Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any free tools available that let me intercept and modify HTTP requests for testing?

I am looking for tools which allow me to send custom HTTP headers.

share

locked by AviD Nov 11 '12 at 7:13

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

comments disabled on deleted / locked posts

13 Answers 13

up vote 17 down vote accepted

I personally am partial to Fiddler, a free download from MS.
There are many other decent interactive http proxies, but that one serves me the best.

share
add comment

As mentioned above, there are a number of HTTP proxies that allow intercepting and modifying requests and responses.

Here is a list of the ones I know about:

  • WebScarab (disclaimer: I wrote it)
  • Paros
  • Burp
  • ZAP (Z Attack Proxy - an updated version of Paros)
  • Fiddler/Fiddler2
  • Achilles
  • HTTPush
  • Exodus (disclaimer: I wrote it, and it is really old)

If you wish to write your own intercepting proxy, you might like to take a look at OWASP Proxy, a Java library that implements all the necessary HTTP protocol functionality so you don't have to.

share
add comment

A while ago I used the Tamper Data Firefox Add-on and found it to be quite effective. It has some good features like being able to choose what requests you wish to tamper with and also has some predefined exploits that you can use to populate field values with.

alt text

share
add comment

Burp now rocks. Portswigger has made some excellent developments in the last 2 years. From the website, Burp can:

  • Intercept and modify all HTTP/S traffic passing in both directions.
  • Easily analyze all kinds of content, with automatic colorizing of request and response syntax, rendering of web content, and parsing of serialization schemes like AMF.
  • Apply fine-grained rules to determine which requests and responses are intercepted for manual testing.
  • View all traffic in the detailed proxy history, with advanced filters and search functions.
  • Send interesting items to other Burp Suite tools with a single click.
  • Save all of your work, and resume working later.
  • Quickly search and highlight interesting content within HTTP messages.
  • Work with custom SSL certificates and non-proxy-aware clients.
  • Define rules to automatically modify requests and responses without manual intervention.

And I would definitely recommend the entire burp suite!

share
add comment

You can use the Firefox add-on Live HTTP Headers so you can view and replay them.

share
add comment

Paros and Burp are the 2 most common open-source options. There is a commercial version of Burp available as well. They are both written in Java.

share
add comment

The Fiddler HTTP debugging proxy has been around for years and is actively maintained. It allows for interception and modification of traffic, crafting custom requests, replaying requests, and is fully scriptable and extendable. It's a Windows-only tool.

It also has extensions for passive and active security testing. Disclaimer - I co-authored those.

share
    
Hey Chris, Thanks for that! Watcher ROX! –  AviD Dec 6 '10 at 18:54
    
Ah thanks for the props, feature requests, bugs, and new ideas for security checks are always welcome! –  Weber Dec 6 '10 at 20:57
add comment

Paros Proxy and Burp both function as proxies, allowing you to intercept and modify HTTP requests and responses.

share
add comment

Owasp has released a tool called Web Scarab

share
add comment

I've used Paros, webscarab and burp extensively and burp wins hands down. There is a free version, but the full version is also very good value at £150/year.

share
add comment

An rare occasions, I've had to use wfetch (another free download from MS), to handle raw bytage over the HTTP stream. The specific problem being that almost all other tools, especially proxies and browser plugins, necessarily URL-encode any non-printable characters... and sometimes, you just really want to send that chr(9)....

share
    
Burp Suite will let you turn off the auto-encoding of those metacharacters –  atdre Nov 15 '10 at 5:47
    
@atdre, really? You can send e.g. raw NULL bytes? Hadn't seen that... Might go back to Burp sometime, it's been a while... Thanks for that –  AviD Nov 15 '10 at 7:05
add comment

I like MITM Proxy: http://mitmproxy.org/

(Careful, there's another project with the same name.)

It has a really lean, interfaces (looks like ncurses), if you like that sort of thing. It has the same capture/view/edit/replay capabilities as many others, but it's very keyboard-friendly. It can also proxy SSL connections!

share
add comment

Just to add (as it seems to have been missed so far) that if you're using Firefox, there's a collection called "Samurai Web Testing Framework" created by Raul Siles that comes with all cool webapp-sec related plugins included in the collection - https://addons.mozilla.org/en-US/firefox/collections/rsiles/samurai/.

share
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.