TamperData a free Firefox Plugin to test Server Side Validation

A few of my co-workers were asking me how I keep finding bugs in the server side validation, when they can’t reproduce the error at all via the GUI layer. What I told them was about a plugin I use(there are many more similar to this) called TamperData.

TamperData is a free plugin that allows you to monitor,intercept and transform HTML posts after they have been posted by your browser. This will allow you to see how your data is being sent, and override any client side validations that you were imposing.

Many untrained or newer developers put a lot of validation into a UI product via the UI layer such as Javascript, or simple HTML/CSS limitations. What they forget to do is put the same validation in the object to provide safety from such things as XSS Script inject, SQL Injection, Method Overloads, and other types of malicious or just incorrect data that the system was not ready to handle properly.

Below are a few screen shots on the free plugin. You can download it here.

Main Window

ConfirmationTamper window with context menu.


3 thoughts on “TamperData a free Firefox Plugin to test Server Side Validation

  1. Jeremy Sloan says:

    At a very quick glance (from my phone at the airport), this looks a lot like what WebScarab can do. Is it the same kind of thing?

  2. Chris says:

    Actually yes. A few other tools do the same thing as well like Paros. I been using TamperData for a year or two now, and I just loved its simplicity and its integration to Firefox. So when I talked to people at the conference and realized so many people don’t even know about these tools, I figured I’d throw a quick blog post about it.

  3. […] TamperData a free Firefox Plugin to test Server Side Validation October 2010 2 comments 5 […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: