Are there any free tools available that let me intercept and modify HTTP requests for testing?
I am looking for tools which allow me to send custom HTTP headers.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I personally am partial to Fiddler, a free download from MS.
There are many other decent interactive http proxies, but that one serves me the best.
As mentioned above, there are a number of HTTP proxies that allow intercepting and modifying requests and responses.
Here is a list of the ones I know about:
If you wish to write your own intercepting proxy, you might like to take a look at OWASP Proxy, a Java library that implements all the necessary HTTP protocol functionality so you don't have to.
A while ago I used the Tamper Data Firefox Add-on and found it to be quite effective. It has some good features like being able to choose what requests you wish to tamper with and also has some predefined exploits that you can use to populate field values with.
Burp now rocks. Portswigger has made some excellent developments in the last 2 years. From the website, Burp can:
And I would definitely recommend the entire burp suite!
You can use the Firefox add-on Live HTTP Headers so you can view and replay them.
The Fiddler HTTP debugging proxy has been around for years and is actively maintained. It allows for interception and modification of traffic, crafting custom requests, replaying requests, and is fully scriptable and extendable. It's a Windows-only tool.
It also has extensions for passive and active security testing. Disclaimer - I co-authored those.
Owasp has released a tool called Web Scarab
An rare occasions, I've had to use wfetch (another free download from MS), to handle raw bytage over the HTTP stream. The specific problem being that almost all other tools, especially proxies and browser plugins, necessarily URL-encode any non-printable characters... and sometimes, you just really want to send that chr(9)....
I like MITM Proxy: http://mitmproxy.org/
(Careful, there's another project with the same name.)
It has a really lean, interfaces (looks like ncurses), if you like that sort of thing. It has the same capture/view/edit/replay capabilities as many others, but it's very keyboard-friendly. It can also proxy SSL connections!
Just to add (as it seems to have been missed so far) that if you're using Firefox, there's a collection called "Samurai Web Testing Framework" created by Raul Siles that comes with all cool webapp-sec related plugins included in the collection - https://addons.mozilla.org/en-US/firefox/collections/rsiles/samurai/.