// what you get
Pause any request or response, rewrite it inline, and forward. Full TLS interception with a CA you control. A RULES panel decides which messages actually get held — And/Or match rules on file extension, method, URL regex, host glob, content-type, status code, or header, each with per-rule negate and a request/response/both direction, live-editable and reorderable (an empty list holds everything, matching Burp). Pivot a held message straight to Repeater, Intruder, Comparer, or Decoder — or fire the active-test battery at a held request directly with Scan. A per-message FORWARD, HOLD RESPONSE button opts just the current held request into response-holding — forward it and see its response even while the global RESPONSES toggle stays off for everything else. Eight client-side-control removals — unhide fields, enable disabled inputs, strip length limits, drop JS validation or scripts, remove <object> tags, downgrade HTTPS links, strip the Secure cookie flag — sit behind a standing auto-apply toggle set (persisted, fires on every future held response the instant it's captured, matching Burp's Options checkboxes) plus manual one-click buttons for the currently-held item. The held-message editor has EDIT/PARAMS/HEADERS/BODY/PREVIEW/HEX/INSPECTOR view tabs, with in-view find — Pretty-printed JSON/XML, a hex dump, an editable query/body-form/cookie Params grid, an editable Headers table (add / remove / reorder with per-row buttons) on both the held request and response, and a structured Inspector side panel, the same view primitives and parsed breakdown Repeater's editor uses. A FIX NEW LINES toggle (on by default, like Burp's) repairs a hand-edited request's header/body boundary before it goes out — restoring a blank line the edit dropped, or trimming stray ones it left behind — while a request that already declares a real body is always sent exactly as typed, so a deliberate desync probe still gets through.
Send a captured request to Repeater, tweak the payload, fire it once and diff responses side by side. A Pretty view auto-indents JSON, XML, and HTML bodies alongside the raw/headers/body/hex/inspector tabs — headers is an editable table (add / remove / reorder with per-row buttons) that writes straight back into the raw request. "Send to Comparer", "Send to Decoder", and "Send to Sequencer" pull either editor pane (or a selected token) straight into those tools with one click, and the request pane also promotes the draft straight to a new Intruder attack template or fires the active-test battery at it directly with Scan, findings streaming into Issues. A per-tab NOTES button records what each tab is testing, with a tab-strip indicator so you can tell your tabs apart at a glance. Each tab also keeps a capped history of its prior sends — ◀ ▶ buttons step back through them (with a live status/timestamp tooltip) and reload any one into the editor for review or re-send. An AUTO-CL checkbox recomputes Content-Length from the edited body before every send (Burp's default, on out of the box); turn it off from the GUI to hand-craft a deliberately desynced CL/TE request. A FOLLOW selector (never / on-site / in-scope / always) chases 3xx redirect chains to the final page, with a COOKIES checkbox threading the original request's cookies plus every Set-Cookie along the way — no more copy-pasting a Location header into a new tab and rebuilding the cookie jar by hand. A ⇄ METHOD button toggles GET/POST, moving params between the query string and an x-www-form-urlencoded body, and a ⇄ ENCODING button converts that body to multipart/form-data and back — both recompute Content-Type/Content-Length so the request stays well-formed.
Sniper, Battering ram, Pitchfork, and Cluster bomb from a GUI mode picker — Pitchfork/Cluster bomb get a per-position payload-set editor. A generator dialog builds numbers (range/step/hex/zero-padded), dates, or a brute-forcer wordlist with a live count-and-sample preview before you apply it. A processing rule chain (prefix/suffix/case/reverse/match-replace/encode/hash) transforms every payload before it hits the wire. A resource-pool row sets concurrency, an inter-dispatch throttle, and a retry count (0-5) resent on a network-level failure — connect refused/timeout/reset — never on an HTTP error status. Results are sortable by any column and filterable by status class, length, or a regex/negative search. The same FOLLOW/COOKIES redirect-chasing controls as Repeater grade each fired request against its final 3xx-followed page — so a bruteforce behind a login redirect scores real content instead of a column of 302s, and a single-row Resend grades against that same final page too.
