July 7, 2008
Google Ratproxy – Part 1 (Building Ratproxy in Windows)
Recently, I have been studying web application security and some of my research led me to Ratproxy. Ratproxy is a web application security audit tool recently released by Google. In this post I will show you how to install Ratproxy in a Windows environment.
What you will need:
- In order to run ratproxy in a windows environment you will need Cygwin (http://www.cygwin.com/).
- The current Ratproxy release — http://code.google.com/p/ratproxy/.
Installing Cygwin:
From the Cygwin home page (http://www.cygwin.com/).:
- Select the “Install or update now!” link to download the Cygwin setup.
- When the download is complete run setup.exe.
- Select “Install from Internet” > Next.
- The next few screens are self explanatory. You will choose your installation directory (the default is fine) and a few other options (all of the default options should be fine).
- After you choose a mirror the download will begin. After the download is complete you will be presented with a screen prompting you to select the packages you would like to install. VERY IMPORTANT– There are a few utilities required to build Ratproxy that are not installed by default by the Cygwin installer.
- make – Located in ‘Devel’.
- gcc-core – Also located in ‘Devel’.
- openssl-devel – Also located in ‘Devel’.
- openssl (The OpenSSL runtime environment) – Located in ‘Libs’ or ‘Net’.
The preceding four packages must be installed or you will not be able to build or run Ratproxy. Make sure they are not being skipped (there should be an X in the box next to each item).
Building Ratproxy:
Once Cygwin is installed with all of the required packages you are ready to build Ratproxy.
- Unzip Ratproxy into your Cygwin directory (c:\cygwin).
- Modify the make file packaged with Ratproxy – The Ratproxy Makefile contains a flag that is not compatible with the compiler installed with Cygwin. This can be fixed by making a small modifcation to Makefile.
- Open Makefile (located at the root of your Ratproxy install).
- Look for this line — CFLAGS = -Wall -O3 -Wno-pointer-sign -D_GNU_SOURCE
- Remove -Wno-pointer-sign
- Flare-dist – Now you need to download the Flare action script decompiler for Windows. From the Ratproxy root open the flare-dist directory. Directions for downloading the Flare action script decompiler are in the README file. Download the distribution at http://www.nowrap.de/download/flare06doswin.zip. Then unzip the file into Ratproxy/flare-dist. You should now have a file called flare.exe (remove the file that was distributed with Ratproxy — flare with no extension).
- Make Ratproxy – Now we are ready to make Ratproxy.
- Open your Cygwin bash shell (by selecting your Cygwin shortcut or by running Cygwin.bat).
- Navigate into the Ratproxy directory – At the command prompt enter ‘cd /ratproxy’ (remember we saved Ratproxy at our Cygwin root).
- Run make – At the command prompt enter ‘make’
The affected portions of the Makefile should now look like this:
PROGNAME = ratproxy CFLAGS = -Wall -O3 -D_GNU_SOURCE LDFLAGS = -lcrypto -lssl
The ‘make’ command should run and complete successfully. You will be left with a compiled ratproxy.exe in your Ratproxy directory. Important: In order to run Ratproxy you will need to make sure the Cygwin/bin directory is in your Windows path (else the exe will blow up when you run it).
To add the Cygwin libraries to your Windows path (in Vista).
- Right-click the ‘My Computer Icon’ and select ‘Properties’.
- Select ‘Advanced system settings’ and then select the ‘Environmental Variables’ button.
- Find the ‘Path’ variable under ‘System variables’ and select the ‘Edit’ button.
- Append ;C:\Cygwin\bin to the ‘Variable value’.
You can now use that executable to run Ratproxy according to the documentation on the Ratproxy site. That is all for this post in part two I discuss running Ratproxy.
21 responses to “Google Ratproxy – Part 1 (Building Ratproxy in Windows)”
Leave a Reply
You must be logged in to post a comment.
When i run make Command the EXE is generating, but when i run the exe from windows command prompt it gives me a error cygcrypto-0.9.8.dll Not found, but this dll exists in bin directory.
