Ratproxy - A Passive Web Application Security Assessment Tool

Ratproxy is a semi-automated, largely passive web application security audit tool, optimized for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments.

Ratproxy also detects and prioritizes broad classes of security problems, such as dynamic cross-site trust model considerations, script inclusion issues, content serving problems, insufficient XSRF and XSS defenses, and much more.

Ratproxy is a local program designed to sit between your Web browser and the application you want to test. It logs outgoing requests and responses from the application, and can generate its own modified transactions to determine how an application responds to common attacks.

    The list of low-level tests it runs is extensive, and includes:
    potentially unsafe JSON-like responses
    bad caching headers on sensitive content
    suspicious cross-domain trust relationships
    queries with insufficient XSRF defenses
    suspected or confirmed XSS and data injection vectors

Installation:
OpenSuSe user can install Ratproxy using "1-click" installer - here

Running  Ratproxy:

# ratproxy -v /tmp/ -w ratlog.txt -d hell.com -lfscm
ratproxy version 1.58-beta by
[*] Proxy configured successfully. Have fun, and please do not be evil.
[+] Accepting connections on port 8080/tcp (local only)...

-d parameter tells ratproxy to run tests only on URLs at the specified domain, so it won't accidentally test a site your application links to for images or advertising.
-v parameter tells it where to write trace files.
-w parameter indicates where log records should be written.

Once the proxy is running, you need to configure your web browser to point to the appropriate machine and port (8080) it is advisable to close any non-essential browser windows and purge browser cache, as to maximize coverage and minimize noise.

The next step is to open the tested service in your browser, log in if necessary, then interact with it in a regular, reasonably exhaustive manner: try all available views, features, upload and download files, add and delete data, and so forth - then log out gracefully and terminate ratproxy with Ctrl-C. 

Generating  Ratproxy Report:

Once the proxy is terminated, you may further process its pipe-delimited (|), machine-readable, greppable output with third party tools if so desired, then generate a human-readable HTML report:

# ratproxy-report.sh ratproxy.log >report.html

This will produce an annotated, prioritized report with all the identified issues.