CORE TOOLS
Proxy
Sits between browser and server. When Intercept is ON, every request is paused for you to inspect and modify before it reaches the server.
Repeater
Lets you manually resend modified HTTP requests. Essential for testing parameters, payloads, and auth bypass attempts.
Decoder
Encode/decode Base64, URL, HTML, Hex. Useful for analysing cookies, tokens, and encoded parameters.
PROXY WORKFLOW
1. Turn Intercept ON
2. Browse target in Browser
3. Request appears in Proxy
4. Inspect / modify request
5. Click Forward to send
6. Observe Response
COMMON TESTS
Parameter tampering
Change ?id=1 to ?id=2 to access another user's data (IDOR).
Hidden field manipulation
Forms often contain hidden fields like admin=false — change to admin=true.
Cookie manipulation
Decode cookie value, modify role/user field, re-encode and resend.
File upload bypass
Intercept upload request, change filename extension or Content-Type header.
HTTP METHODS
GET — retrieve resource
POST — submit data
PUT — upload/replace resource
DELETE — delete resource
OPTIONS — list allowed methods
USEFUL HEADERS
X-Forwarded-For: 127.0.0.1
X-Original-URL: /admin/
Referer: http://trusted.site/
User-Agent: Mozilla/5.0...