OWASP WebScarab NG Project

Welcome to the WebScarab (Next Generation) Project

WebScarab-NG is a complete rewrite of the old WebScarab application, with a special focus on making the application more user-friendly. To this end, WebScarab-NG makes use of the Spring Rich Client Platform to provide the user interface features. By using the Spring Rich Client Platform, WebScarab-NG automatically gains things like default buttons, keyboard shortcuts, support for internationalisation, etc.

Another new feature is that session information is now written into a database, rather than into hundreds or thousands of individual files. This makes disk space utilisation and things like archiving of sessions a lot easier.

Ultimately, WebScarab-NG will have all the significant functionality that the old WebScarab had, although it will be reorganised quite significantly, in order to make the application more user friendly.

New User Interface

As mentioned above, the user interface has changed quite a lot from the old WebScarab. Apart from the new default Look&Feel (JGoodies), you will see that the conversation viewer has changed quite a lot. The old "Raw" view is still there, but the Parsed version has changed quite dramatically - for the better, I hope you'll agree!

The Parsed view now shows the request and response details in a tree form, rather than in individual text boxes. This makes the interface look a lot cleaner, and more importantly, is a lot more compact. It also makes it a lot easier to include features like automatically breaking out URL parameters, and multiple cookies into their own nodes, where it is a lot easier to view the individual parameters. We also show the request and the response next to each other, rather than one above the other, since most people seem to have more horizontal real-estate than vertical. The split between request and response can easily be adjusted by dragging, as can the split between the headers and the message content.

Current status

At this stage, WebScarab-NG primary feature is the intercepting proxy that allows the operator to observe and modify requests from a browser or other client passing through the proxy. A new feature is the Proxy Control Bar, which is implemented as a "stays on top" tool bar that floats above your browser or other thick client, and allows you to quickly enable or disable request intercepts. It also allows you to annotate or describe the requests as they pass through the proxy. If you type some text into the annotation field, that text will be linked to the next conversation that passes through the proxy, and can later be viewed as part of the conversation history. this can be very helpful to keep track of what you were doing in a multi-step procedure.

For example: Selecting a menu item, entering a value, submitting that value, etc. Often sites are built in such a way that they can result in dozens of conversations resulting from a single action. Annotating that conversation that initiated all the rest makes it very easy to identify them at a later stage.

Error feedback

One of the neat features provided by the Spring Rich Client Platform is the ability to check that the inputs actually make sense, and to provide automated "as you type" feedback to the user.

For example, look at the "Intercept Request" window:

We can see that the user tried to change the method from "POST" to "PROST". WebScarab-NG has no idea how to execute a "PROST" method, and so provides an error message to inform the user. Additionally, the OK button is automatically disabled, until the error is corrected.

Obtaining WebScarab-NG

WebScarab-NG is distributed via Java WebStart, and can be obtained here.

A major benefit of using Java WebStart is that users will automatically receive new versions of WebScarab-Ng as they are made available, since WebStart checks to see if a new version is available each time it is run. Of course, if it is run with no access to the Internet, it will still run.

Note: there is an issue with signing the application and Java web start if you are using Java 1.6.
We are investigating the solution. In the meantime, you can still use WebScarab NG with an older 
version of Java (without messing up your system).
 
 "set PATH="c:\Program Files\Java\jdk1.5.0_06\bin" or whatever
 "javaws http://dawes.za.net/rogan/webscarab-ng/webstart/WebScarab-ng.jnlp

Depending on demand, once WebScarab NG matures, it will also be made available for offline installation.

For information about what changes have been made, please see the GIT repository

If you want to get a copy of the source, you can download a snapshot from the gitweb repository viewer. Alternatively, if you want to check out the repo using git, you can use the following command:

 $ git clone http://dawes.za.net/rogan/webscarab-ng/webscarab-ng.git/

You can get any subsequent changes using:

 $ git fetch origin

Technical information

Technical information for those interested in digging into it can be found here

Feedback

If you have any comments or suggestions for WebScarab-NG, please feel free to send them to the OWASP WebScarab mailing list

Your feedback is much appreciated, and will be carefully considered for future releases of WebScarab-NG.

Project Contributors

The WebScarab-NG project is run by Rogan Dawes of Aspect Security. He can be contacted at rogan AT dawes.za.net