I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
asked Apr 6 '13 at 3:12
There is one for Chrome, released mid-last year, called XSS ChEF. Based on some earlier work finding vulnerabilities in Chrome extensions. Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one.
I haven't used it myself but based on the way it works (it's just a web server), I imagine it's possible to use it to exploit Firefox extensions too or at least to extend it to be able to access Firefox internal state once you have found a vulnerable extension.
BeEF might be a good place to start looking too.
One similar tool is Qualys BrowserCheck but it announces that checks for plugin vulnerabilities and not for extension vulnerabilities. I have tried it and just detects updates for plugins in my case. Remember that, as @Ladadadada has commented, browser plugins and extensions are different elements.
Qualys BrowserCheck will perform a security analysis of your browser and its plugins to identify any security issues.
-
2Plugins and extensions are different things (at least in Firefox). For instance, Flash and Java are plugins, Adblock and NoScript are extensions. I suspect Qualys are only talking about the former. – Ladadadada Apr 6 '13 at 8:21
