Interceptor Support

Quick start

1. Create or open a project so history, settings, findings, testing checklist items, evidence, and report data stay together.
2. Define Target Scope before using active tooling. Scope rules are used by Attacker, active scanner workflows, Desync Lab, and other guarded actions.
3. Start the proxy from the toolbar or F9. The default listener is 127.0.0.1:8080.
4. Configure your browser, mobile proxy profile, CLI client, or test tool to use the listener.
5. Capture traffic, review History, Sitemap, API Surface, Findings, and Project Health, then send interesting requests to Repeater, Attacker, Auth Matrix, Regression, Decoder, Comparer, GraphQL, or Report.
6. Export HAR, raw messages, findings, WebSocket sessions, reports, or the full project when the assessment is complete.

Workspace map

Proxy and capture

• HTTP/HTTPS proxy listener: captures browser, application, CLI, and test-tool traffic through a local endpoint.
• CONNECT pass-through: tunnels HTTPS without decryption when TLS interception is disabled or a host is bypassed.
• HTTP/1.1 correctness: handles keep-alive, chunked bodies, trailers, informational responses, no-body responses, request-target forms, half-close behavior, timeouts, and connection cancellation.
• HTTP/2 and HTTP/3 awareness: supports HTTP/2 replay/direct-proxy paths, h2c replay, HTTP/3 primitives, QPACK validation, MASQUE/CONNECT-UDP, WebTransport, and WebSocket Extended CONNECT recognition where implemented.
• Backpressure and limits: capture size limits, storage limits, body spooling, and a connection cap protect the workstation during bursts.
• Auditability: user edits, match/replace modifications, and proxy-side changes are recorded for later review.

TLS and certificates

• TLS MITM is opt-in. Interceptor never silently decrypts TLS traffic and never installs CA trust automatically.
• Local CA management: export, rotate, or delete the generated CA from the app. Install trust manually only in authorized test profiles.
• Host controls: use global, scope-only, and per-host bypass rules to decide which destinations are decrypted.
• Upstream verification: keep upstream certificate verification enabled unless your test plan explicitly requires otherwise.
• mTLS: configure per-host client certificate rules for mutual-TLS environments.
• Pinning assessment: pinning diagnostics and bypass-intent markers document authorized lab boundaries; Interceptor does not automatically bypass application pinning.
• Diagnostics: SNI, ALPN, TLS version, cipher, certificate subject/issuer, validity, SANs, verification status, and ECH visibility limits are surfaced where available.

History review

• History: stores exchanges with method, URL, host, status, MIME, size, timing, scope, findings, annotations, and search metadata.
• HTTPQL-style filtering: filter captured traffic with fields (method:, status:, host:, has:json…) combined with boolean operators AND, OR, NOT and parentheses, e.g. method:get OR method:post.
• Click-to-build filters: clicking the HTTPQL field opens a popover of clickable filter chips (Method, Status, Type, Flags); selections within a category are OR-ed and categories are AND-ed, building the query for you while your typed text is preserved.
• Message viewer: inspect raw, headers, body, analysis, render, image/media, and hex-oriented views depending on content.
• Review ergonomics: search bars, regex/case modes, match counts, syntax highlighting, invisible characters, line numbers, safe HTML rendering, and switchable request/response layouts.
• Layout persistence: History placement, request/response layout, splitter positions, and compact UI choices are saved in project state.
• Send To workflows: send requests to Repeater, Attacker, Auth Matrix, Regression, Attack Path, Decoder, Comparer, GraphQL, Evidence, Report, or exports without losing context.

Repeater and replay

• Edit and resend HTTP requests in raw or parsed form.
• Replay HTTP/1.1, HTTPS, HTTP/2 over TLS, and h2c requests when target support and build features allow it.
• Use redirect controls, timeout controls, cookie jar mode, session macros, client certificate rules, and site auth token injection.
• Save replay attempts back into project history for comparison, reporting, and regression workflows.
• Send request or response content directly to Decoder or Comparer.

Attacker

• Mark payload positions and run single (one position at a time), broadcast (same payload in every position), lockstep (payload sets advanced in parallel), and combinator (every combination of payload sets) style attacks.
• Use payload sets for lists, numbers, dates, case mutations, and file-based input.
• Control rate limits, global concurrency, per-host concurrency, redirect behavior, cookie handling, pause/resume, graceful stop, and emergency stop.
• Track status, length, words, lines, duration, MIME, title, errors, grep matches, extracts, and baseline differences.
• Keep scope checks enabled so attack traffic remains inside the authorized target boundary.

