1

I have to read http/https messages sent from a client system and see that the messages are not being modified within system by any malware and the server receives what exactly the user wants to send.

For Example, a User in an online Banking Transaction wants to send Amount $100 to Account 'A' and lets say that the message has been modified by a spurious program within system outside of users knowledge and sends it as $1000 ,Account 'B' before it is sent to the Server over the Network. I need to verify the details of the message before it is sent to the server.

Thus I want to use a Proxy to see what request is being sent to the Banking Server and display it to user. Then the User observes that it has changed to B,$1000 and immediately aborts or kills the request.

In this way I want to ensure the integrity of the details of a secure Transaction. For this reason, I need a Proxy which made me research about them and came up with these four proxies. As I am beginner in this area and don't know much about it. Want to know if any of these proxies work or Is there a better approach to work out my purpose.

Paros, BURP Free Version, Webscarab, SQUID.

If anyone has a better user friendly and useful proxy please feel free to suggest it

Thanks, Pavan.

closed as off-topic by TildalWave, scuzzy-delta, AviD Mar 17 '14 at 21:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have you considered MITMproxy? – scuzzy-delta Mar 17 '14 at 20:57
  • Yes, I did. Found it a bit tricky and not user friendly to use...Ofcourse, I am looking for some Java or C# Proxy as they both are better familiar to me than Python. – Pavan K Mar 17 '14 at 21:00
  • Besides that the question is closed since we don't accept product recommendation requests here, there have been many questions in the past that have mentioned many of these products. On a personal note, I much prefer Fiddler most of the time. – AviD Mar 17 '14 at 21:07
3

The leading proxies are Burp and Zap. Burp pro edition just about has the edge on Zap, but Zap is completely free. The free edition of Burp is usable, but lacks advanced features like the active scanner.

Paros and Webscarab were once leading proxies, but they are no longer cutting edge. Zap is actually a fork of Paros, but it has moved on a lot.

Squid is a proxy, that's true, but it's not an interactive proxy. It's not much help for testing a web app.

  • I agree that burp pro is better than zap but I don't think the free edition of burp is very useful at all. Burpsuite pro has a free trial, too. – 735Tesla Mar 17 '14 at 20:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.