Groundspeed, a firefox add-on for web application security testers

Groundspeed is now a reviewed Firefox addon

Felipe — Sun, 30 Jan 2011 17:36:18 +0000

Last Friday Groundspeed passed the Mozilla review to become a ‘public’ add-on. This basically means there will be no more install ‘malware danger’ warnings and users with older versions should be prompted to update to the most recent version.

I am impressed with the speed of the review by the Add-on Editors team, it took less than a week to complete. I am sure they have a lot of work so it’s great that they can be able to move things with so much efficiency. I am seriously thinking about volunteering some time to the review process.

Groundspeed 1.2 released

Felipe — Sun, 23 Jan 2011 00:26:39 +0000

I just uploaded a new version of Groundspeed to the Mozilla Add-on (AMO) site. The new version, 1.2, has some small updates to increase stability and to correct some bugs. I also submited this version to ‘full review’ by Mozilla, what should give Groundspeed access to all functionality in the add-ons site (no more warnings that the add-on might not be safe when installing!).

For security reasons, all add-ons hosted by Mozilla have to undergo a review by an AMO editor. This review covers things like namespase pollution, memory leaks, possible conflicts with other add-ons, malicious content and security vulnerabilities, like arbitrary privileged JavaScript execution in chrome space.

Once the review is passed, people using older versions of Groundspeed will be automatically prompted to update as part of the browser update process.

Slides from Groundspeed talk at OWASP

Felipe — Wed, 03 Nov 2010 22:18:41 +0000

Here are the slides from the talk I gave yesterday at the OWASP NY/NJ chapter meeting. You can download the PDF slides from slideshare. Thanks to everyone who attended!

Groundspeed Presentation at the OWASP NY/NJ

View more presentations from Felipe M.

Groundspeed at OWASP NY/NJ chapter meeting (Nov 2)

Felipe — Wed, 27 Oct 2010 02:42:26 +0000

Next week I will be talking about some of the ideas behind Groundspeed in the OWASP NY/NJ chapter meeting. The meeting will be on Tuesday, Nov 2 at the KPMG offices (345 Park Ave) from 6pm to 9pm and the agenda includes some very interesting presentations:

Much Ado about Randomness, Aleksandr Yampolskiy
Escaping the Sandbox, Stephen Ridley
Memory Corruption, Exploitation, and You, Dino Dai Zovi

There will be free beer and food and there are over 200 people already registered to attend! This is supposed to be largest OWASP chapter meeting ever held! If you are in the NY/NJ area you should consider coming! For more information and a link to register check the OWASP NY/NJ chapter website.

Replay Groundspeed SANS Webcast

Felipe — Mon, 31 May 2010 23:43:39 +0000

Last month I presented a webcast titled “Manipulating Web Application Interfaces” as part of the SANS webcast series. It is now available online in the SANS webcast archive here. You will have to sign in with your SANS portal account (free registration) in order to see the link to replay the webcast. The slides are available online here.

Groundspeed Slides from SANS Webcast

Felipe — Mon, 19 Apr 2010 18:40:12 +0000

Here are the slides from the SANS webcast from April 19th. The PDF version will be available at the SANS website soon.

As soon as the recording is made available I will post a link here.

Manipulating Web Application Interfaces

View more presentations from Felipe M.

Talking about Groundspeed on SANS webcast (April 19th 1PM ET)

Felipe — Sat, 03 Apr 2010 15:28:16 +0000

On April 19 (1pm EDT / 18h00 GMT) I will be talking about some of the ideas behind Groundspeed on a SANS webcast titled “Manipulating Web Application Interfaces“.

For a long time we have used the same approach to perform input validation on web applications. We have seen some nice improvements at the client side proxy level (remember the old Achilles proxy? Now think about Burp), but the overall idea remained the same: place a client proxy between the browser and the web server, generate requests, intercept them and modify the HTTP parameters.

Why was manipulating the HTTP request such a successful idea that today we still assume it’s the natural way to test input validation? Has the context that forced that solution changed? Or in other words, are we still subject to the same limitations we were then? Those are some of the questions I want to discuss.

You can find more information including a link to register for it here.

3,000 groundspeed downloads since November

Felipe — Tue, 16 Feb 2010 02:03:14 +0000

Groundspeed just passed the 3,000 download mark this weekend. It’s an average of about 29 downloads a day since it came out last November! The single day with most downloads was Jan 27, with 343 downloads, or one download every 5 minutes.

Most of Groundspeed users seem to be in the United States (61%), the UK and Germany tie for the second with 7% followed by Spain (6%), France (5%) and Brazil (2%).

It’s surprising and nice to see so many people interested! If you have installed groundspeed and have comments, suggestions or bug reports, send me an email or leave a comment here!

Release of Groundspeed 1.1

Felipe — Mon, 25 Jan 2010 04:53:41 +0000

The new version of Groundspeed is up at addons.mozilla.com. Click on the “Install Now” button on the sidebar or click here to download it. This version is a minor update to fix some bugs in version 1.0.1 and add locale support. What’s new:

Translated to Spanish, French, Portuguese and Russian
Groundspeed now loads the form information from the page automatically when the sidebar opens, when the user changes tabs and when a new page is loaded in the current tab
Fixed small bugs in the interface and the decoding/encoding functions

New version coming next week

Felipe — Fri, 15 Jan 2010 01:59:36 +0000

I am currently working on an update for Groundspeed that should be released soon. This upcoming version will fix some bugs and add support to locales. It will support Spanish, French and Portuguese locales, so if you would prefer to use Groundspeed in one of these languages check the site next week!

Also, if you want to help translate Groundspeed into your language contact me by email!