I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is there a tool that I should use (or shouldn't use) specifically when looking at rogue HTTPS source code?
Yes, modern browsers such as Firefox, Chrome do make a second requests if you view source. And that does mean the source may be different from the one that is being displayed.
If you want the original source, you should use some add-on such as web developer toolbar (https://addons.mozilla.org/en-US/firefox/addon/60). Then use View Generated Source.
The safest way to pull source code for a website is with a client that can't render/execute the content that comes down.
You want to look for something that simply pulls data -- like netcat, or curl, or a custom script/application that makes raw HTTP requests.
But again, the key is to use something that is impervious to the downloaded content because it doesn't understand it.
It depends on which level you want to see the source code.
Firefox's View Source gives you the source code as seen by the render engine; unfortunately, FF itself applies a few transformations before the render engine gets to see it, and there's some caching involved, so it's not always reliable.
Tools like curl and wget will show you the exact response at the HTTP level (including HTTP headers, if you ask for them). This is usually good enough, and they'll transparently handle HTTPS for you so you don't have to worry about the SSL part of the protocol.
If you want to dive a bit deeper, try netcat or telnet - these basically give you a byte-stream connection to the server, allowing you to type (or pipe) HTTP requests directly, and view the raw response. The downside is that if you violate the protocol, you'll be kicked out of the connection.
To go yet a level deeper, consider a network sniffer - wireshark is excellent, but fairly complex; it will give you the raw packets as well as their contents at different levels of the network stack.
On Firefox I use Firebug for that. F12 activates firebug.
On Chrome there is a built in "Tools for developers" Ctrl+Shift+I or menu->Tools -> "Tools for developers".
Both can display current DOM tree (modified by scripts) as well as raw HTTP requests and responses.
Malzilla is a Swiss army knife when it comes to dissecting foreign code in Windows . Not only can it view source, but it can help someone de-obfuscate "funny" javascript code.
If you're worried that View Source gets you something else than actually goes over the wire, I highly recommend Fiddler: it's a capturing HTTP(S) proxy that sits between your browser and the network, and shows you the actual requests and responses before the browser gets to them (thus, you're seeing the exact same data as the browser, without any additional requests). It has various tools to analyze the content, including viewing the source.
Out of curiosity where did you hear that?
My understanding was that all browsers viewed the source of the cached file. But since Firefox uses a custom protocol for viewing source, it may be possible to view the source of a file that isn't cached, so it would need to make a request for it.
Ctrl + U is the easiest way to view website source code! In firefox browser.
chrome and firefox does if you open it in a new tab. The live editors doesn't (F12/right click in chrome). Safari doesn't - but it doesn't format the source either (like old IE).
