#1Tools for intercepting, analyzing, and modifying web traffic for security testing.
Kitploit recommended
caido/caidoLightweight web proxy for intercepting, inspecting, and modifying HTTP traffic to audit web applications during penetration testing and bug bounty…
weirdmachine64/redomA Burp Suite extension that brings full DOM rendering capabilities directly into Burp, enabling effective security testing of modern JavaScript-heavy…
denuitt1/mhr-cfwA Domain-Fronting Relay that routes traffic though GAS (Google Apps Script) and forwards it to Cloudflare Workers. Designed to bypass DPI.
nccgroup/http-mcp-bridgeHTTP proxy bridge for security testing of remote MCP servers, allowing standard HTTP tools to send JSON-RPC messages and manage sessions.
synacktiv/hoplaHopLa Burp Suite Extender plugin - Brings AI capabilities, autocompletion support, and a set of useful payloads to Burp Suite
0xbartita/cookie-swapperBurp Suite extension that auto-replaces cookies and headers in requests using configurable rules. Eliminates manual copy-pasting of session tokens…
syss-research/wcfproxyA proxy for net.tcp-based WCF traffic.
cappricio-securities/burpflowBurpFlow is one of the best Burp Suite automation tools for bug bounty hunters and penetration testers, widely used to load recon data via proxy and…
dereeqw/web-mitm-labWeb traffic interception simulation tool for cybersecurity research and defensive learning in isolated lab environments.
ignitetechnologies/burpsuite-for-pentesterThis cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and…
adityatelange/frida-uiInteract with Frida devices, processes, and scripts directly from your browser.
proxymanapp/atlantis-androidCapture HTTP/HTTPS traffic from Android apps and send to Proxyman for debugging.
rhinosecuritylabs/iprotate_burp_extensionExtension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.
httptoolkit/httptoolkitHTTP Toolkit is a beautiful & open-source tool for debugging, testing and building with HTTP(S) on Windows, Linux & Mac :tada: Open an issue here…
singe/burp_global_match_replaceMatch & Replace rules for Portswigger's Burp that operate globally across all utilities.
matank001/moxyMoxy is an open-source DAST tool designed for modern web application security testing. It provides an easy-to-use interface with agentic capabilities…
repplus/rep-chromerep+ — Burp-style HTTP Repeater for Chrome DevTools with built‑in AI to explain requests and suggest attacks
pentagridsec/pentagridresponseoverviewResponse Overview Extension for BurpSuite - Find exotic responses by grouping response bodies
