Below is a list of tools we've found useful in solving the WebGoat lessons. You will need a proxy like OWASP ZAP or Paros to solve most of the lessons.
Like WebGoat, Zed Attack Proxy (ZAP) is a part of OWASP and is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually..
Webpage: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
The .jar install file can be found at the OWASP ZAP Google Code Project
After installing ZAP and configuring your browser to use it as a proxy on localhost we can start. To intercept a request,
click the green arrow icon turning it red. If we browse a WebGoat page, ZAP will intercept the HTTP request.
Here we can read and edit the intercepted parameters and headers. After editing is complete press the play icon to submit the request to the server.
Most modern browser have developer tools that will allow you to inspect and modify request data.
Wireshark is a network protocol analyzer. You can sniff network traffic and gather useful
informations this way.
Webpage:http://www.wireshark.org
There are many vulnerability scanners for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Below are links to three open source scanners.
Nessus:http://www.nessus.org
Paros:http://www.parosproxy.org
OWASP ZAP:https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project