SQLite-backed, indexed and filterable by host, method, path, status, in-scope, parameterized, hide-404, MIME class, or file extension (show/hide). Search is case-sensitive-toggleable and a leading "-" negates a term. Add hosts to scope by pasting a URL, loading a list, or right-click on any row. A DB Search overlay queries the SQLite index directly by method/host/path/status/size/since, at engagement scale rather than the bounded on-screen window, and opens any matched row's full raw request/response even if it has since been evicted from view. Each Site map host expands into a full protocol://host:port → directory → file tree — every path segment its own expandable folder, leaves deduped by method+path (most recent request wins) — click a leaf to jump straight to that message's editor instead of hunting for it in the history table, or click a folder to scope the history table (and Deep Search's regex-over-bodies results) to that branch, shown and cleared via a scope banner in the Site map pane. A "log out-of-scope traffic" checkbox in the Scope tab keeps the default Burp behaviour of dropping out-of-scope items from history and live tasks, or flip it on to browse broadly first and scope down later — each retained out-of-scope row is dimmed with a ⊘ marker in the history table so it's legible at a glance which captured rows fall outside the current scope. Right-click any history row or Site map leaf to flag it with one of 9 highlight colours and/or a free-text comment — shown as a coloured row edge and a comment icon, filterable via an ANNOTATED chip in either view; persisted client-side to this browser. Manually hand-add a URL to the Site map without sending it, or promote a Discover-tab robots.txt Disallow path / sitemap.xml URL with a one-click "+ map" button — each lands greyed-out and dashed ("not sent") in the tree, distinguishing an unrequested node from real captured traffic. Right-click a host, a folder, or a single leaf for COPY URLS (plain-text list), COPY LINKS (clickable HTML, for pasting into tickets/docs), SAVE SELECTED ITEMS (a Burp-site-map-shaped XML download with the full captured request/response, base64), DELETE HOST / DELETE BRANCH (client-side hide, removed from the site map, history table, and Compare Hosts alike, with a filter-bar chip to see the hidden count and restore in one click), or REPORT ISSUES (a standalone, severity-sorted HTML issue report), scoped to whatever was clicked.
Rule-based rewriting on the wire. Regex headers and bodies in both directions without touching the client.
Burp's macro-driven session handling, in a named rules editor on the Sessions tab: extract a value from a matched response by header, cookie, JSON path, or regex, store it under a variable, and inject it into every subsequent matched request — header, cookie, body, or URL query — scoped by host and path glob, and by a Proxy/Repeater/Intruder/Scanner tools-scope checkbox row per rule (Burp's "Tools scope"; enforced for Proxy, Repeater, Intruder, and HTTP scanner sends). Rules can be added, edited, deleted, and individually enabled or disabled; captured variables show live with a one-click clear. A companion Login macros section names a recorded login sequence — record its steps straight from Proxy history — then runs it on demand or lets it auto-re-run when a logged-out status/body-regex condition matches a live response, Burp's "run a macro" rule action.
Structured breakdown of any request or response — headers, cookies, query and body params, and JWTs decoded right where they sit. Paste-and-parse in its own tab, or docked live in Repeater, Proxy history, and Intruder's template editor. A Selection widget section reports the highlighted text's character count plus the first byte's decimal/hex value, labelling non-printing bytes (\n/\t/\r/space) instead of hiding them — a routine step when chasing header-injection or parser-differential bugs. Every header/cookie/query/body-param value carries its own automatic, revisable multi-step decode chain — gated URL/Base64/HTML auto-detection up to 6 layers deep, with a per-step dropdown to retarget the technique the auto-detector picked and see every step below it recompute. A JWT TOOLKIT mode adds an active attack toolkit — offline decode with weakness flags and HS* secret brute-force, alg:none and HS256-resign/algorithm-confusion forging, and a live calibrated acceptance test against a target that confirms whether a forged token is actually accepted.
