Release notes

Interceptor changelog.

Complete release history reconstructed from Git commits, version bumps, and the project roadmap, from the initial 0.1.0 proxy to the current 1.105.0 build.

Version 1.105.0

Unified themed list control and interface polish

  • Introduced a single themed DataListCtrl and migrated every list across the app (History, Connections, Packet Capture, Match/Replace, Intercept queue, Attacker, Repeater, WebSocket panels, Settings, and more) onto it.
  • Added clearly visible zebra striping whose alternate-row colour is derived from the active theme, with centred column headers throughout.
  • Preserved the scroll position when live-updating lists rebuild, so History and other panels no longer jump the focused row back to the top while new requests arrive.
  • Fixed the request/response line-number gutter to align exactly with the text control's line positions instead of drifting toward the bottom.
  • Stripped chunked Transfer-Encoding framing from the Raw message view (the Hex view still shows the exact on-the-wire bytes).
  • Added a Clear button beside the History HTTPQL search field, themed row highlights driven from the History id column, and row hover feedback.
Version 1.100.0

Active security scanner: 45-check detection suite, intrusive gate, and OAST correlation

  • Added a scope-gated active-scan engine with a probe generator, request pacing (global and per-host rate and concurrency limits), and a "Run active scan on in-scope history" action.
  • Shipped 45 opt-in, non-destructive-by-default checks: SQL error / out-of-band / time-based / boolean injection, OS command, SSTI, XXE, CRLF, LDAP, XPath, NoSQL, insecure deserialization, expression-language/OGNL, server-side includes, verbose-error disclosure, host-header injection, active CORS and over-permissive CORS preflight, open redirect (query and body), JWT tampering, IDOR, mass assignment, user enumeration, HTTP TRACE/XST, risky HTTP methods, sensitive path and directory-listing discovery, GraphQL introspection, HTTP parameter pollution, secret exposure, server-side prototype pollution, and web cache deception.
  • Added an explicit intrusive/destructive checks gate (opt-in checkbox, warning, and run-time confirmation) covering ReDoS, unauthenticated HTTP PUT writes, malformed/oversized fault injection, XML entity-expansion (billion laughs) DoS, path-traversal secret-file reads, and XXE out-of-band file exfiltration.
  • Added out-of-band testing with an HTTP collaborator and a DNS collaborator, correlating callbacks into confirmed findings.
  • Enforced Attacker rate limits and concurrency controls in a bounded dispatcher with dedicated throughput knobs.
  • Ran inbound HTTP/3 through the intercept/modify pipeline, and added Swagger 2.0, YAML, and $ref-resolving API spec import.
Version 1.85.0

Reliability, performance, and hardening at scale

  • Hardened storage durability: fsync spooled body files and their directory, sweep orphaned spool files on open, batch retention eviction instead of per-exchange VACUUM, and bound the async write queue with backpressure.
  • Hardened the proxy under load: replaced select() with poll() and capped concurrent connections, recycled finished connection threads, and capped and evicted QUIC connections to bound UDP-flood memory.
  • Kept the UI responsive under bursts by coalescing captured-exchange and network events and moving History filtering, Target Sitemap, Findings, and API Surface rebuilds off the UI thread.
  • Fixed denial-of-service and crash vectors: bounded JSON parser recursion, grep regex subjects, and replay response size (with an O(n^2) chunked-read fix), and resolved several worker/UI data races.
  • Added IPv6 UDP socket support and a shared non-blocking TCP host dialer for upstream connects and replay.
  • Expanded RFC edge-case hardening (HTTP protocol, QPACK static table) and broadened automated test coverage across importers, exporters, scope, authorization, storage normalization, and models.
Version 1.70.0

