Pentesting
The Pentesting workspace (⌘3) adds request fuzzing and analysis on top of the proxy. Use it only against systems you own or are authorized to test.
Intruder
Take a request, mark positions, and send it many times with payloads. Attack types:
| Attack | How payloads fill positions |
|---|---|
| Sniper | One payload set, one position at a time. |
| Battering Ram | One payload set, the same value in every position. |
| Pitchfork | A payload set per position, advanced in parallel. |
| Cluster Bomb | Every combination across positions. |
Payloads can be encoded (None, URL, Base64, double URL) and transformed by payload rules, and you can grep-extract a value from each response to compare results.
Security scanner
A passive scanner that watches the traffic you generate and flags issues it sees in requests and responses — no active probing of its own.
Sequencer
Collect many instances of a token (a session id, a CSRF token) and measure its randomness, to judge whether it is predictable.
Comparer
Diff two responses (or two requests) byte by byte or word by word, to see exactly what changed between them.