Web Tools 2026

General
,
1

It’s been a minute since we’ve discussed tools for web tests. What are we using these days? Anything new and exciting we should know about?

I’m still on the fence about Caido. ZAP has been fine, if a bit stale. I’m really hoping there’s better tooling for modern JavaScript apps that I haven’t seen yet.

General Tool Show and Tell
2

I’ve been using caido lately, and ignoring the assistant (mainly because I don’t have any premium features). I’m not a power user by any means, but it’s more comfortable for me than zap is, coming from burp. It’s a lot faster than burp is as well. The main reason I’d consider upgrading is for access to more than three plugins at a time. It does enough for what I need, but I’d like to learn some more tooling as well.

3

Don’t fall for the trap. Taggart is just baiting us before the rug pool that he’s been building a brand new web proxy testing tool in secret, from scratch, and entirely in Rust. It’ll be called the ITT (Intrusion Testing Tool). Mark my words.

4 Likes
4

Been reading my dream journal again I see.

For real though, a proper FOSS Rust proxy is a market gap.

5

I’ve also used HTTP Toolkit, it’s nice and although for a fully feature version, there’s a paywall, it’s cheap enough to make it worth it. And it excels at intercepting desktop apps web traffic without much trouble.

6

I’m still a Burp user, especially as the whole Bambda and Montoya API get more mature, it’s becoming much easier to create macros, filters, and extensions on the fly as opposed to sitting and committing hours of dev time. That said, I have the luxury of being able to use Burp Pro through work, which isn’t necessarily accessible to everyone, but I do end up spending most of my time sitting in Burp.

I was trying to put together a list of stuff I know I use regularly, but as I was thinking about it, I really do just use Burp:

  • Project Discovery’s Tools - not new by any means, and thoroughly embraced by the bug bounty community at this point. I’ve just slept on some of them like katana.
  • Burp Extensions
    • Autorize - The UI is a little confusing, but it’s extremely useful to be able to run authorization tests while passively exploring the app.
    • Hackvertor - Allows you to use tags when you modify requests in Burp to let you type in plain text and automatically encode text for you
    • InQL - Easily takes introspection output or JSON schema and gives you the structure for GraphQL requests
      • Postman also has a clean UI to do this, though I don’t really like using Postman for reasons that have been discussed by Taggart and others before.
    • BlackboxProtobuf - I’ve run into a few apps that use protobufs, which is extremely hard to test without having the protobuf definitions already. This repo by NCC group has a few different implementations (library, Burp extension, mitmproxy add on) that all allow you to “decompile” and “recompile” protobufs to modify the data in a human-readable format.
  • Experimental
    • Google’s JSIR - This is something I only saw recently and I need to find time to play around with it, but this might be interesting to break down static JavaScript files.
7

Katana is so good, and it also (unfortunately) handles Anubis juuust fine.

8

learning more about/practicing better recon lately and holy smokes these are awesome

1 Like