Intercepting and manipulating traffic is a fundamental technique in web application penetration testing. It is used to discover vulnerabilities, analyze data flows, and test how applications respond to unusual or malicious inputs.
Frameworks
- OWASP ZAP [Link]
- The Zed Attack Proxy (ZAP) claims to be the world’s most widely used web app scanner.
- It is part of the OWASP family of resources, so it is free and open source.
- Burp Suite [Link]
- Arguably the most popular tool on this list. The Community Edition offers most features for free, but the throttling in the Intruder can make for a frustrating experience.
- Note that version 2 of the Community Edition no longer includes the Spider feature, though many other tools can fill that gap.
- Caido [Link]
- Available as both a graphical and command-line application. Its equivalent of Burp’s Intruder does not throttle.
- The CLI version also enables automation.
- MITMProxy [Link]
- A free and open-source interactive HTTP/HTTPS proxy. It terminates SSL/TLS connections and uses a self-signed certificate for the client.
- Can be used via CLI or through a browser-based Web UI.
- For developers, it offers programmable APIs for full control over the proxy, data transformation, and more.
Extensions
- FoxyProxy [Link]
- An indispensable browser extension for quickly setting up, enabling, and disabling a proxy for traffic interception and analysis.
- ProxyChains [Link]
- A CLI tool that wraps the execution of a client web application and forces its traffic through a chosen proxy or chain of proxies.
Assessments
- OpenVAS Scanner [Link]
- Can be easily installed on Kali or in a Docker container.
- OpenVAS Scanner is now part of the Greenbone Community Edition.
- Tenable Nessus Essentials [Link]
- A capable vulnerability scanner, free for non-commercial use with some limitations.
- NMAP Vuln Scripts [Link]
- Using scripts, NMAP can programmatically assess applications for known vulnerabilities.
Vulnerable Apps and Labs