Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run.

What are the benefits of Greasemonkey to the IT Security Professional?

Should IT Security be concerned about the growing use of Greasemonkey and related browser add ons? What mitigations are there?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Greasemonkey is a useful tool for influencing how a page behaves. From a secuirty perspective Greasemonkey isn't really a tool for auditing, its a tool for leveraging flaws. It can be helpful in leveraging client side trust vulnerabilities, but its not the only way. For instance if your application is performing data validation in JavaScript then another Firefox addon by the name of Tamperdata can also be used.

The Firebug addon is probably more useful to IT Security because it allows the user to debug JavaScript which can expose vulnerabilities.

share|improve this answer
add comment

Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript.

It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving

You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of anything you have would (possibly) inherently stop it

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.