HTTP/2, HTTP/3, QPACK, MASQUE, WebTransport, and workspace hardening

  • Added HTTP/2 Repeater support for h2c alongside HTTPS ALPN h2 replay.
  • Expanded direct HTTP/2 proxy handling for interleaved request bodies, trailers, safe GOAWAY/error serialization, and stricter frame validation.
  • Hardened HTTP/3 frame and SETTINGS parsing and serialization with QUIC varint bounds, reserved SETTINGS rejection, and strict boolean SETTINGS validation.
  • Expanded QPACK support with Huffman string literals, dynamic table references, dynamic indexed field lines, dynamic literal name references, safe field-section serialization, pseudo-header ordering, duplicate detection, and integer/string bounds checks.
  • Hardened HTTP Datagram Capsule, CONNECT-UDP/MASQUE, IPv6 zone identifier, WebTransport stream/datagram/capsule, and WebSocket Extended CONNECT validation.
  • Added History query numbering, wider timestamp and method columns, smaller History list typography, movable History panel placement, and project-persisted request/response layouts and splitter positions.
  • Added high-contrast and colorblind-friendly themes plus broader theme-defined colors across UI states.
  • Updated version formatting to 1.70.0.Build and refreshed the website feature map, RFC coverage, comparison matrix, and release pages.
Version 1.61.0

Workspace navigation ergonomics

  • Added configurable main tab bar placement from the View menu: left, top, right, or compact switcher-only mode.
  • Added a current-tab switcher that shows the active workspace and opens a dropdown of the other visible tabs.
  • Added compact tab navigation in the top toolbar before the proxy controls for users who want to hide the full tab bar.
  • Kept tab labels left-aligned and fully visible across side and top navigation modes.
  • Updated the website feature map, comparison matrix, and public feature count for the new navigation options.
Version 1.60.0

Auto API Model, API Surface, and safer endpoint workflows

  • Added an explicit Bypass SSL Pinning switch beside TLS and proxy controls, with warning text and visible test-boundary intent.
  • Moved the command palette entry into the Tools menu to keep the primary interface focused.
  • Added Auto API Model normalized route inference from captured history, including path placeholder detection such as numeric IDs.
  • Added an API Surface view for modeled endpoints, observed methods, statuses, authentication evidence, role/profile hints, and linked source exchanges.
  • Added observed request and response shape summaries so inferred schemas are presented as evidence-backed hints rather than authoritative contracts.
  • Added per-endpoint manual test checklist generation for authorization comparison, input validation, cache behavior, sensitive data exposure, replay/regression coverage, and missing negative cases.
  • Added safe endpoint workflow actions to send representative requests to Repeater, create regression coverage, queue auth matrix comparison, add report evidence, or open linked history evidence.
  • Added API model baseline diffing for new endpoints, removed endpoints, changed status behavior, new response fields, newly unauthenticated behavior, and sensitive-looking fields.
  • Added model confidence and evidence counts across the API Surface so reviewers can judge how much captured traffic supports each inference.
  • Updated the website from 115+ to 130+ documented features with a dedicated Auto API Model category and refreshed comparison matrix.
Version 1.50.0

Review ergonomics, layout control, and website refresh

  • Added integrated request and response search bars with regex mode, case-sensitive mode, previous/next navigation, auto-scroll, and match counters.
  • Added theme-aware syntax highlighting for HTTP fields, values, punctuation, cookies, and nested key/value structures.
  • Added line-number gutters with dynamic width for request and response viewers.
  • Added visible invisible-character rendering for spaces, tabs, newlines, carriage returns, and control bytes.
  • Added a safe HTML Render tab for response review.
  • Added switchable request/response layouts: stacked, side-by-side, and tabbed.
  • Added layout icon buttons with active-state indicators.
  • Updated Send To workflows so destination tabs receive a green notification badge without stealing focus.
  • Improved History filters with themeable filter chips, immediate theme refresh, and a wider advanced-filter panel.
  • Added request/response context menu cut, copy, paste, and invisible-character controls.
  • Added a separate self-hosted Python OAST server option for controlled remote callback labs.
  • Updated the website feature map, comparison matrix, and product positioning for the expanded feature set.
Version 1.35.0

