It downloads the most important extensions, and install it on your browser. The used extensions has been chosen by a survey among the information security community. Based on it's results, Firefox Security Toolkit was made. Also, it allows you to download Burp Suite certificate and a large user-agent list for User-Agent Switcher. Making it one-click away to prepare your web-application testing browser.
OWASP Mantra and Hcon STF are not regularly updated, and needs a lot of work in order to develop and maintain. Meanwhile, Firefox Security Toolkit does not need a additional maintaining, although I would be maintaining it for any issues/bugs if needed. The used extensions are downloaded from Mozilla Addons Store with its latest version, to ensure the best testing experience for the penetration tester.
Web-Application Penetration Testers, Information Security Learners, and basically anyone interested in web-application security.
The project supports Linux/Unix environments.
bash ./firefox_security_toolkit.sh
- Advanced Dork (https://addons.mozilla.org/en-US/firefox/addon/advanced-dork/)
- Cookie Export/Import (https://addons.mozilla.org/en-US/firefox/addon/cookies-exportimport/)
- Cookie Manager+ (https://addons.mozilla.org/en-US/firefox/addon/cookies-manager-plus/)
- Copy as Plain Text (https://addons.mozilla.org/en-US/firefox/addon/copy-as-plain-text/)
- Crypto Fox (https://addons.mozilla.org/en-US/firefox/addon/cryptofox/)
- CSRF-Finder (https://addons.mozilla.org/en-us/firefox/addon/csrf-finder/)
- Disable WebRTC (https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/)
- FireBug (https://addons.mozilla.org/en-US/firefox/addon/firebug/)
- Fireforce (https://addons.mozilla.org/en-US/firefox/addon/fireforce/)
- FlagFox (https://addons.mozilla.org/en-US/firefox/addon/flagfox/)
- Foxy Proxy (https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/)
- Greasemonkey (https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/)
- HackBar (https://addons.mozilla.org/en-US/firefox/addon/hackbar/)
- IP Address and Domain Information (https://addons.mozilla.org/en-US/firefox/addon/ip-address-and-domain-info/)
- JavaScript Deobfuscator (https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/)
- Live HTTP Headers (https://addons.mozilla.org/en-US/firefox/addon/live-http-headers-fixed-by-dan/)
- PassiveRecon (https://addons.mozilla.org/en-US/firefox/addon/passiverecon/)
- Regular Expressions Tester (https://addons.mozilla.org/en-US/firefox/addon/rext/)
- RESTED (https://addons.mozilla.org/en-US/firefox/addon/rested/)
- Right-Click XSS (https://addons.mozilla.org/en-us/firefox/addon/rightclickxss/)
- Shodan (https://addons.mozilla.org/en-US/firefox/addon/shodan-firefox-addon/)
- Tamper Data (https://addons.mozilla.org/en-US/firefox/addon/tamper-data/)
- ThreatPinch Lookup (https://addons.mozilla.org/en-US/firefox/addon/threatpinch-lookup-for-firefox/)
- User Agent Switcher (https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/)
- Wappalyzer (https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/)
- Web Developer (https://addons.mozilla.org/en-us/firefox/addon/web-developer/)
- Downloading Burp Suite certificate.
- Downloading a large user-agent list for User-Agent Switcher.
This project is made for educational and ethical testing purposes only. Usage of Firefox Security Toolkit for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
The project is licensed under MIT License.
Mazin Ahmed
- Website: https://mazinahmed.net
- Email: mazin AT mazinahmed DOT net
- Twitter: https://twitter.com/mazen160
- Linkedin: http://linkedin.com/in/infosecmazinahmed