Firefox for Security Researchers: Burp Suite, XSS Testing, Certificate Analysis, Privacy Auditing

Firefox has become a go-to browser for security researchers, penetration testers, and privacy advocates. Its open architecture, powerful DevTools, extension ecosystem, and commitment to web standards make it well-suited for security work. Here's how security professionals use Firefox effectively.

Why Security Researchers Prefer Firefox

• Open source: mozilla-central is publicly auditable; security researchers find and report bugs
• Independent certificate store: doesn't inherit corporate MITM certs unless explicitly configured, so you see what's actually there
• Strict CSP enforcement: finds CSP misconfigurations that Chrome's more lenient behavior masks
• uBlock Origin at full capability: MV2 extensions can intercept/block at the network level
• Proxy support: native SOCKS5+DNS, per-browser proxy config (doesn't inherit system proxy)
• Private browsing: no telemetry in private mode, no third-party cookies

Configuring Firefox for Security Research

Essential about:config changes for research work:

security.OCSP.require = false    (don't fail on OCSP timeouts during offline research)
network.proxy.socks_remote_dns = true   (DNS through SOCKS to prevent leaks)
dom.security.https_only_mode = false    (allow HTTP when testing HTTP-only apps)

Disable Safe Browsing for offline work (Safe Browsing sends URLs to Google for checking):

browser.safebrowsing.malware.enabled = false
browser.safebrowsing.phishing.enabled = false

Note: only disable safe browsing in isolated VMs used for malware analysis, not your daily driver.

Burp Suite Integration

Burp Suite is the standard proxy for web app security testing. Firefox integration:

1. Set Firefox proxy: Settings → Network Settings → Manual → HTTP Proxy: 127.0.0.1:8080
2. Navigate to http://burp in Firefox → download Burp's CA cert
3. Settings → View Certificates → Authorities → Import → select the cert → trust for websites
4. Burp now intercepts all Firefox HTTPS traffic

For per-project configs, use FoxyProxy to switch between Burp proxy and direct connection per URL pattern.

OWASP ZAP Integration

OWASP ZAP is an open-source web app scanner:

1. ZAP → Tools → Options → Dynamic SSL Certificates → Generate → Save
2. Firefox → Import that cert as a trusted CA
3. Set Firefox proxy to ZAP's proxy address (default: 127.0.0.1:8080)

ZAP's passive scanner analyzes traffic as you browse; active scanner auto-sends attack payloads.

Cookie and Session Analysis

Firefox's Storage Inspector (DevTools → Storage tab) shows:

• All cookies for the current origin (session, persistent, httpOnly, Secure flags)
• LocalStorage and SessionStorage
• IndexedDB contents
• Cache entries

For cookie security testing, look for:

• Missing HttpOnly flag → cookie accessible via JavaScript (XSS risk)
• Missing Secure flag → cookie sent over HTTP
• Missing SameSite attribute → CSRF risk on older endpoints
• Overly broad domain scope (Domain=.example.com)

XSS Testing in Firefox

Firefox handles some XSS vectors differently from Chrome. Both should be tested:

DevTools Console: test JavaScript injection directly

// Test if inline event handlers work (CSP check)
document.body.innerHTML = '<img src=x onerror=alert(1)>'
// Test for DOM-based XSS via URL fragments
location.hash = '#<script>alert(1)</script>'

Firefox's stricter CSP enforcement means a CSP bypass that works in Chrome may not work in Firefox — and vice versa.

Network Traffic Analysis

Firefox DevTools Network tab for manual traffic inspection:

• Filter by type: XHR/Fetch, JS, CSS, Doc, WS (WebSocket)
• Copy as cURL: right-click any request → copy as cURL with all headers
• Edit and Resend: right-click → Edit and Resend → modify request and replay
• HAR Export: save entire session as HAR file for offline analysis

For WebSocket analysis: filter by WS type → click the WebSocket connection → Messages tab shows all frames in both directions.

TLS and Certificate Analysis

Firefox's Security tab in DevTools (available per-request in Network tab → click request → Security tab) shows:

• TLS version negotiated
• Cipher suite
• Certificate chain
• Whether HSTS is active

For deeper certificate analysis: address bar → padlock → Connection Secure → More Information → Security → View Certificate.

Check for:

• Unexpected certificate issuers (MITM detection)
• Certificate transparency logs (crt.sh)
• Expired or soon-to-expire certs
• Weak cipher suites (RC4, DES — Firefox blocks these by default now)

Extension Security Testing

Firefox extensions are easier to inspect than Chrome extensions because AMO requires unobfuscated source code:

1. Firefox → Add-ons (about:addons) → extension page
2. "Source Code" link on the AMO listing → browse the source on AMO
3. Or: find the extension XPI file in ~/.mozilla/firefox/PROFILE/extensions/ and unzip it

Look for:

• Content scripts that run on all pages (matches: ["<all_urls>"])
• Broad permissions in manifest.json
• External script loading
• Data exfiltration via background script

Privacy Analysis

Firefox's Developer Tools + extensions make it excellent for privacy analysis:

Ghostery or uBlock Origin logger shows all third-party connections a site makes.

Lightbeam for Firefox: visualizes third-party tracking connections across sites you visit.

DevTools Network filter for tracking: filter by third-party or search for known tracker domains (doubleclick.net, google-analytics.com).

WebRTC leak testing: Firefox's WebRTC can expose local IP even through a VPN. Test at ipleak.net with and without VPN. In about:config, set media.peerconnection.enabled = false to disable WebRTC completely.

Isolated Testing VMs

For malware analysis or high-risk security testing, run Firefox in an isolated VM:

• Snapshot the clean state
• Perform analysis
• Revert snapshot to clean state
• Firefox profiles within the VM are disposable

Firefox's portable mode (running from a USB drive or temp directory with a custom profile) also works for isolated testing without affecting your main installation.