Modern protocol diagnostics and RFC coverage

  • Added HTTP/3 protocol primitives with h3 ALPN awareness and QUIC-oriented modeling.
  • Added QPACK codec support for HTTP/3 field representation.
  • Added HTTP Datagrams and Capsule Protocol primitives.
  • Added CONNECT-UDP / MASQUE request recognition and diagnostics.
  • Added WebTransport over HTTP/3 primitives for sessions, streams, datagrams, and close/drain capsules.
  • Added WebSocket bootstrapping awareness for HTTP/2 and HTTP/3 Extended CONNECT.
  • Added RFC 9218 modern Priority header and reprioritization diagnostics.
  • Added ECH / Encrypted ClientHello outer ClientHello detection without bypassing encryption.
  • Added DNS HTTPS/SVCB and Alt-Svc awareness for domains advertising h3.
  • Added an in-app RFC reference page reachable from Help > RFC.
  • Updated the website feature map and public RFC coverage page.
Version 1.31.0

Logging, release control, and download workflow

  • Added configurable daily file logging for persistent diagnostics.
  • Expanded verbose logging coverage for troubleshooting proxy, UI, and runtime behavior.
  • Improved logging output and release readiness cleanup.
  • Updated the public download workflow.
  • Updated website calls to action to point to product downloads and contact options.
Version 1.30.2

Release refresh and UI fixes

  • Prepared a new release build after the 1.30 packet capture cycle.
  • Fixed UI layout issues found during release validation.
  • Polished tooltips and interaction text across the main interface.
  • Removed the database integrity action from the File menu to reduce clutter.
Version 1.30.1

Send To workflow and settings editor cleanup

  • Expanded Send To destinations for captured requests and responses.
  • Added GraphQL as a Send To destination from request context menus.
  • Added site authentication token injection for Repeater.
  • Added response-token save action for later authentication injection.
  • Replaced TSV-based settings editors with list-based forms.
  • Added request context menus with word wrapping for long request and response data.
  • Replaced the main AUI tab strip with toolbar-style navigation.
Version 1.30.0

Packet capture and desktop package distribution

  • Added a Wireshark-like packet capture panel.
  • Added live interface selection and packet detail inspection.
  • Added PCAP capture and evidence export workflows.
  • Cleaned up PacketCaptureSession internals and network interface selector UI.
  • Moved packet details to a right-side pane for faster inspection.
  • Added View > Tabs controls to show or hide main tabs.
  • Added packaged desktop distribution and checksum generation.
  • Updated website release artifacts.
  • Updated screenshots, contact form, website feature count, and release pages.
Version 1.20.0

OAST, advanced workflows, licensing, packaging, and product polish

  • Added local-only OAST callback support with interaction token evidence storage.
  • Added runtime controls for the local OAST callback server.
  • Documented local OAST architecture and authorized-use boundaries.
  • Added engagement profile metadata and project health checks.
  • Added load and benchmark-style tests for storage, WebSocket, queue, and active scan scenarios.
  • Added initial gettext i18n infrastructure with English, French, German, and Spanish catalogs.
  • Defaulted the UI language to English and avoided unnecessary locale popups.
  • Added GraphQL analysis panel and JSON GraphQL operation summaries.
  • Added HTTP/2 MITM ALPN support, HPACK/Huffman work, and HTTP/2 upstream relay foundations.
  • Added OpenAPI and Postman request import.
  • Added Authorization Matrix workflow for comparing endpoints across authentication profiles.
  • Expanded Attacker execution to dispatch attack plans through ReplayEngine with throttle, pause, resume, stop, and emergency stop controls.
  • Added WebSocket frame intercept queue, frame filtering, forward/drop decisions, edit dialog, timeout handling, and cancellation.
  • Added optional blind crawl seed generation with explicit warnings and scope enforcement.
  • Added session macro workflows and project settings saved as cfg files.
  • Added upstream proxy chaining and later completed corporate upstream proxy support.
  • Added per-host mTLS client certificate support.
  • Added offline signed shareware licensing and moved registration to the Help menu.
  • Removed the temporary hardcoded binary expiration after licensing was introduced.
  • Added Debian, Windows MSI, and macOS DMG packaging targets.
  • Added integrated help documentation, project testing workspace checklist, request diff timeline, evidence board, and low-level connection inspector.
  • Persisted main window placement across restarts.
  • Added website rebuilds, screenshot gallery updates, and about-box updates.
Version 1.15.0

