Follow the request.
Understand the signal.
One workspace to discover endpoints, enumerate paths, inspect ports, edit requests and understand captured traffic.
Start an investigation ↘Discover. Enumerate.
Then investigate.
Discovery scan log
Less guesswork.
More understanding.
Variables & user contexts
Example: {"Authorization":"Bearer your-test-token"}. Header overrides are case-insensitive. The no-auth variant removes common credential headers and keys configured in A/B; URL/body credentials are unchanged.
Paired/repeated checks use GET/HEAD only. Other methods are sent one request at a time. Responses are kept in memory (latest 40); no automatic browser or database persistence.
Compare evidence & write findings
A matching HTTP status or body does not confirm unauthorized access. Validate that the data is private, the identities are distinct and the resource belongs to the expected test user.
Credential headers are redacted by default. URLs and bodies can still contain private data; review before sharing.
Observe first.
Then investigate.
TrafficLens helps you read browser captures. AccessLab compares actions from two users. Payload Playground explains how an input changes across contexts. Repeater sends a request only when you choose to run it.
HAR means HTTP Archive: a JSON export from the browser Network panel. It may include response content, headers and timings. HAR comparison is observation; it cannot establish an authorization vulnerability on its own.
This website does not intercept HTTPS or replace a desktop proxy. No certificate authority is installed. Browser restrictions and the data available in your capture determine what can be analyzed.