We will also make a separate Google Chrome profile for the proxy settings. To allow easy configuration and management of proxies, we will be using the FoxyProxy add-on by FoxyProxy. In this tutorial we will show you how to configure Google Chrome to proxy through Burp Suite. OWASP Top Ten Secure Development Training.

Migrate an App Securely to Cloud Computing.Deploy Rugged Code Rapidly with DevSecOps.Today, it's something that everyone believes is a serious problem to look out for and the awareness of the issue has led to tons of critical bugs being fixed. Once I released the service and tooling, security researchers started finding and reporting blind XSS all over the place. 'These opinions were, of course, because nobody was looking for it, so nobody was finding it. I'd hear things like 'I'm sure that theoretically could happen, but I've never seen it' and 'I don't think it's actually exploitable'. 'Before I released the tool and made it easy-to-use and generally-available, most people I talked to didn't even believe that blind XSS was a real concern. 'A real-world example of this is another tool I wrote for finding blind cross-site scripting (XSS) vulnerabilities called XSS Hunter,' Bryant said. This includes tools like Modlishka, Facebook's Weasel, Metasploit, and more. While the information security (infosec) community might react negatively to 'offensive hacking tools' being released once in a while, Bryant says they have their roles. IT admins can use Chrome Galvanizer to allow or block Chrome extensions from accessing certain URLs and the data associated with it. Named Chrome Galvanizer, this is a web-based tool that generates enterprise policies that can be installed on all of a company's workstations. Besides providing the pen-testing tool, the researcher has also provided the solution in the form a second project that he also open-sourced on GitHub. The researcher says that by using something like CursedChrome, pen-testers can show companies exactly how vulnerable they truly are when they don't strictly control what employees can install in their browsers.īut Bryant isn't the type to point the finger at a problem and make some noise. 'It's important to raise awareness of just what level of access you're granting when you install a random extension for your browser,' Bryant told ZDNet. An employee who ignores company rules and installs a malicious extension can create a hole in their company's defenses, allowing hackers to bypass firewalls or VPN filters. Nowadays, as most companies use more and more web-based tools, browser extensions are more important than ever.

Google chrome extension proxy