Confirmed users
81
edits
Security/Plug-n-hack: Difference between revisions
no edit summary
(Added content on pnh plans) |
No edit summary |
||
| Line 9: | Line 9: | ||
* Phase 1 (q2/3 2013): | * Phase 1 (q2/3 2013): | ||
** Allow a browser to be configured to use a security tool with minimal effort | ** Allow a browser to be configured to use a security tool with minimal effort | ||
*** Proxy configuration | |||
*** Proxy certificate import for SSL termination | |||
** Allow tool configurations to be managed | ** Allow tool configurations to be managed | ||
** Allow tool functionality to be exposed via browser UI | ** Allow tool functionality to be exposed via browser UI | ||
| Line 14: | Line 16: | ||
* Phase 2 (q3/q4 2013): | * Phase 2 (q3/q4 2013): | ||
** Provide some access to the DOM from external security tools via a probe (e.g. injected via bookmarklet or by a security proxy) | ** Provide some access to the DOM from external security tools via a probe (e.g. injected via bookmarklet or by a security proxy) | ||
*** Document load / reload in place | |||
*** PostMessage interception / replay | *** PostMessage interception / replay | ||
**** window.postMessage proxying via javascript for on-origin iframes | |||
**** DOM manipulation for iFrame replacement with postMessage proxying for off-origin iframes | |||
*** Event inspection | *** Event inspection | ||
* Phase 3 (q4 2013): | * Phase 3 (q4 2013): | ||
** Define configurations and interfaces for browser | ** Define configurations and interfaces for in-browser versions of the existing probe functionality | ||
** | ** Experiment with event manipulation and replay | ||
** Experiment with ringleader impl of interface and configuration | |||
* Phase 4 (q1 2014) | |||
** Fuzzing via event record and replay | |||
** Remote probe configuration | |||
*** Enable / disable monitoring / interception | |||
'''Tool support''' | '''Tool support''' | ||