Which tool provides a nontransparent proxy that enables detailed manipulation of HTTP/HTTPS requests and responses for web app testing?

• A. Burp Suite
• B. OWASP ZAP
• C. Nessus
• D. Metasploit

Answer: (B)

Using a nontransparent proxy that lets you manipulate HTTP and HTTPS traffic is central to hands-on web app testing. OWASP ZAP acts as a local intercepting proxy between your browser and the target application, so traffic passes through it and you can pause, edit, and replay requests and responses in real time. This means you can alter parameters, headers, cookies, or payloads on the fly and see exactly how the web app responds, which is essential for testing input validation, session handling, and security controls. Nessus and Metasploit aren’t designed to manipulate live web traffic through a proxy for testing requests and responses—Nessus is a vulnerability scanner and Metasploit is an exploitation framework. Burp Suite also provides this capability, but as described, the tool that fits the nontransparent proxy with detailed manipulation for web app testing is OWASP ZAP.