mailing list archives
[tool] ratproxy - passive web application security assessment tool
From: Michal Zalewski <lcamtuf () dione cc>
Date: Wed, 2 Jul 2008 02:02:02 +0200 (CEST)
I am happy to announce that we've just open sourced ratproxy - a free,
passive web security assessment tool. This utility is designed to
transparently analyze legitimate, browser-driven interactions with tested
web applications - and automatically pinpoint, annotate, and prioritize
potential flaws or areas of concern on the fly.
The proxy analyzes problems such as cross-site script inclusion threats,
insufficient cross-site request forgery defenses, caching issues,
potentially unsafe cross-domain code inclusion schemes and information
leakage scenarios, and much more.
For a detailed discussion of the utility, please visit:
Source code is available at:
And finally, screenshot of a sample report can be found here:
The tool should run on Linux, *BSD, MacOS X, and Windows (Cygwin). Since
it is in beta, there might be some kinks to be ironed out, and not all web
technologies might be properly accounted for. Feedback is appreciated.
Please keep in mind that the proxy is meant to highlight interesting
patterns in web applications; a further analysis by a security
professional is required to interpret the significance of results for a
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- [tool] ratproxy - passive web application security assessment tool Michal Zalewski (Jul 02)