Ask HN: Do you have any code or projects of your own you would like to talk about instead?

Re:Ask HN: Do you have any code or projects of your own you ... by tptacek on Wednesday April 29, 2009 @08:52PM (#586186)

Right now (please call me on this sometime, it'd help me) I'm working on a clone of Burp, the industry standard web penetration testing tool, in Cocoa. I started with RubyCocoa, but I've ditched it for Objective C. It is (surprisingly) liberating to work in C after spending a year in Ruby; any time something looks expensive or naive, you just tell yourself, "what I'm doing here can't possibly be more expensive than what MRI Ruby would have done", and you go about your day. Highly recommended.

The last code I managed to publish was Ruckus:

http://github.com/tqbf/ruckus/

(a better description: http://wiki.github.com/tqbf/ruckus/crash-course)

Ruckus is a Ruby DSL replacement for Peach Fuzz, Mike Eddington's famous Python fuzzer library. It is distinguished by being about 100 times slower, using a DSL instead of XML, and providing a DOM-style interface to any packet format (you can tag fields, arbitrarily nested in a tree structure, with classes and id's, and then fuzz them using CSS selectors).

I have a JDWP JVM debugger (or rather a thin protocol driver) written in Ruckus if anyone's interested in seeing what it actually looks like. We never get to publish the actual protocols we build with this.

My programming "day job" (I'm one of 4 developers on the project) is Playbook:

http://runplaybook.com

[ Parent | on HN ]

Re:Ask HN: Do you have any code or projects of your own you ... by yan on Thursday April 30, 2009 @07:45AM (#586694)

Never had I felt more like I was tricking software into doing what I want to do than when I was trying to use Peach. I mean Michael's a nice guy, but you email the peachfuzz list or him personally on issues you're having and he convinces you that it's you not using the tool correctly and that you really don't want the feature you're asking. Modifying code was hellish because it's just thousands of lines of kludge, written as far from Python's usual styles as possible.

Good stuff on the Burp clone. Any plans to publish it eventually?

As for me, the last project I was working on is a complex structure analyzer plug-in for HexFiend along with basic plug-in functionality to support it.

[ Parent | on HN ]

Re:Ask HN: Do you have any code or projects of your own you ... by tptacek on Thursday April 30, 2009 @11:47AM (#586955)

I'm planning on wiring Ruckus into Hexfiend, so you can highlight hex characters Ethereal-style and using CSS selectors from packet formats.

I don't know what I'm going to do with the Burp clone, but if you ask me for it, I'll hand it over. =)

[ Parent | on HN ]

Re:Ask HN: Do you have any code or projects of your own you ... by yan on Thursday April 30, 2009 @11:56AM (#586967)

I'd like to take a look at the burp clone, not sure if I'll contribute.

Do you want help on wiring to hexfiend?

[ Parent | on HN ]

Re:Ask HN: Do you have any code or projects of your own you ... by tptacek on Thursday April 30, 2009 @01:55PM (#587137)

I just used RubyCocoa, but I haven't done much of the UI stuff yet. My contact info's in my profile, though.

[ Parent | on HN ]