// what you get
Pause any request or response, rewrite it inline, and forward. Full TLS interception with a CA you control.
Send a captured request to Repeater, tweak the payload, fire it 1 or 1000 times. Diff responses side by side.
200k+ rows on a 16GB box. SQLite-backed, indexed and filterable by host, method, path, or status.
Rule-based rewriting on the wire. Regex headers and bodies in both directions without touching the client.
Drop a single file into the extensions dir. Hook the request lifecycle in JavaScript. No marketplace gate.
Your captures never leave the machine. No telemetry, no account, no license server. Air-gap it if you want.
// honest comparison
Three good tools. Here's where each one wins, no spin.
| Capability | nullock | Burp Suite | mitmproxy |
|---|---|---|---|
| License | MIT, free | Commercial | MIT, free |
| Desktop GUI | ✓ native | ✓ | terminal / web |
| Repeater + diff | ✓ | ✓ (Pro) | manual |
| Scriptable extensions | ✓ JavaScript | ✓ Java | ✓ Py |
| History at 200k rows | ✓ SQLite | heavy | in-memory |
| Passive detectors | ✓ 100+ kinds | ✓ ~70 | none |
| CWE / OWASP / CVSS tags | ✓ on every finding | ✓ (Pro) | — |
| CVE correlation | ✓ built-in | add-on | — |
| GraphQL attack probes + schema audit | ✓ 5 attacks + introspection | add-on | — |
| DOM-XSS taint analysis | ✓ proxy-side | ✓ in-browser | — |
| Request chains (variable passing) | ✓ | macros only | — |
| JWT attack toolkit | ✓ core | add-on | — |
| Hidden parameter mining | ✓ core | add-on | — |
| IDOR / BOLA auto-detection | ✓ | manual | — |
| Mass-assignment scanner (API #6) | ✓ | manual | — |
| Active CORS exploitability | ✓ proves it | passive | — |
| JS endpoint + source-map recon | ✓ | sitemap only | — |
| Race-condition tester | ✓ core | Turbo extension | — |
| Verb-tampering auth bypass | ✓ | — | — |
| SSTI detection + engine fingerprint | ✓ core | manual | — |
| Web cache poisoning (safe-confirm) | ✓ core | Param Miner add-on | — |
| Open redirect (resolved-host confirm) | ✓ core | manual | — |
| CSP audit (gadget-host aware) | ✓ core | basic header check | — |
| Secret scan in JS (masked) | ✓ core | add-on | — |
| CRLF / response splitting (confirmed) | ✓ core | passive hint | — |
| Path traversal / LFI (content-confirmed) | ✓ core | add-on | — |
| OS command injection (exec-confirmed) | ✓ core | add-on | — |
| Reflected XSS (context-confirmed) | ✓ core | add-on | — |
| SQL injection (error-based + DBMS fp) | ✓ core | add-on | — |
| XXE (content-confirmed file read) | ✓ core | add-on | — |
| NoSQL injection (operator differential) | ✓ core | add-on | — |
| HTTP request smuggling (CL.TE/TE.CL) | ✓ core | extension | — |
| Service-version CVE scan (nmap-vulners) | ✓ core | — | — |
| Port-scan → findings + CVE bridge | ✓ core | — | — |
| Recon→vuln pipeline (point-at-host) | ✓ one command | manual chaining | — |
| TLS/cert inspection (testssl-class) | ✓ core | — | — |
| Active tech fingerprint (WhatWeb-class) | ✓ core | passive | — |
| HTTP method / WebDAV / XST audit | ✓ core | passive | — |
| Subdomain takeover detection | ✓ core | add-on | — |
| One-call host assessment | ✓ core | manual | — |
| Sensitive-file exposure (.git/.env/...) | ✓ core | add-on | — |
| robots.txt / sitemap recon | ✓ core | crawl only | — |
| WAF / CDN detection (wafw00f-class) | ✓ core | — | — |
| Web cache deception | ✓ core | manual | — |
| One-command deep audit (whole battery) | ✓ audit all | per-insertion config | — |
| HTML / Markdown engagement report | ✓ core | ✓ (Pro) | — |
| JSON master report (CI bundle) | ✓ core | Enterprise API | — |
| Host-centric asset inventory (risk-sorted) | ✓ core | site map only | — |
| CycloneDX SBOM export | ✓ core | — | — |
| Findings baseline / diff (re-test deltas) | ✓ core | Enterprise only | — |
| Security posture grade (A–F score) | ✓ core | — | — |
| OWASP Top-10 / compliance coverage | ✓ core | Enterprise only | — |
| Live CVE feed sync (runtime overlay) | ✓ core | add-on | — |
| AI payload generation | ✓ local Ollama | — | — |
| Authorization tester | ✓ multi-user | ✓ (Pro) | — |
| Token randomness (Sequencer) | ✓ free | ✓ (Pro) | — |
| OAST / collab callbacks | ✓ self-host | ✓ (Pro, cloud) | — |
| OAST auto-correlation (confirmed SSRF) | ✓ free | ✓ (Pro) | — |
| DNS OAST sink (Log4Shell / blind exfil) | ✓ self-host | ✓ (Pro, cloud) | — |
| Telemetry | none | opt-out | none |
| Price to get started | $0 | $475/yr | $0 |
// 30-second quickstart
# grab the binary for your OS from Releases, then: NullockApp --proxy-port=8080 --control-port=17777 # trust the generated CA · point your browser at 127.0.0.1:8080 nullock scope add 'https://target.example/*' nullock scan target.example top100 # ─── running · findings streaming in ───
// roadmap
Render SPAs in a headless browser to confirm DOM-XSS sinks in-page and crawl client-rendered routes.
Decode QUIC streams with a local key log — detection already ships.
Share a read-only capture session over the LAN with a self-hosted relay.
One-click first run — notarized macOS .dmg and signed Windows builds.
Pay for hosted services if you need them, or for support if you want a human on email.