Any Idea why this is happening
Thanks
Srinivas
Yes. From the post:
“Important: In order to run Ratproxy you will need to make sure the Cygwin/bin directory is in your path (else the exe will blow up when you run it).”
Excellent guide, thanks 🙂
Glad it helped!
I have successfully created ratproxy.exe file using above stated steps. But when I tried to run the ratproxy.exe, I get following error:
“The procedure entry point _getreent could not be located in the dynamic link library cygwin1.dll”
I have installed latest version of both ratproxy and cygwin. Plz help me
Ashok,
You need to make sure that ratproxy was compiled with the same version of cygwin that you are attempting to run it with. My guess is that you compiled ratproxy on one machine and moved it to another machine with a different version of cygwin.
Hi ,
I need assistance in analyzing the report generated . I have tried out ratproxy tool on https://docs.google.com .
I followed the above instructions in generating the report.html file . But I am not able to decide about which are of high priority issues. As this report contains many issues as high , medium & low . I need a way to figure out which exactly is a high priority security issue .
Some of the issues in the report.hmtl I was able to generate is posted here .. Please help me in this regard as I need to use this tool for my application.
Markup in dynamic Javascript [toggle]
Section hidden
Code that resembles JSON responses or other dynamic code snippets, and quotes non-escaped HTML. If this rendered markup is attacker-controlled, content sniffing in Internet Explorer may potentially kick in and trigger XSS flaws, regardless of MIME type used.
My first recommendation would be to familiarize yourself with web security issues. From the RatProxy docs look at the following section – “How to interpret and address the issues reported?”. This section lists a few sites that you can visit to read about issues you should be aware of.
I think the error you have attached is pretty self explanatory. You have a snippet of code that includes HTML mark-up that is not escaped.
WOW.
So after trying to patch the makefile to run on gcc <4, and a hundred other things, I come to your site.
Perfect.
Not just informative, well written (which I assure you is a rarity for tech articles). Great job.
Thanks for the kind words. I appreciate them. I am glad the post was helpful to you.
Not that I’m impressed a lot, but this is a lot more than I expected for when I found a link on Delicious telling that the info here is quite decent. Thanks.
Да,согласен с предыдущими блоггерами
Споки 🙂
Хм,несогласен с предыдущими высказываниями
^..^ Bye
Отлично,согласен с предыдущими неудачниками
) Bye
Молодца,согласен с предыдущими ораторами
) 🙂
Вот так,согласен с предыдущими ораторами
) 🙂
Hi,
I am getting the following error wehn running make:
Administrator@cisampsensor1 /cygdrive/d/apps/cygwin/ratproxy
$ make
cc ratproxy.c -o ratproxy -Wall -O3 -D_GNU_SOURCE http.c mime.c ssl.c -lcrypto
-lssl
make: cc: Command not found
make: *** [ratproxy] Error 127
cygwin\bin is already in the system environment path variable. Thanks for your helf.
-Sri
Sri,
You need a c compiler in order to make ratproxy. Please re-read the post. I have pasted the relevant section below:
After you choose a mirror the download will begin. After the download is complete you will be presented with a screen prompting you to select the packages you would like to install. VERY IMPORTANT- There are a few utilities required to build Ratproxy that are not installed by default by the Cygwin installer.
1. make – Located in ‘Devel’.
2. gcc-core – Also located in ‘Devel’.
3. openssl-dev – Also located in ‘Devel’.
4. openssl (The OpenSSL runtime environment) – Located in ‘Libs’ or ‘Net’.
Hi David,
Thanks for the speedy reply. I did choose all the utilities specified when I downloaded cygwin. Guess I’ll try to download again.
-Sri
Success. I reinstalled and reselected all the required packages and everything was fine. Thank you for the excellent guide and response.
Regards,
-Sri
[…] (http://code.google.com/p/ratproxy/) and Build (http://www.butterdev.com/web-security/2008/07/google-ratproxy-web-application-security-audit-tool/) […]