Manual testing tools
Repeater, Comparer, Decoder, Sequencer, and Intruder.
These are the hands-on tools for once you have a request captured — from an import, the proxy, or a finding. All five live under Traffic in the sidebar.
Repeater
Take any captured exchange, edit the method, URL, headers, or body, and resend it as many times as you like. This is where you turn a finding into a confirmed, reproducible request-response pair, or manually probe a parameter the automated rules didn't flag. Every resend is captured as its own exchange, so you keep a trail of what you tried.
Comparer
A line-level diff between two requests or two responses. Useful for spotting what actually changed between a baseline call and a modified one — an extra header, a different status code, a field that silently disappeared from a JSON body.
Decoder
Encode or decode a value by hand: Base64, URL encoding, HTML entities, hex, and gzip. Handy for making sense of an opaque token or cookie value before deciding what to do with it.
Sequencer
Points Shannon-entropy analysis at a set of tokens (session IDs, CSRF tokens, password-reset tokens — anything you'd expect to be unpredictable) and flags weak randomness: low entropy, or outright duplicate values across samples. A strong result doesn't prove a token is safe, but a weak one is a fast way to catch a predictable-token issue early.
Intruder
A payload-position fuzzer. Mark one or more positions in a request template, supply payload lists, and choose how they combine:
| Attack type | What it does |
|---|---|
| Sniper | One payload list, fired through each marked position one at a time |
| Battering ram | One payload list, the same value inserted into every marked position at once |
| Pitchfork | Multiple payload lists, zipped together position-by-position (position 1 gets list 1's nth item, position 2 gets list 2's nth item, ...) |
| Cluster bomb | Multiple payload lists, every combination across all lists (the full cartesian product) |
Intruder needs a project open, since results are stored as exchanges you can review afterward like any other capture.
Next: Auth, scope & BOLA covers rewriting traffic on the way through with match & replace, and testing authorization with role-diff.