Extensibility, plugins, settings organization, and diagnostics

  • Defined internal extension points for passive rules, active checks, history actions, export formats, and request transformations.
  • Added stable extension data model for requests, responses, findings, and scope.
  • Added plugin manifest format, plugin loading from user directories, and plugin enable/disable UI.
  • Added plugin sandboxing strategy and a native C++ plugin ABI contract.
  • Added declarative scriptable passive scanner rules.
  • Added declarative scriptable request transformations.
  • Added plugin API documentation, examples, and integration tests.
  • Moved sample plugins to documentation and bundled finalized passive observation plugins.
  • Added XSS parameter candidate plugin example.
  • Introduced wxAUI main frame layout.
  • Replaced settings tabs with wxTreebook navigation.
  • Split settings into focused scanner, plugin, diagnostics, active scan, and rewrite-rule pages.
  • Moved settings warnings into dockable status panels.
  • Grouped findings by host then severity.
  • Stored project-generated files in per-project directories.
  • Moved project storage directly near the .itp project file.
  • Added diagnostics and health panels.
  • Updated product and technical documentation.
Version 1.14.0

Active scanner and reporting

  • Added active scanner configuration and UI integration.
  • Required explicit target scope before active checks can run.
  • Enforced non-destructive active checks by default.
  • Added crawl planning from observed sitemap data.
  • Added active request queue limits, concurrency controls, per-host controls, and safe cancellation.
  • Added active reflected input checks.
  • Added paired authorization indicator checks.
  • Added harmless XSS reflection probes.
  • Added conservative SQL error observation checks.
  • Added explicit-parameter path traversal checks.
  • Added URL-like open redirect checks.
  • Added safe command injection observation checks.
  • Added controlled SSRF callback checks backed by local-only OAST evidence.
  • Added CSRF token presence checks.
  • Added active scan result deduplication and confidence scoring.
  • Added active scan report export.
  • Added Markdown report tool panel, formatting toolbar, report review mode, and loading of existing Markdown reports.
  • Added known-vulnerable test app fixtures for regression coverage.
Version 1.13.0

Certificate pinning assessment boundaries

  • Added TLS interception failure classification.
  • Added history markers for pinning-related TLS failures.
  • Added pinning diagnostics panel explaining observed symptoms without bypassing platform protections.
  • Added project-level authorization notes for mobile and application testing engagements.
  • Added per-target pinning assessment scope configuration.
  • Added controlled lab integration options for authorized pinning diagnostics.
  • Added instrumentation helper configuration as an explicit, auditable boundary.
  • Added QA-safe paths configuration for app-owner testing workflows.
  • Added instrumentation payload catalog mode and tests while preserving the no-stealth-bypass product boundary.
Version 0.13.0

WebSocket completion and UI polish

  • Completed WebSocket frame display inside the message viewer.
  • Added WebSocket frame search and filters.
  • Added per-message compression awareness.
  • Added WebSocket session export.
  • Added Send To Decoder for WebSocket payloads.
  • Added WebSocket replay UI and execution support.
  • Added WebSocket frame interception and fixture-server tests.
  • Added global clear-history action.
  • Added UI theme configuration and main-interface theme application.
  • Added macOS app icon generation.
  • Improved history filters, status badges, summary updates, and global search.
  • Moved Repeater to wxAuiNotebook and added Close All Tabs behavior.
Version 0.12.0

WebSocket capture foundation

  • Detected HTTP Upgrade: websocket handshakes.
  • Stored WebSocket handshake request and response data.
  • Implemented WebSocket frame relay.
  • Captured text and binary WebSocket frames.
  • Stored frame metadata for later UI display and export.
  • Kept binary frame display safe for the UI.
Version 0.11.0

Attacker

  • Added Attacker module and Send To Attacker workflows.
  • Added payload position selection and request mutation engine.
  • Added attack types including sniper, battering ram, pitchfork, and cluster bomb.
  • Added payload sets for simple lists, numbers, dates, case mutations, and file input.
  • Added rate limits, concurrency controls, pause, resume, graceful stop, and emergency stop.
  • Added scope guard for Attacker execution.
  • Added response table with status, length, words, lines, duration, MIME, title, errors, grep matches, and extracts.
  • Added grep match and grep extract helpers.
  • Added baseline request comparison.
  • Added redirect handling and cookie handling options.
  • Added result filtering, sorting, and CSV export.
  • Added Attacker fixture server tests.
Version 0.10.0

