Jim Plush's Programming Paradise

Last week I downloaded the free HTTP Proxy tool called Paros Proxy after a recommendation from the WebHacking book by Stuart McClure and I'm pretty darn satisfied with it. Testing SOAP applications can be a bit of a pain and having a proxy like this really makes life easy, as well as being able to do little security tests on your application without needing to write a custom socket client script.

Brief Overview:
Paraos allows you to see the raw HTTP traffic from your browser to your webserver and INTERCEPT AND MODIFY IT! So basically you click on a link on your webpage, the http request goes to your proxy(Paros) and sits there, letting you view it. If you want to change a variable or the user agent at runtime to see how your script reacts just change it and hit send and it then sends it to the webserver. You can also see the raw response that the web server returns.

It is espcially handy for testing how drop down lists or radio buttons where you have a set of defined options yet at run time you want to test what a malicious user could actual send as those values to make sure you're testing for those fields properly.

Some other cool features...
*Manual Request Box - lets you type in a manual GET/POST whatever request to the webserver
*Scanner - scans the site for basic vulns (haven't really gotten too deep on this feature yet)
*Filters - lets you filter out requests you might not be interested in like jpg, gif, css, etc

http://www.parosproxy.org/index.shtml