Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm doing some testing on my web app with Tamper Data. I've had success with Tamper Data in the past for normal HTTP post requests, but in this particular case I want to modify a post request that that has the content-type set to multipart/form-encoding.

Tamper Data shows this request as one big blog of messy escaped-ness and the text field is too small to view the entire thing or reasonably edit it. I also tried copying/pasting to a text editor, making changes, then copying/pasting back but I must not be doing something right because the web app isn't acting like it's received any form data.

Is there a setting I'm missing to have tamper data modify multipart requests like this in an easier manner? If not, any tips for doing it by hand? Thanks.

share|improve this question
Can you ask the plugin's author? – logicalscope Dec 28 '11 at 16:56
Thanks, good point. I emailed the plugin's author and will post back if I get a good answer. – mehaase Dec 28 '11 at 22:14
up vote 4 down vote accepted

Usually it is possible to modify the POST request by copy/pasting into a text editor. But not always, I find it will often cause problems when posting JSON. This process can also damage the content-type and content-size, although it usually fixes this for you (but it is unreliable).

In general I find standalone proxies to be easier to use and more powerful. You can also do stuff like modify the entire http request, including the URL, which is something you can't to with tamperdata. The OWASP Zed Attack Proxy or commercial tools like BURP and Charels are all great choices for any pen tester.

share|improve this answer
Yes. Years later, I use MITM Proxy almost exclusively for this type of work. Tamper Data isn't worth the trouble any more. – mehaase Oct 23 '13 at 13:47

According to my experience it works fine (copy/paste and modify and CP again). However i have change only the name of the field to test a path manipulation. And it was a success. You might have issue with your webapp.

share|improve this answer
Thanks. I was actually doing the same (just changing a field name) but I know it's not my web app because I was able to do it correctly with a stand-alone proxy (mitmproxy). – mehaase Dec 28 '11 at 22:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.