Decoder, encoder, and comparer tools

  • Added Decoder tool panel.
  • Added URL, Base64, Base64URL, hex, HTML entity, JSON string, and Unicode escape encode/decode workflows.
  • Added JWT decoding with header and payload display.
  • Added hash helpers for MD5, SHA-1, SHA-256, and SHA-512.
  • Added HMAC helper with explicit key entry.
  • Added gzip and deflate compression/decompression helpers.
  • Added pretty printers for JSON, XML, HTML, CSS, and JavaScript.
  • Added Comparer tool with request, response, text, and hex diffs.
  • Integrated Send To Decoder and Send To Comparer from history and Repeater.
Version 0.9.0

Passive scanner

  • Persisted passive findings in SQLite.
  • Added Findings panel with severity, host, URL, title, evidence, and status.
  • Added deduplication by issue type, host, path, parameter, and evidence.
  • Added finding lifecycle states: open, confirmed, false positive, and ignored.
  • Added configurable passive scanner rules.
  • Improved cookie, security header, CORS, cache, mixed content, and insecure form checks.
  • Added server/version disclosure checks.
  • Added sensitive data detection for keys, tokens, private keys, cloud credentials, stack traces, and debug errors.
  • Added JWT detection and weak metadata warnings.
  • Added TLS observations, MIME sniffing mismatch checks, parameter inventory, and suspicious parameter checks.
  • Added JavaScript passive analysis for secrets, source maps, and endpoint extraction.
  • Added confidence levels, remediation text, and fixture-backed scanner tests.
Version 0.8.0

Target scope, sitemap, export, import, and reporting

  • Added target scope model with protocol, host, port, path regex, include, and exclude rules.
  • Added target scope editor UI and import/export of scope configuration.
  • Added in-scope/out-of-scope markers and show-only-in-scope filters.
  • Added target sitemap tree with host, path, endpoint, methods, statuses, MIME types, parameters, and forms.
  • Added endpoint detail panel with observed requests and responses.
  • Added scope enforcement for Repeater, Attacker, and active scanner.
  • Added HAR 1.2 export with headers, cookies, query strings, post data, timings, sizes, and MIME types.
  • Added raw request and raw response export.
  • Added selected exchanges export.
  • Added full session JSON export and import.
  • Added findings export as JSON, Markdown, and HTML.
  • Added report templates for passive findings.
  • Added redaction before export.
  • Added export progress and cancellation for large sessions.
  • Added HAR fixture validation tests.
Version 0.7.x

Target scope and sitemap milestone

  • Implemented the scope model and matching engine.
  • Added visual scope markers in history.
  • Added sitemap endpoint discovery and observed request metadata.
  • Added parameter tracking from query strings, forms, JSON, XML, cookies, and headers.
  • Added tests for scope matching and sitemap behavior.
Version 0.6.x

Repeater milestone

  • Implemented ReplayEngine for standalone HTTP and HTTPS requests.
  • Added Repeater tabs and raw request editor.
  • Added parsed editor for method, scheme, host, port, path, query, headers, and body.
  • Added send, cancel, timeout, and response viewer controls.
  • Stored replay traffic in history with a source marker.
  • Added Send History Item To Repeater.
  • Added duplicate, rename, close, and restore tab behavior.
  • Added redirect handling and cookie jar behavior.
  • Added request comparison between replay attempts.
  • Added replay tests for HTTP, HTTPS, timeout, DNS error, and edited bodies.
Version 0.5.0

Intercept mode

  • Implemented the InterceptQueue between parsed traffic and forwarding.
  • Added global intercept toggle.
  • Added request and response interception rules.
  • Added Forward, Drop, Edit, and Forward All actions.
  • Added timeout behavior for queued messages.
  • Added UI warnings when queued traffic blocks browser behavior.
  • Added raw request editor and raw response editor with validation.
  • Added body editor modes for raw text, form, JSON, XML, and hex.
  • Added automatic Content-Length recalculation after edits.
  • Added advanced option to preserve malformed requests.
  • Added match-and-replace rules for headers and bodies.
  • Added rule enable/disable, ordering, and preview.
  • Added audit log for modified messages.
  • Added regression coverage for edit, drop, modified response, and timeout flows.
Version 0.4.0

