Web Traffic Interception Tools

Whistle is an HTTP debugging proxy that captures, inspects, and modifies traffic through a web-based management interface. It operates as a man-in-the-middle proxy, intercepting HTTP, HTTPS, HTTP/2, WebSocket, and TCP traffic between clients and servers, and provides a plugin-based architecture that extends core functionality with custom rules, UI panels, and protocol handlers at runtime. The project distinguishes itself through a combination of capabilities that go beyond basic traffic inspection. It supports server-side headless operation on Linux, allowing it to intercept traffic for appli

Hetty is an HTTP intercepting proxy and web security research toolkit used to capture, inspect, and modify traffic between a browser and a server. It functions as an HTTP request editor for creating and replaying manual requests to test server behavior and as a project-based traffic logger that isolates network logs across different security research engagements. The tool provides a request-response interception loop that pauses outgoing requests and incoming responses in transit, allowing for manual editing or cancellation. It includes a manual request replay engine to construct and transmit

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust

Reqable is a cross-platform network debugging tool that functions as an HTTP/HTTPS debugging proxy, a REST API client, and a traffic replay tool. It captures, inspects, and modifies live traffic using a local MITM proxy engine, supports VPN tunnel capture for mobile devices, and provides a Python scripting sandbox for custom traffic processing. The application is available on Windows, macOS, Linux, iOS, and Android. The tool distinguishes itself by combining traffic interception with breakpoint-based request modification, allowing users to pause live HTTP traffic for manual inspection and alt

OWASP ZAP is a dynamic application security testing tool and intercepting HTTP proxy used to find vulnerabilities in web applications. It functions as a penetration testing framework that enables both automated security scanning and manual security testing of running web services. The tool provides a suite of capabilities for analyzing web applications from the outside in, including the ability to capture and modify traffic between a browser and a target application. It is designed to integrate into DevSecOps pipelines to provide consistent security checks across different environments.

w3af is a web penetration testing suite and security audit framework designed to identify and exploit vulnerabilities in web applications. It functions as a vulnerability scanner that crawls targets to find injection points and a fuzzer used to discover hidden endpoints and test input validation. The project distinguishes itself by providing an intercepting HTTP proxy for capturing and modifying traffic, combined with a knowledge-base driven exploitation system. It enables the execution of security exploits to gain remote shell access and supports post-exploitation activities, such as routing

Proxyee is a Java-based network proxy library designed for building custom proxy servers that support traffic interception, inspection, and modification. It functions as a programmable framework for handling HTTP, HTTPS, and WebSocket traffic, providing the necessary tools to analyze and alter request and response data in real time. The project distinguishes itself through its man-in-the-middle capabilities, which include dynamic certificate generation to facilitate the decryption and re-encryption of secure traffic streams. This allows for granular control over network communications, suppor

Gor is a set of specialized utilities for recording, replaying, and shadowing network traffic to validate system behavior under real-world conditions. It functions as an HTTP traffic recording tool, a network traffic capture engine, and a system for duplicating live production traffic. The project provides capabilities for recording real-time HTTP network traffic and storing it for later playback or analysis. It can duplicate live production network traffic and redirect it to a staging environment in real time, or replay recorded network requests against a target environment to validate syste

Expose is a secure tunneling tool that creates public URLs for local development servers, making them accessible from the internet without complex network configuration. It forwards incoming HTTP requests and responses between a public relay server and a local machine, enabling external services to reach a development environment that would otherwise be isolated behind a firewall or VPN. The project distinguishes itself through a comprehensive set of webhook debugging and inspection capabilities. It captures all incoming webhook requests and displays them in a real-time dashboard or command-l

Shadowsocks-Windows is a desktop proxy manager that provides a graphical interface for configuring system-wide network routing. It functions as a local SOCKS5 or HTTP proxy server, intercepting outbound traffic through system-level injection to route requests through secure, encrypted remote tunnels. The application distinguishes itself through a modular architecture that supports plugin-based transport extensibility, allowing users to integrate external binaries for custom traffic obfuscation and specialized cryptographic protocols. It also enables high-availability networking by automatical

Mockserver is a multi-protocol mock server and API verification proxy used to simulate HTTP, gRPC, and WebSocket endpoints. It functions as a tool for testing client applications without relying on live backend services, providing a system to simulate chat completions and streaming responses for large language model integrations. The project automates behavior by generating request expectations and response behaviors from OpenAPI and Swagger specification files. It differentiates itself through a network traffic simulator that introduces latency, dropped connections, and failures to verify ho

websockets is a Python library that provides both client and server implementations for the WebSocket protocol, enabling real-time, bidirectional communication between applications. At its core, it offers the fundamental primitives for establishing persistent connections, managing their lifecycles, and exchanging text or binary messages asynchronously using coroutines. The library distinguishes itself through comprehensive support for various messaging patterns, including broadcast messaging to all connected clients, targeted messaging to specific clients, and shared application state synchro