Are there any HTTP/HTTPS interception tools other than Fiddler, Charles, Poster, and Achilles?

Question

I'm in the process of testing my application with respect to security.

Aside from Fiddler, Charles and Poster (Firefox plug in). Are there any other free to use https interception (and editing) applications out there? Especially ones which can be installed w/o admin privileges.

Achilles comes to mind, but I don't think it can handle https traffic.

Solution 1

Achilles does work on HTTPS traffic, but they note on their site that it is not the best tool any more.

Their suggestions are Burp Suite and WebScarab both of which I highly recommend.

Solution 2

OWASP ZAP - its free, open source and cross platform.

Its also the most active open source web security tool and came first and second in the last 2 'Top Security Tools' surveys run by Toolswatch.org (2013, 2014)

It was originally forked from Paros, which is no longer maintained, but it now has loads more functionality.

Its an OWASP Flagship project having replaced WebScarab, which is also essentially no longer maintained.

Simon (ZAP Project Lead)

Solution 3

Wireshark is amazing. It captures everything on the network so you'll need to filter down to http/https: http://wiki.wireshark.org/CaptureFilters.

Solution 4

There are a few programs that I would suggest.

Paros Proxy and Ratproxy have already been noted.

scapy is a powerful packet manipulation tool, and has all of the sniffing and monitoring capabilities as well. dsniff is a suite of tools that allows manipulation, injection, and all sorts of interception and modification options.

There is also a plugin for IE called Tamper IE that has a simple GUI based packet editor.

All of these are free.

Solution 5

Doing more research I came across Paros Proxy. Seems to be a good alternative to the others.

View more solutions

Comments

[Lotus]

+1 for scapy. An awesome low-level packet inspection library for Python.

[Lotus]

+1 for burp suite. Highly effective, intuitive, and free.

[David Mulder]

Just for feature readers coming across this page: 'modern user interace' means a ribbon clone in this case (ala Microsoft Office)...

[Khachatur]

not only :) It comes with a 'report control' that allows group, filter and sort http sessions and get some quic statistics for selected sessions (size by domains, by content types, gzip statistics, etc). Did you ever run it before posting your comment about ribbon?

[Ajeeb.K.P]

Instead of WebScarab should use ZAProxy. See first link for info.

[mins]

As-is Wireshark isn't able to display https traffic (you need to provide the SSL/TLS key apart)