Proxy UI core and history workflow

  • Added persistent configuration for proxy, TLS MITM, timeouts, limits, storage, and UI settings.
  • Added centralized Settings dialog with category navigation.
  • Added runtime-safe settings application, validation, defaults reset, and risk warnings.
  • Added advanced history filters and quick filter chips.
  • Added full-text search over URL, headers, request body, and response body.
  • Added sortable history columns.
  • Added request/response viewers with raw, headers, pretty, hex, and rendered text modes.
  • Added syntax highlighting for JSON, XML, HTML, JavaScript, CSS, and HTTP.
  • Added decompression display for gzip, deflate, and Brotli.
  • Added copy commands for URL, request, response, and cURL.
  • Added annotations, highlight colors, issue markers, and false-positive markers.
  • Added Send To Repeater, Attacker, Decoder, and export selected actions.
  • Added keyboard navigation shortcuts and safe binary body display.
  • Added RequestHistoryModel tests for large histories.
Version 0.3.0

Storage, capture model, and data integrity

  • Introduced SQLite schema versioning and migration tests.
  • Split exchange data into structured metadata, headers, small bodies, body spools, TLS info, findings, annotations, and replay-related tables.
  • Added indexes for timestamp, host, method, status, MIME type, URL, and scope.
  • Added transaction boundaries for complete exchange saves.
  • Added AsyncWriteQueue so proxy workers are not blocked by storage writes.
  • Added retention settings for database size, body capture size, and age.
  • Added sensitive data redaction for cookies, authorization headers, API keys, and custom patterns.
  • Stored raw and normalized bodies where needed.
  • Added capture truncation metadata.
  • Added complete project session export and import.
  • Added database integrity check and repair guidance.
  • Added crash-safe handling for partial captures.
Version 0.2.0

TLS MITM robustness

  • Supported multiple HTTP requests inside a single intercepted TLS tunnel.
  • Added per-host certificate cache with concurrent access safety.
  • Added certificate regeneration policy for CA or parameter changes.
  • Improved generated certificate SAN support for DNS names and IP addresses.
  • Added TLS handshake diagnostics in UI history.
  • Added upstream certificate details including subject, issuer, validity, SANs, protocol, cipher, and verification result.
  • Added upstream TLS verification control with clear warnings.
  • Added per-host MITM bypass rules.
  • Added global and per-scope TLS interception rules.
  • Added ALPN handling and explicit HTTP/2 behavior.
  • Added clear rejection behavior when HTTP/2 support was not available yet.
  • Added TLS minimum and maximum version settings.
  • Added SNI behavior tests and upstream certificate failure tests.
  • Added local CA rotation and deletion UI.
  • Documented how to remove CA trust from browser and OS stores.
Version 0.1.0

Initial proxy and HTTP/1.1 correctness

  • Created the initial CMake, wxWidgets, proxy, storage, and desktop application structure.
  • Added local HTTP proxy capture on 127.0.0.1:8080.
  • Added basic HTTP request and response handling.
  • Added CONNECT method tunnel pass-through before MITM support.
  • Added menu bar, About dialog, and Quit action.
  • Added early TLS MITM support with CA management and dynamic certificate generation.
  • Added roadmap, project hygiene baseline, contributor workflow, coding rules, and test strategy.
  • Added persistent client and upstream connection handling.
  • Preserved keep-alive behavior and handled hop-by-hop headers.
  • Added request lifecycle state machine.
  • Handled Content-Length bodies, chunked transfer encoding, trailers, Expect: 100-continue, informational responses, no-body responses, body limits, large-body streaming, and body spooling.
  • Tracked bytes sent, received, and captured separately.
  • Added timeouts, cancellation, graceful half-close, DNS retry diagnostics, IPv6 literal support, and request target form coverage.
  • Added parser hardening for malformed headers, duplicate headers, folded lines, invalid CRLF, and oversized fields.