How to Setup RatProxy on Windows

In an effort to help developers and other windows users get started adding security testing into their process, this post will describe the process to install Ratproxy on Windows.  Ratproxy is an interception tool that is used to inspect web traffic and identify potential security vulnerabilities.

Ratproxy is distributed as code and needs to be compiled before we can run it.  In the windows environment, this is done by installing Cygwin (http://www.cygwin.com).  Once Cygwin has been installed, RatProxy can be compiled and then used.  If you already have Cygwin installed, you can skip to the next section.

Installing Cygwin
The following steps outline how to install cygwin on a Windows system:

1. Download the Cygwin installer from http://www.cygwin.com.
2. Unzip the installation package (may require a program such as 7-zip).
3. Run the Setup.exe installer.
4. Follow the on screen prompts, using the default is fine, until the Utilities screen appears.  Select the following packages:
1. Select make from the devel package.
2. Select gcc-core from the devel package.
3. Select openssl-devel from the devel package.
4. Select openSSL (The Open SSL runtime environment) from the Libs package.
5. Complete the installation.  This may take some time as it downloads all of the packages needed.

UPDATE – 8/22/12:  For a video walk through of installing cygwin go to http://www.youtube.com/watch?v=zRbbDkDb5UM&feature=plcp

Installing RatProxy
To install RatProxy follow these steps:

1. Download the package from http://code.google.com/p/ratproxy/.  
2. Unzip the downloaded RatProxy distribution file into the Cygwin directory.  If cygwin was installed to C:cygwin then RatProxy should be unzipped to C:cygwinratproxy. 
3. Update Flare (used to decompile flash objects):
1. For the latest instructions open the readme file in the RatProxyflare-dist directory. 
2. Open the URL for the Windows distribution and save the file.  
3. Unzip the file into the RatProxyflare-dist directory. 
4. Modify the Makefile (C:cygwinratproxymakefile) and remove the “-Wno-pointer-sign” from “CFLAGS = -Wall -03 -Wno-pointer-sign -D_GNU_SOURCE”
5. Save the Makefile file.
6. Open a Cygwin bash by double-clicking the C:cygwinCygwin.bat file.
7. Navigate to the ratproxy directory.  If installed at C:cygwinratproxy, type cd ../../ratproxy and press enter.
8. type make and press enter.
1. If you receive an error that looks like this: “ratproxy.c:1635: error: incompatible type for argument 2 of ‘waitpid'” the ratproxy.c file needs to be modified.
2. Open ratproxy.c and modify line 1635 “while (waitpid(-1,&x,WNOHANG) > 0);” to be “while (waitpid(-1,(int*)&x,WNOHANG) > 0);“.
3. run the make command again. This should run successfully.
9. Add cygwin to your path.
1. Right-click “My Computer” and select “Properties”.
2. Select “Advanced system settings” and then select “Environmental Variables”.
3. Find the “Path” variable under “System Variables” and edit it.
4. Add “;C:Cygwinbin” (without the quotes) to the end of the “Variable Value”.

At this point, RatProxy should be installed and ready to run.

Running RatProxy

1. Open a command shell (cmd.exe, not the cygwin bash).
2. Navigate to C:cygwinratproxy (or the path that ratproxy was installed to).
3. type the following at the command prompt: ratproxy.exe -v C:cygwinratproxy -w ratproxy.log -p 8080 -lextifscijmXC
4. To quit RatProxy, press Ctrl+C.

Once RatProxy is running, change your browser to go through the proxy just created on port 8080.  Now all traffic that is passed through the browser will go through RatProxy.  Once finished testing, enter Ctrl+C at the command prompt to stop RatProxy.

Creating the RatProxy Report

1. Go back to your bash shell, or open it if hasn’t been started.
2. Navigate to the ratproxy directory.
3. type ./ratproxy-report.sh ratproxy.log > report.html and press enter
4. Now open the ratproxy folder in an explorer window and open the report.html file.  This should contain the results of your testing.

Although it may seem like a lot of work getting this up and running, it can be very beneficial to increasing the security of your applications.  Developers can now run ratproxy while they test their new features and get some feedback on potential security issues just by doing normal testing.  Of course, this does not cover all vulnerabilities and security testing still needs to be performed, but it is a step in the right direction and will help reduce possible vulnerabilities.