rep-chrome — rep+ — Burp-style HTTP Repeater for Chrome DevTools with built‑in AI to explain requests and suggest attacks | Kitploit

Unified Extractor: secrets, endpoints, and parameters from captured JS.
Secret Scanner: entropy + patterns with confidence scores; pagination and domain filter.
- Powered by Kingfisher rules for comprehensive secret detection
- Supports AWS, GitHub, Google, Slack, Stripe, Twilio, Azure, and many more service providers
- Rules stored locally in rules/ directory for offline use
- Note: Secret scanning only analyzes JavaScript files from the current inspected tab.
- Export: Export all secrets to CSV for analysis and reporting
Endpoint Extractor: full URLs, relative paths, GraphQL; method detection; one-click copy (rebuilds base URL).
- Export: Export all endpoints to CSV with method, endpoint path, confidence, and source file
Parameter Extractor: passive JavaScript parameter discovery with intelligent grouping and risk assessment.
- Parameter Types: Extracts query, body, header, and path parameters from JavaScript files
- Grouped by Endpoint: Parameters are organized by endpoint with expandable/collapsible groups
- Risk Classification: Automatically identifies high-risk parameters (auth, admin, debug flags, IDOR, feature flags)
- Confidence Scoring: Stricter confidence model than endpoints to reduce false positives
- Smart Filtering: Suppresses common false positives (webpack, React, jQuery, DOM events, telemetry)
- Copy as cURL: One-click copy generates curl commands with all parameters properly formatted
- Location Badges: Visual indicators for parameter location (query/body/header/path)
- Domain Filtering: Filter parameters by source domain with accurate counts
- Column Sorting: Sort by parameter name, location, endpoint, method, risk level, or confidence
- Export Options:
  - CSV Export: Export all parameters with location, endpoint, method, risk level, and confidence
  - Postman Collection Export: Generate ready-to-import Postman collection JSON with all endpoints and parameters
    - Automatically groups parameters by endpoint
    - Includes query, body, and header parameters
    - Uses Postman variable syntax ({{paramName}}) for easy testing
    - Perfect for security testers who want to quickly import discovered APIs into Postman
Response Search: regex support, match preview, pagination, domain filter.

Interactive Chat Interface: Real-time conversation with AI about your HTTP requests and responses
- Streaming responses with live markdown rendering
- Syntax highlighting for code blocks (supports multiple languages)
- Copy-to-clipboard for code blocks with visual feedback
- Token usage counter with color-coded warnings
Per-Request Chat History: Each request maintains its own conversation history
- Automatically saves chat when switching between requests
- Restores previous conversations when returning to a request
- Clear chat button resets only the current request's conversation
Cross-Reference Previous Requests: Reference investigations from other requests
- "Reference previous requests" UI with collapsible/expandable list
- Select which previous requests to include in context
- AI receives summaries of previous investigations for referenced requests
- Perfect for multi-step testing scenarios (e.g., login → authenticated request)
Request Modification: AI can modify requests directly in the editor
- "Apply modifications" button appears when AI suggests changes
- Smart detection: only shows when modifications are actually suggested
- Preserves request structure (headers, formatting, HTTP version)
- Animated application with visual feedback
- Supports header updates, body modifications, and new header additions
Response History Tracking: Tracks multiple responses from resends
- Maintains chronological history of all responses (original + resends)
- AI has context on all responses when analyzing changes
- Conditional inclusion: only includes full history when relevant (token optimization)
Smart Context Management: Intelligent token optimization
- Response truncation for large responses (~1,500 tokens max)
- Chat history compression (summarizes older messages)
- Conditional response inclusion (only when asked about)
- Limits response history to last 2-3 responses
- Keeps last 15 messages in conversation history
Multi-Provider Support: Works with Claude, Gemini, and local Ollama models
- Automatic model detection for Anthropic and Gemini APIs
- Manual URL/model configuration for local models
- Streaming support for all providers
Use Cases:
- Security testing and penetration testing guidance
- Request/response explanation and debugging
- Automated request modification for testing
- Bug bounty report generation
- Vulnerability identification and attack vector suggestions
- Multi-step attack chain planning with cross-request context

Clone the repository:

git clone https://github.com/bscript/rep.git

Open Chrome Extensions:
- Navigate to chrome://extensions/ in your browser.
- Enable Developer mode (toggle in the top right corner).
Load the Extension:
- Click Load unpacked.
- Select the rep folder you just cloned.
Open DevTools:
- Press F12 or right-click -> Inspect.
- Look for the rep+ tab (you might need to click the >> overflow menu).

Stop any running Ollama instance.
Start Ollama with CORS enabled (pick one):
- Allow only Chrome extensions:
```
OLLAMA_ORIGINS="chrome-extension://*" ollama serve
```
- Allow everything (easier for local dev):
```
OLLAMA_ORIGINS="*" ollama serve
```
Verify your model exists (e.g., gemma3:4b) with ollama list.
Reload the extension and try again. If you still see 403, check Ollama logs for details.