---
title: "Intercepting Proxy"
canonical: https://trickest.com/glossary/http-proxy
description: "An intercepting proxy sits between a browser and a server so a tester can inspect, modify, and replay HTTP traffic, with Burp Suite a common example."
---

# Intercepting Proxy

An intercepting proxy routes a client's HTTP and HTTPS traffic through a tool the tester controls, pausing each request and response so it can be read or changed before it continues. By installing the proxy's certificate, the tester also decrypts TLS traffic and sees the cleartext exchange. Burp Suite and OWASP ZAP are the tools most people reach for.

The proxy is the central workbench for [web application security](/glossary/web-application-security) testing. It lets you tamper with parameters the front end would normally lock down, replay a captured request with a different session token, and watch exactly what the server returns. That visibility is what makes manual testing of access control, input handling, and business logic possible at all.

Most proxies bundle more than interception. A repeater resends and tweaks a single request, an intruder-style module drives [fuzzing](/glossary/fuzzing) across payload positions, and a passive scanner watches traffic for issues. These features also make a proxy the engine behind much [dynamic application security testing](/glossary/dynamic-application-security-testing).

In a Trickest workflow, the same idea runs headless: a programmatic proxy captures and mutates requests at scale, which is well suited to probing [API security](/glossary/api-security) across many endpoints without a human clicking through each one.

---
_Markdown source of https://trickest.com/glossary/http-proxy._