Tool simulation
Proxy History
Traffic workflow
Browse the shop in the Browser pane (or inspect the captured exchange), then submit the query parameter that determines which order record the server returns.
New to this workspace? Target maps every captured host and path. Proxy holds Intercept and HTTP History. Repeater lets you edit a request and resend it in its own tab. Intruder automates a payload across a request and flags the outlier response. Decoder and Comparer transform and diff values.
Loading...
Site map
Exchanges under api.acmeretail.local
Select an exchange to open it in the Proxy tool.
| # | Method | Host | Path | Status | Length | Note | Actions |
|---|---|---|---|---|---|---|---|
| GET | api.acmeretail.local | /orders/detail?order_id=1042 | 200 | 112 | The shopper's own order, opened normally from the confirmation page. |
GET /orders/detail?order_id=1042 HTTP/1.1Host: api.acmeretail.localCookie: session=shopper-88f2Accept: application/json
HTTP/1.1 200 OKContent-Type: application/json{"order_id":1042,"owner":"shopper-88f2","total":42.10,"items":2}
The shopper's own order, opened normally from the confirmation page.
Intercept
Off - captured traffic flows straight to HTTP History.
Editing: GET /orders/detail
HTTP/1.1 200 OKContent-Type: application/json{"order_id":1042,"owner":"shopper-88f2","total":42.10,"items":2}
6 of 6 candidate positions active. Click a highlighted value to toggle it.
GET //?order_id= HTTP/1.1 Host: Cookie: Accept:
Clearing every category still runs the full library; check at least one to narrow it down.
'Single quote used to probe for unescaped SQL string concatenation.' OR '1'='1Boolean tautology used to check whether a WHERE clause can be reshaped by input.
<secmissions-probe>reflected</secmissions-probe>Inert placeholder tag used to check whether input is reflected without output encoding.
../../../etc/passwdRelative traversal sequence used to check whether path input can escape an intended directory.
http://127.0.0.1/Loopback destination used to check whether a fetch-by-URL feature reaches internal addresses.http://169.254.169.254/latest/meta-data/Well-known link-local metadata address used to check for unrestricted server-side fetches.
6 payloads ready to run.
Reading the outlier is the point: the response with a different status or length is the one that proves the flaw, regardless of how ordinary or dramatic that payload's own syntax looks.
No attack has been run yet. Configure positions and payloads, then start the attack.
0 added · 3 removed · 0 changed · 1 unchanged
6 commands available in this tool
helphistoryinspectshow <number>mark <evidence>submit