Paros Proxy User Agent Configuration

If you are doing web application testing with Paros Proxy, you have probably noticed that some sites behave differently or flat-out block your requests. The reason is usually the User-Agent header. Paros sends its own UA string by default, and any WAF or reverse proxy worth its salt will flag it.

The problem

Paros 3.2.13 (the current release) sends this User-Agent:

User-Agent: Paros/3.2.13

This immediately identifies your traffic as coming from a security scanner. mod_security rules, Cloudflare, and plenty of custom WAF configs will block or challenge requests with known scanner UAs. Even some simple Apache configs block anything that is not a recognised browser.

During a pen test last week, I was getting 403 Forbidden on every request through Paros while the same URLs loaded fine in Firefox. Checking the Apache logs on the target confirmed it was the UA being blocked.

Changing the User-Agent

Paros does not have a GUI option to change the UA string (one of several things the developers could improve). You need to edit the config file directly.

Find the Paros config directory. On Linux it is ~/.paros/, on Windows it is C:\Users\username\Paros\. Edit the file session.properties:

connection.defaultUserAgent=Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12

If the line does not exist, add it. This sets the default UA for all requests proxied through Paros. I use a Firefox 2 on Windows XP string because it is common enough to blend in but also matches the era - sending a Firefox 3 beta string in early 2008 might actually be more suspicious on some targets.

Restart Paros after changing the config. You can verify it is working by checking the request headers in the History tab.

Per-request overrides

Sometimes you want different UAs for different parts of a test. Paros supports request modification through the Trap feature. Enable the trap (Trap - Trap Request), and you can edit the User-Agent header manually before each request is sent to the server.

This is tedious for normal browsing but useful when you want to test how a site responds to different clients. Some applications serve different content to mobile UAs, for example, and you want to test both code paths.

Common UA strings for testing

Here are a few I keep in a text file for quick copy-paste:

# Firefox 2 on Windows XP (common, blends in)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12

# IE 7 on Windows Vista
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)

# IE 6 on Windows XP (still very common in corporate environments)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

# Safari on Mac OS X
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/523.12 (KHTML, like Gecko) Version/3.0.4 Safari/523.12

# Googlebot (for testing crawler-specific behaviour)
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

Other scanners with the same problem

Paros is not the only tool that outs itself via the UA header. Nikto, w3af, and sqlmap all do the same thing by default. Most of them have command-line options to override it:

# Nikto
nikto -h target.com -useragent "Mozilla/5.0 ..."

# sqlmap
sqlmap -u "http://target.com/page?id=1" --user-agent="Mozilla/5.0 ..."

If you are running any kind of security assessment, changing the UA should be one of the first things you do. Not to be sneaky - if you have permission to test, you have permission to test - but because you want to test the application as a real user would see it, not the scanner-specific error page.