|
I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of Greasemonkey to the IT Security Professional? Should IT Security be concerned about the growing use of Greasemonkey and related browser add ons? What mitigations are there? |
|||
|
|
|
Greasemonkey is a useful tool for influencing how a page behaves. From a secuirty perspective Greasemonkey isn't really a tool for auditing, its a tool for leveraging flaws. It can be helpful in leveraging client side trust vulnerabilities, but its not the only way. For instance if your application is performing data validation in JavaScript then another Firefox addon by the name of Tamperdata can also be used. The Firebug addon is probably more useful to IT Security because it allows the user to debug JavaScript which can expose vulnerabilities. |
|||
|
|
|
Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript. It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of anything you have would (possibly) inherently stop it |
|||
|
|