Twenty-five on-demand checks — SQLi, XSS, SSRF, SSTI, IDOR, XXE and more — launchable against an authorized target from one panel. Findings land in Issues. A one-click "Deep audit all rows" sweep runs the full battery (LDAP/XPath/smuggling/host-header/cache-poisoning/deserialization/NoSQLi/mass-assignment/CORS and more) throttled against every captured history row. The Probe tab adds on-demand tech/CVE fingerprint, security-header audit, WAF detection, client-side secret scanning, and a GraphQL toolkit — schema introspection with dangerous-mutation/sensitive-field flagging plus a five-attack active probe suite (introspection, field suggestion, alias amplification, depth bypass, batched queries).
The Issues tab lists findings flat, grouped by kind+host with instance count, max CVSS, and CWE/OWASP rollup so a hundred hits on one bug read as one row, or as Definitions — a browsable, filterable library of every issue kind the scanner can report (CWE/OWASP/CVSS/compliance/confidence/remediation) independent of whether it has been found yet, drawn from the same enrichment table applied to live findings so the two can never drift apart. A Baseline bar saves a findings snapshot and diffs the current set against it later — new / fixed / unchanged, for repeat engagements. A per-finding Triage button asks a local Ollama model for an impact/fix/false-positive read, falling back to a heuristic verdict when Ollama isn't running. Clicking a finding opens an inline detail pane with Advisory (CWE/OWASP/CVSS/compliance/fix guidance), Request, and Response sub-tabs, with the scanner's evidence string highlighted directly in the raw traffic. Every finding also carries a false-positive toggle, a severity-override selector, and a soft delete/restore, plus a per-kind mute — all persisted per project and reversible with no re-scan.
Self-hosted out-of-band interaction client. Mint a callback URL, paste it anywhere on the target, and watch HTTP interactions land in a live-polled panel — source IP, headers, and body preview per hit, with copy-to-clipboard on every minted payload. A Blast panel fires the same tab's target URL straight through a multi-vector SSRF/blind-XXE/blind-RCE/Log4Shell spray in one call, listing every fired vector so confirmed callbacks can be matched back to the class that triggered them.
Wordlist directory/file brute-force with soft-404 calibration, robots.txt + sitemap recon, and a start/stop control for the BFS crawler — all one panel. Paste or load a custom wordlist from a file, add extension-bruteforce suffixes for the classic backup sweep (.php/.bak/.old/.zip), and tune request concurrency and throttle for rate-limited or WAF'd targets.
Statistical randomness analysis for session tokens, CSRF tokens, and reset-URL tokens. Paste a corpus, load it from a file, paste from the clipboard, or select a value in Proxy history or Repeater and click SEQUENCER/SEQ to send it straight into the corpus — a live sample summary (count, shortest/longest/mean length) shows before you analyze. A Live capture panel drives the token-harvest engine directly: point it at a request (host/port/TLS + raw request template), pick where the token lives (header/cookie/JSON path/regex/status code/start-end delimiters), set a shot count and throttle, and hit START — harvested tokens stream into the same corpus as they land, with a live progress readout (done/harvested/empty/HTTP errors/transport errors). In cookie mode a "cookies seen so far" dropdown auto-populates from the Set-Cookie names actually observed in captured responses, so the extraction key can be picked instead of typed blind. Results cover Shannon entropy, character-class breakdown, Hamming distance, longest common substring, sequential/monotonic counter detection, and per-position + bit-level (monobit/two-bit/serial-correlation) tests where the corpus qualifies. EXPORT HTML / EXPORT XML buttons download a standalone report of the current analysis.
Drop a single file into the extensions dir, or install from the in-app Marketplace — searchable, category-filtered, with a per-extension detail panel (source link, permissions, sha256) and a Settings-tab badge on every loaded script showing exactly what it declared: modifies traffic or observe-only. Each installed extension gets a "Loaded" checkbox to disable it in place without deleting the file — the choice persists and takes effect immediately. An entry that requires a newer Nullock build is flagged with an "incompatible" badge and a disabled Install/Update button. An "Install bundled" button copies the extensions shipped with Nullock straight into your extensions dir, no manual file-hunting required. An "Auto-reload (dev)" checkbox watches the extensions folder and debounce-reloads everything ~300ms after any script is added, removed, or edited, for iterating on an extension without a manual Reload click each time.
