HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Open in ctfpalWeb challenges are a loop: change one thing about a request, send it, read the response. A browser makes that loop slow because it insists on being a browser - it will not send PUT, it normalises your headers, and it re-runs the whole page every time.
Sending the request directly removes all of that. You see exactly what went out and exactly what came back, headers included, and you change one variable at a time - which is the only way to attribute a change in behaviour to the thing you actually changed.
What to vary
- The method. An endpoint that rejects
GETmay acceptPOST,PUT, or the frequently-forgottenOPTIONS, which lists what else it takes. - Authorisation headers. Swap a token for another user’s and see what comes back - the whole of broken access control lives here.
- Content-Type. The same body parsed as JSON versus form-encoded can reach entirely different code paths.
- Redirect following. Turning it off shows you the 302 itself, including headers and body that a browser discards.
Related tools
Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
HTTP security header analyzer
Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.
URL decoder and encoder
Percent-decode and encode URL components, including double-encoded payloads and `+`-as-space form encoding.