Scanners and findings

Passive scanner

Passive scanning analyzes captured traffic without sending new target requests. It covers security headers, CSP, HSTS, framing controls, MIME sniffing, CORS, cache controls, cookies, JWT metadata, TLS observations, technology disclosure, mixed content, forms, JavaScript, GraphQL, and sensitive keyword indicators.

Active scanner

Active scanning is disabled by default, scope-aware, rate-limited, and controlled through explicit check selection. The catalog includes 45 checks covering reflected input, authorization indicators, harmless XSS reflection, SQL error observation, path traversal observation, open redirect, command injection observation, SSRF callbacks, CSRF token presence, SSTI, XXE, CRLF, OAST SQLi, LDAP, XPath, NoSQL, deserialization, expression language/OGNL, host-header injection, active CORS, JWT tampering, IDOR, timing differentials, TRACE/XST, sensitive path discovery, GraphQL introspection, mass assignment, user enumeration, SSI, verbose errors, HTTP parameter pollution, risky methods, secret exposure, web cache deception, prototype pollution, directory listing, and permissive CORS preflight.

Intrusive checks

ReDoS, unauthenticated HTTP PUT writes, malformed input fault injection, XXE file exfiltration, XML entity expansion DoS, traversal secret-file reads, and boolean SQL confirmation are gated behind a separate intrusive-check authorization and warning.

OAST callbacks

• OAST is disabled by default and requires explicit authorized-testing acknowledgement.
• The built-in HTTP callback service is loopback-scoped; valid base URLs must use localhost, 127.0.0.1, or 127/8.
• The DNS collaborator records local DNS-form callback tokens when configured with a collaborator domain.
• Interactions are retained for the configured retention period and correlated back into scanner findings where possible.
• A separate self-hosted OAST server can be used for controlled lab infrastructure when the test plan requires remote callback reachability.

API Surface and GraphQL

• API Surface: infers normalized routes from captured or imported traffic, groups observed methods/statuses, and links every inferred endpoint back to source exchanges.
• Shape evidence: summarizes request and response fields as traffic-backed hints, not authoritative contracts.
• Auth evidence: highlights Authorization, Cookie, API key, Set-Cookie, WWW-Authenticate, role, profile, permission, scope, claim, and group indicators.
• Endpoint checklist: creates testing items for authz comparison, input validation, cache behavior, sensitive data exposure, replay/regression coverage, and negative cases.
• Model diff: compares API model baselines for new/removed endpoints, changed status behavior, new response fields, auth evidence changes, and sensitive-looking fields.
• GraphQL: parses operations and variables, identifies query/mutation/subscription usage, and supports scanner-relevant introspection and risky input review.

WebSockets

• Capture WebSocket handshakes and frames with direction, opcode, payload length, and timestamps.
• Intercept matching frames by direction and opcode, then forward, drop, edit, or release queued frames.
• Replay crafted WebSocket payloads from WS Repeater for authorized endpoint testing.
• Export WebSocket sessions as text or JSON for external review and evidence packages.
• Recognize WebSocket bootstrapping over HTTP/1.1, HTTP/2 Extended CONNECT, and HTTP/3 Extended CONNECT where protocol support is present.

Network diagnostics and modern protocols

• Connection Inspector: tracks DNS, TCP connect, upstream proxy chaining, TLS handshake, bytes transferred, timing, errors, and close reasons.
• Packet Capture: uses proxy-mirror records by default and native libpcap capture when available. PCAP/PCAPNG evidence can be written with rotation settings.
• HTTP/2: covers frames, streams, SETTINGS, HPACK, h2c replay, direct proxy handling, trailers, safe GOAWAY/RST/error serialization, and priority diagnostics.
• HTTP/3: covers h3 ALPN awareness, QUIC-oriented modeling, frame/SETTINGS parsing, strict varint and boolean validation, and safe serialization primitives.
• QPACK: supports Huffman literals, dynamic references, dynamic indexed field lines, dynamic literal-name references, pseudo-header ordering, duplicate detection, and bounds checks.
• MASQUE/WebTransport: recognizes CONNECT-UDP, HTTP Datagrams, Capsule Protocol, IPv6 zone identifiers, WebTransport sessions, streams, datagrams, close/drain capsules, and related validation boundaries.
• ECH/SVCB/Alt-Svc: records Encrypted ClientHello visibility limits and HTTP/3 advertisements from DNS HTTPS/SVCB and Alt-Svc signals.

See the RFC coverage page for the protocol standards map.

Evidence, regression, and reports

• Testing checklist: track endpoint objectives, status, notes, exchange links, finding links, and Repeater links.
• Evidence Board: collect notes, exchanges, findings, Repeater references, tags, and report-ready Markdown.
• Regression: create regression entries from requests and rerun them through the replay engine.
• Attack Path: organize linked requests into multi-step testing paths and export relevant exchanges into Regression.
• Report: build a Markdown-oriented assessment report and append evidence directly from other panels.
• Findings lifecycle: review severity, evidence, remediation, active/passive source, and lifecycle status from the Findings panel.