One-click Markdown, styled HTML, JSON, and Burp-style XML issue reports; reverse-engineer or seed an OpenAPI spec from captured traffic; CycloneDX SBOM export; push/pull findings against a shared workspace.
Generate an auto-submitting CSRF proof-of-concept page for any captured request, one click from Proxy history or the site map — form-based for urlencoded/multipart bodies, a credentialed fetch() PoC otherwise. Download or copy to host on an attacker-controlled page.
Generate a clickjacking proof-of-concept page for any captured request, one click from Proxy history or the site map — frames the request's URL in an invisible iframe over a decoy button. Download to host on an attacker-controlled page; check X-Frame-Options / frame-ancestors on the response to know whether a real browser would allow the framing.
Multi-identity replay for a captured request — define named identities as header overlays (session cookie, bearer token, ...), replay the same request as each, and see a per-identity status/size table with a divergence flag. Divergent responses hint at BOLA / horizontal / vertical privilege issues and also file a finding in Issues, one click from Proxy history or the site map.
Inject a frame straight onto a live WebSocket tunnel — pick the session, direction (client→server / server→client), and opcode (text, binary, close, ping, pong), edit the payload, send, and one-click resend the last frame. One panel over the tunnels the intercepting proxy is currently relaying, no separate client required. A captured text-frame message in Proxy history opens straight into it, payload pre-filled and a still-open session on that message's host:port pre-selected — binary/close/ping/pong frames stay out of reach of this reissue link since only a text frame's real bytes survive into the history view.
A dedicated tab for captured WS traffic, grouped into a connection list by host:port. Each message gets real columns instead of the pseudo-HTTP placeholders the Proxy tab's history table used to show for it — direction, type (text/binary/close/ping/pong, deflate/continued flags decoded), and length — plus direction and type filters and a per-message free-text comment. Selecting a message opens the same Raw/Headers/Body/Hex/Inspector detail pane and Send-to-Repeater/Intruder/Comparer/Decoder/Sequencer pivots as Proxy history. Captured on the TLS-MITM leg only — a plaintext ws:// tunnel isn't relayed yet — and two concurrent tunnels to the same host:port share one connection bucket, since a history row carries no per-tunnel session id.
A frame-level view of HTTP/2: a per-stream summary table (method/path/status/bytes in-out/frame counts/open-closed) and a live-tailing raw frame feed (type — DATA/HEADERS/PRIORITY/RST_STREAM/SETTINGS/PUSH_PROMISE/PING/GOAWAY/WINDOW_UPDATE/CONTINUATION — flags/stream/bytes/error code) captured on either MITM leg of any HTTP/2 connection the proxy negotiated via ALPN, one button away from the Proxy tab's HTTP HISTORY pane.
One-shot target assessment (fingerprint + CVE correlation + header/method/TLS audit), a synchronous deep-audit run against a single URL with per-tester include toggles, a response-diff hidden-parameter miner, multi-step raw-HTTP request chains with variable extraction/substitution (record the steps by hand or straight from Proxy history row IDs), and the capstone pipeline that bridges port-scan results straight into a full web assessment — all from the SCANS tab, alongside on-demand posture grade, asset inventory, OWASP/compliance coverage, and CI-gate pass/fail rollups. A "Port scan → findings" section promotes the port scanner's current results (exposed database/remote-admin/management-API/cleartext/file-share, plus banner→CVE correlation) into the same findings list, report, and gate check as every web finding — idempotent, so re-running it after a fresh scan never duplicates. The port scanner itself also accepts an imported nmap `-oX` XML file alongside its own live scans. The same tab also drives an exposure scan (curated .git/.env/actuator/backup path probe, confirmed by content signature), a service CVE correlation scan (banner-grab a host's open ports against a curated CVE table), JS recon (mines a page's same-origin JS bundles for API endpoints, hardcoded secrets, and exposed source maps), a TLS/certificate inspection (live connection, flags expired/self-signed/weak-key/hostname-mismatch/legacy-protocol config), an HTTP/3 detection probe (reads the Alt-Svc response header for advertised h3/h3-* support), a Detection templates section running the bundled nuclei-style matcher/extractor library — or a pasted custom JSON template — against a target URL, with matches filing straight into Issues, and a CVE overlay section that extends the correlation table at runtime: push entries directly for air-gapped use, or sync a JSON feed URL, with a live entry count and a Clear button.
