This is like taking the safety bracket off of your chainsaw. Don’t use the browser for regular browsing.Take that into consideration when determining actual risk. Remember that some flaws you find may be partially or wholly mitigated by the browser controls that you have disabled.When you disable automatic updates, you have to update stuff on your own!.With a few quick tweaks of the Firefox preferences & configuration, you can simplify your testing in the future.īefore we get to that though, there are a few important things to remember. It turns out that most, if not all, of these requests can be disabled. I did some searching on the listed URLs and perused through Firefox’s help section.

The following lists the domain requests that were found. The unwanted requests also greatly increase the size of the Burp project files.Īfter a recent test, I deleted all of customer-specific URLs that had been requested in Burp and then listed all of the Mozilla/Firefox-specific URLs. Even if you’ve learned to use the scope limiting tools in Burp, that doesn’t help with proxy interception. If you regularly test with Firefox and Burp, then you’re familiar with the constant barrage of unwanted requests. But that pales in comparison to the number of requests when you’re actually using the browser. With absolutely no user interaction, the browser averages 200-300 requests per day. Just for fun, I started Firefox with nothing but a blank page open and the proxy settings configure to pass through Burp Suite Pro. It’s possible to ignore them, but it turns out that it’s also really easy to disable most of that traffic.

When using Firefox for web app testing, I’ve often noticed the constant stream of additional requests that get in the way. Firefox is one chatty browser! Even if you don’t actually use it for anything, it’s constantly making requests out to the internet for things like updates, checking network status, and sending telemetry data back to Mozilla.

Mozilla firefox homepage url