros application and the short Paros user guide from the Paros Web site (http://www.parosproxy.org). Installation is straightforward. The Paros application is a Java Archive (JAR) file but comes with a shortcut in your Windows\Program Files\Paros folder to launch the program. On UNIX systems, navigate to the folder in which you extracted the Paros .zip file and execute the startserver.sh script. If successful, you'll see the Paros application start up in its own window as a standalone Java application.
Next, configure your Web browser to make a proxy connection to the Paros server. By default, Paros accepts network connections on local host TCP port 8080. You can change either the server you wish to connect to or the connection port in Paros by selecting Tools, Options, Local proxy.
When you view a Web page in a browser you've configured for Paros, you should be able to see data about that Web site in the Paros application UI. After you've collected data about a site, you can save it and later open it as a previous session. Let's walk through the panes in the Paros UI and talk about what they indicate, using a visit to the Windows IT Pro Web site as an example.
Navigating the Paros Interface
Figure 1 shows the functional Paros interface, which has three panes plus additional tools available from its menu. The upper left Sites pane shows a hierarchical view of all the Web sites accessed based on the URL I entered. The Sites pane in Figure 1 shows the Web site I visited, http://www.windowsitpro.com, as well as six other Web sites my browser talked to during that visit. This result is common for Web sites that use advertising because ads are typically served from third-party Web sites.
The pane that spans the bottom of the Paros interface presents the history, the results of a spider crawl, or noted vulnerability alerts, depending on which button you click. In Figure 1, the lower pane displays the chronological history of URLs visited as a result of a single request to http:// www.windowsitpro.com as well as the response returned by the Web server. The Windows IT Pro Web page is listed first, followed by a request for the Cascading Style Sheets (CSS) file and then the advertiser sites.
If you click an entry in the Sites or History pane, you can see the actual request or response displayed in the upper right pane. You can also use the Trap tab in this pane to halt on every request (or response) so that you can modify the actual request after it's left your browser. For example, you could test whether the server validates data by entering data in the requested, "good," format on the target Web site and then changing it to a "bad" format in Paros. If the Web server accepts the bad data as good, then you've discovered a possible vulnerability.
The Request and Response tabs in the upper right pane show the actual data being sent to or from the site. For example, in the Request view, you can see the actual HTTP GET string used to call the Web site data, as well as related data such as the Agent string (i.e., the type of Web browser you're using), referring URL, and even cookie data. Click the Response tab, and you'll be able to see data similar to what Figure 1 shows in the upper right pane, which the Web server sends back to the client. This includes HTML source code and images as well as metadata such as page expiration, how or whether the page should be cached, and whether a cookie was set or read.
Whether you're new to auditing Web sites or a veteran, it's informative to use Paros to visit a few Web sites to see what it tells you about how they really work. As you become more familiar with Paros, you can use its more advanced features to begin to assess a Web site's security.
Previous
Register
