mozdev.org

• Saturday July 4th 2009
• Do you want fries, a shake, onion rings, salsa sauce with that project? Would you like to supersize?

Skip to Content

tuvbar    

resources:	Home Your Comments Mailing List Installation Source Code Members Bugs Screenshots

TuvBar is a little Security-Menu-Addon for Firebird, which adds a menu to your browser to check site or page-security and configuration.
Unix-Users please scroll down before installing...

Nota bene: This tool is quick and dirty! Don't expect it to do more than to mess up your browser.

Functions
Search-Engines Domain

•     Google-Backlinks - checks backlinks to domain at google
•     Google-Related  -   checks googles "related links" for domain-name
•     AlltheWebUrl-Investigator - checks the domain at the AlltheWeb url-investigator
•     Altavista-Backlinks - does a domainsearch at altavista
•     Inktomi-Backlinks - does a domainsearch at inktomi
•     IxQuick-Results - does a domainsearch at the ixQuick-Metaengine to get an overall-rating

Misc-Domain

•     Archive-Org Archive - checks for archived versions of the domain at archive.org
•     Archive-Org Structure - checks the site structure of archived previous versions
•     Netcraft Similar Domainnames - checks netcraft for similar domainnames
•     Netcraft HTTP-Server-History - checks the server-sistory of domain at netcraft
•     Netcraft HTTPS-Server-History - checks the server-history of domain at netcraft
•     Alexa-Site-Overview - checks the site-stats using the alexa-engine
•     Alexa-Traffic-Details - shows traffic-details for site using the alexa-engine
•     Zone-H Site Hacked - checks, if the domain is in the defaced-sites-archive at zone-h
•     Check-TLD - checks, if other tlds for the domainname are taken/available
•     Class-C-Check - does several Security-Checks for the whole Class-C-Network (you'll have to type the domain-name manually in the textbox)

Network-Tools

•     Traceroute (space-net) - does a traceroute to the server using the standard unix-traceroute at spacenet (hi maex!)
•     Traceroute (dnsstuff) - does an advanced traceroute - sometimes you'll get past firewalls with this
•     DNS-Checks - checks ns- and mx-entries
•     Siteinfo - issues a unix-siteinfo-command
•     MX-Records - shows MX-Records
•     SOA-List - shows SOA-Record
•     ListHosts  - does a unix hosts command
•     DNS-Report - does a complete DNS-report
•     DNS-Traversal - shows a complete DNS-Tree from rootservers up
•     DNS-Time - shows speed of DNS-Queries for NS at domain
•     Response-Time - checks response-time of the site
•     Sam-Spade - shows domain-info from Sam Spade
•     Whisker - does brute-force-browsing with rfp's whisker 1.4
•     Whisker - does brute-force-browsing of ip with rfp's whisker 1.4
•     Call HTTP://IP calls site by its ip-number

Tests

•     various HTML-checks

Source

•     Shows the page-source

Mozilla

•     Cache Memory - shows Firebirds memory-cache
•     Cache Disk - shows Firebirds disk-cache
•     Stake-Proxy - sets proxy-settings to standard stake-proxy port and localhost
•     Paros-Proxy - sets proxy-settings to standard paros-proxy port and localhost
•     Reset Proxy - sets proxy-settings to standard direct connection to internet

Manipulate HTML

•     POST->GET - changes POST-Forms to GET-Forms. Click and then submit the form to see all parameters in the URL (works only if appserver supports this and the transmitted get-data is smaller than a few kb)
•     Outline Block-Elements - outlines blocks
•     Outline Replaced Elements - outlines previously replaced elements
•     Outline Table-Cells - outlines tables and their cells
•     Apply external styles - view the page using an external style-sheet
•     Kill Styles - view the page without using any style-sheet
•     Kill Images - hide all images on the page
•     Kill Event-Handlers - kill annoying javascript-eventhandlers like onmousouver etc.

Show...

•     robots.txt - show robots.txt of domain
•     live-headers - show live-headers
  For the Live-Headers-Function to work you'll need to install the liveheaders-plugin from http://livehttpheaders.mozdev.org/.
  
•     cookiese - shows the site-cookies

    Pagedate - shows the pagedate according to the webserver

User-Agent

•     Mimicks several Useragents (changes the ua-string of Firebird)

I developed and tested with Firebird 0.6 under WinXP/2000 - I don't know if this will work on mozilla or earlier firebird-versions.
The underlying xul, js and installation is mainly stolen from chris cascianos pnhtoolbar.

send feedback, flames and raisins to Thomas Springer

---

Unix-Users: Philip Buehler was kind enough to install it on openbsd an noted:

installing unsigned blabla.. yes
then something in the popup [dis]appears, i cannot read it and then it
'hangs' at tuvbar.xpi - Required file does not exist
(that's an openbsd system) .. hm, apparently it's a permission denied
problem (which is intended to be caught by install.js, but is not :} )
Ok, w/ appr. permissions it works - but i'd only see the toolbar if
firebird is started as root (which is not really what i want :>)
...
ah, found out. /usr/local/mozilla-firebird/chrome/tuvbar.zip is
installed read-only for root, fixing that to readable by world, it
actually works.

I believe this will be an issue for all *nix-users - if anybody has a fix for this prob (should be in install.js, which i stole from Chris Casciano as well), drop me a line.

Maybe a hint from the livehttp-headers-mailinglist will help:

If you aren't root or don't have write permission to the mozilla/components
and to the mozilla/chrome directory, you can install a new Mozilla in you own home
directory.  You will have full access to it and install what you want in this Mozilla.
(This way, you can even try different version of Mozilla at the same time !)

---

Beware: Most tools work remotly on sites that have nothing to do with tuvbar or yourself - all information gathered is publicly available on the web, but you might set somebody's security at risk with supplying the url of a misconfigured site to one of the sites used by tuvbar!
I did my best to choose only "wellknown" sites - but you'll never know.