WebApp Sec: Re: Any special tool for testing a web chat application?

[Steve Pinkham <steve.pinkham () gmail com>]

Burp proxy has a built in REGEX based search and replace we often use to 
do on the fly injections.
A search string like:
XSS(.*?)XSS
and and output string like:
(stored "web bug" type xss to steal cookies here)$1

which will match XSSmyidentifierXSS, and then replace that with:
(stored "web bug" type xss to steal cookies here)myidentifier

A very simple way to do many injections semi-automatically when you 
control the input.  Otherwise, you have to write more complicated regexs 
or parsers in a plugin facility like Rogan mentioned.
Steve
--
 | Steven E. Pinkham                      |
 | GPG public key ID CD31CAFB             |

-------------------------------------------------------------------------
Sponsored by: Watchfire 
Methodologies & Tools for Web Application Security Assessment 
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today! 

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------