OWASP WebScarab Differences (Classic vs NG) - Revision history

Daniel Brzozowski at 22:49, 22 January 2011

2011-01-22T22:49:51Z

2011-01-22T22:47:45Z

Updating for google code.

2011-01-22T22:38:37Z

2008-09-03T12:28:22Z

‎Plugins: added some structure

2008-04-24T16:25:05Z

update the list of differences

2008-02-06T15:05:10Z

Http protocol support

2008-01-25T16:58:40Z

2008-01-25T16:56:32Z

Status update

2008-01-14T09:19:32Z

Recategorise this project

2008-01-08T17:15:43Z

How to execute WS-NG

@@ Line 59: / Line 59: @@
   java -jar WebScarab-ng-X.X.X.one-jar.jar
-where X.X.X is downloaded version or use one of scripts (start.sh for Linux, start.bat for Windows) provided in WebScarab zip file.
+where X.X.X is downloaded version or use one of scripts (start.sh for Linux, start.bat for Windows) provided in WebScarab NG zip file (which can be found [https://code.google.com/p/webscarab-ng/downloads/list here]).
 [[Category:OWASP WebScarab Project]]
 [[Category:OWASP WebScarab NG Project]]

@@ Line 56: / Line 56: @@
 ==Execution==
-WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. An alternate packaging has been created, using the Maven onejar plugin, which packages all the required jars into a subdirectory of the "onejar", and provides a specialised classloader to allow Java to access the contents of those jars.
+WebScarab NG is distributed using the Maven onejar plugin, which packages all the required jars into a subdirectory of the "onejar", and provides a specialised classloader to allow Java to access the contents of those jars. To start WebScarab NG use following command in jar directory
 [[Category:OWASP WebScarab Project]]
 [[Category:OWASP WebScarab NG Project]]

@@ Line 53: / Line 53: @@
 * Search, Compare
 These plugins are very clunky to use. It actually makes a lot more sense to make those features available as part of the primary interface, rather than relegating them to a backwater. Search should provide a simple interface where the operator can type some text and click Go, rather than having to write code.
 ==Execution==

@@ Line 12: / Line 12: @@
 NG has significantly fewer plugins than Classic. The only plugins currently implemented in NG are the Proxy, Manual Request and WebServices plugins.
 This leaves the following plugins to be implemented:
@@ Line 33: / Line 24: @@
 * Search
-Porting of the WebServices plugin to NG is partially completed. Currently it is sufficient to access the WebGoat web service, but it doesn't support complex types. This functionality could easily be added if desired.
+=== Proxy ===
 ==HTTP Protocol support==

@@ Line 7: / Line 7: @@
 NG has no concept of the shared cookie jar, which is used in Classic to allow plugins such as the Spider and Manual Request plugins to use the most current cookies for a particular URL. This could/should be replaced by an Identity module, which can provide the most current identifiers for a particular identity (cookies, Basic auth, etc).
-NG now also has the Transcoder functionality, implemented as a modal dialog. It is intended to also implement "right-click" menus to perform various transcoding operations "in-place" in arbitrary text fields.
+NG now also has the Transcoder functionality, implemented as a non-modal dialog. It is intended to also implement "right-click" menus to perform various transcoding operations "in-place" in arbitrary text fields.
 ==Plugins==
@@ Line 14: / Line 14: @@
 Some features of the Proxy plugin remain to be ported:
 * BeanShell scripts for programmatic modification of requests/responses
 * Miscellaneous proxy plugins - Reveal hidden fields, prevent caching of responses

← Older revision		Revision as of 15:05, 6 February 2008
Line 36:		Line 36:

	Porting of the WebServices plugin to NG is partially completed. Currently it is sufficient to access the WebGoat web service, but it doesn't support complex types. This functionality could easily be added if desired.		Porting of the WebServices plugin to NG is partially completed. Currently it is sufficient to access the WebGoat web service, but it doesn't support complex types. This functionality could easily be added if desired.
		+
		+	==HTTP Protocol support==
		+
		+	WebScarab-classic has support for authentication to servers using SSL client certificates (including those stored on a smart card), as well as using NTLM. NG does not currently support SSL client certificates at all. NTLM should be supported through the Apache HTTPClient library, but this has not been tested.

	==Porting suggestions==		==Porting suggestions==

← Older revision		Revision as of 09:19, 14 January 2008
Line 54:		Line 54:
	WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. Maven does have a fatjar plugin which should be able to construct a single jar with all its dependencies. This needs to be investigated.		WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. Maven does have a fatjar plugin which should be able to construct a single jar with all its dependencies. This needs to be investigated.

−	~~[[Category:OWASP Project]]~~
−	~~[[Category:OWASP Tool]]~~
−	~~[[Category:OWASP Download]]~~
	[[Category:OWASP WebScarab Project]]		[[Category:OWASP WebScarab Project]]
		+	[[Category:OWASP WebScarab NG Project]]

← Older revision		Revision as of 17:15, 8 January 2008
Line 50:		Line 50:
	This plugin should also identify FORMs in the HTML responses, and identify those that have been submitted by matching them with the parameters of GET requests, or the bodies of POST's, using an intelligent matching algorithm. (Empty parameters in the form may be matched to anything in a GET/POST)		This plugin should also identify FORMs in the HTML responses, and identify those that have been submitted by matching them with the parameters of GET requests, or the bodies of POST's, using an intelligent matching algorithm. (Empty parameters in the form may be matched to anything in a GET/POST)

		+	==Execution==
		+
		+	WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. Maven does have a fatjar plugin which should be able to construct a single jar with all its dependencies. This needs to be investigated.

	[[Category:OWASP Project]]		[[Category:OWASP Project]]