Projects and storage

• Project files keep config, scope, target state, layout, Repeater tabs, checklist items, regression tests, evidence, and captured data together.
• SQLite stores exchange metadata, findings, annotations, audit entries, FTS indexes, WebSocket data, and project session data.
• Large bodies are spooled beside the database so big responses do not bloat the main SQLite file.
• Retention policies can cap database size and exchange age.
• Database integrity checks validate SQLite consistency and body spool references.
• Privacy redaction can remove cookies, authorization headers, API keys, and custom regex matches before persistence/export where configured.

Imports and exports

MCP for Claude

• Expose Interceptor's tools to Claude through a local MCP server (Model Context Protocol over Streamable HTTP), so Claude can drive the tool during authorized testing.
• Opt-in and off by default. Enable it in Settings → MCP; starting and stopping apply immediately, without restarting the app.
• The endpoint is bound to loopback only (http://127.0.0.1:8765/mcp) and gated by a bearer token that is generated when you enable the server. Use Regenerate token to rotate it. Cross-origin browser requests are rejected by validating the Origin and Host headers, and a per-session Mcp-Session-Id is issued on connect.
• Connect from Claude Code with the command shown on the settings page, for example: claude mcp add --transport http interceptor http://127.0.0.1:8765/mcp --header "Authorization: Bearer <token>"
• Available tools: repeater_replay (send an HTTP request through the scope-aware replay engine and get back status, headers, and body), repeater_send (open a new Repeater tab loaded with a raw request for review and replay), repeater_list_tabs (list the open Repeater tab titles), history_search (search the captured proxy History and return matching exchanges), and history_get_exchange (return the full request and response of an exchange by id).
• Requests remain subject to your target scope. Keep the endpoint on localhost and only enable it for authorized engagements.

Reporting integrations

• Push findings to an external pentest reporting tool over its REST API, without manual re-entry.
• SysReptor: in Settings → Reporting, set the base URL, a personal API token, and the target project id, then use Test connection.
• PwnDoc-ng: set the base URL, username, password, and a target audit id; it authenticates with the JWT session cookie returned at login.
• From the Findings panel, Send to report... and pick a backend to push all findings. A finding pushed before is updated instead of duplicated (an id link is stored per connector and target).
• Findings map onto each tool's fields, including a severity-derived CVSS vector, with evidence and request context. The captured request and response are attached as a proof-of-concept (size-bounded).
• The target project or audit id can be picked from a list fetched from the server (Choose... in Settings) instead of typed by hand.
• The push runs off the UI thread and reuses Interceptor's own HTTP/TLS stack, so there is no external runtime dependency. The API token and password are secrets.

Browser extension (Firefox)

• The companion Interceptor Bridge Firefox extension (Manifest V3, shipped in extensions/firefox/) routes the browser through Interceptor and colours History rows by Firefox container. It is Firefox-only: it relies on the container and blocking webRequest APIs.
• Pair it: in Settings → Browser bridge, enable the bridge and copy the generated pairing token. Load the extension via about:debugging (Load Temporary Add-on → select manifest.json), open its Settings, set the Interceptor host/port, paste the token, and save.
• Colour by container: turn Proxy routing On from the toolbar, then browse in a Firefox container. Each request is marked with X-Interceptor-Color / X-Interceptor-Container; Interceptor maps the container colour to a History highlight swatch and records the container name.
• Send to Repeater: right-click a page and choose Send this page to Interceptor Repeater (available once routing is on and paired). The tab is reloaded in its container so the request is re-issued with X-Interceptor-Action: send-to-repeater.
• Strip security headers: an option removes Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options from responses to ease framing and injection testing.
• Safety: the markers are only added while routing is on, are authenticated by the pairing token, and Interceptor strips every X-Interceptor-* header before relaying upstream and never stores them in history — so neither the marker nor the token reaches the target server. The bridge is off by default.

Settings reference

Keyboard shortcuts

• F1: About Interceptor.
• F5: Refresh History.
• F9: Start proxy.
• Shift+F9: Stop proxy.
• Ctrl+,: Settings.
• Ctrl+H: Focus History.
• Ctrl+R: Send to Repeater.
• Ctrl+I: Send to Attacker.
• Ctrl+D: Send to Decoder.
• Ctrl+E: Export selected as HAR.
• Ctrl+1 to Ctrl+5: switch major workspace groups.
• Ctrl+PgUp / Ctrl+PgDn: switch tabs.

Troubleshooting