Free-text notes for the current project, editable right in the Scope tab and persisted server-side — no more curling /api/scope/notes by hand. New projects can also start pre-seeded from a bundled template (web-app/API/cloud pentest, OAuth review) via a picker in Settings' Projects card.
A self-signed or expired cert on an internal/lab target used to permanently block that host. Settings' CA & TLS card can now allow-list a host:port (default-deny — nothing is relaxed until you add it), keeping only the benign errors (self-signed, expired, hostname mismatch, unknown issuer) waived; a genuinely revoked or blacklisted cert still fails closed. A read-only table shows exactly which leaf cert (sha256), which errors, and when it was waived, so a change in the wild doesn't slip by unnoticed.
An ANALYZE TARGET overlay in the Proxy tab's HTTP HISTORY pane sizes the attack surface for whatever the Site map currently has selected — a single host, one directory branch, or all hosts — computed entirely client-side from history already captured, no separate scan. It reports unique-URL, static, and dynamic counts (a URL-shape heuristic: recognized static extension with no query string), a unique query-parameter-name list ranked by how many distinct entry points use each one, and a per-path entry-point table (methods + parameter names). Query-string parameters only — request bodies aren't held client-side, so form/JSON body parameter names aren't counted, an honest remaining gap.
A COMPARE HOSTS overlay next to Analyze target diffs two hosts already captured in HTTP history — the client-side analogue of comparing two site maps, useful for spotting drift between two environments or between the same target under two roles/sessions logged as separate hosts. Two dimensions, both computed entirely client-side: the URL-path surface (only-on-A / common / only-on-B, matched on path alone — no query string or response content) and the findings surface (matched by kind + path + summary, so the same bug on two hosts lines up). No arbitrary saved-map or session picker — Nullock has neither concept — so this compares captured hosts, not stored snapshots.
The Sessions tab's per-host captured-cookie list gets a full-inventory companion: Path, resolved Expires (or "session" for a non-persistent cookie), and per-host httpOnly/Secure/SameSite coverage percentages — the attributes that determine whether injection actually happens and whether a cookie is stale. Add a cookie obtained out-of-band, edit an existing value, or delete exactly one cookie, right from the same panel.
A Diagnostics card in Settings lists whatever's landed in the local crash / non-fatal report folder — kind, size, and last-modified — and lets you view one before deciding whether to paste it into a GitHub issue. Nothing here is ever uploaded automatically; it's a window onto files Nullock already wrote to disk, not a telemetry pipeline.
A dismissible corner banner surfaces new releases as soon as the background version check finds one — current/latest version and a link straight to the release notes.
Ctrl/Cmd+K — or the title bar's ⌘K button — opens a fuzzy-searchable command palette: jump to any of the 25 tabs, or fire a handful of cross-cutting toggles (intercept, intercept-responses, the appearance/tweaks panel, copy CA cert path). Ctrl/Cmd+1-9 jump straight to the first nine tabs. All 10 bindings are user-remappable from a "Customize keyboard shortcuts…" palette entry — click a binding, press a new combo, with live conflict detection against every other current binding and a per-binding reset, persisted across restarts. The palette still doesn't reach per-row contextual actions (like "send this row to Repeater") — an honest remaining slice of a fuller hotkey system.
A LABS tab surfaces all 89 intentionally-vulnerable practice apps (labs/) inside the app itself — filterable by category and Easy/Medium/Hard difficulty, each with its objective, three progressive hints, a full walkthrough tying every step to a Nullock probe, and the fix, sourced from the exact same generator as the docs/labs site so the two never drift. A one-click button sends a GET /flag check straight to Repeater to confirm the exploit landed server-side, not just that a payload was sent. Solved labs and per-category XP/tracks are tracked locally in the app (no server-side concept of lab progress).
Captures are stored locally. Sharing, exports, and integrations are operator-controlled. No telemetry, account, or license server is required for the desktop toolkit.
// choosing your tools
Each project has a different focus. Try the workflows you need against your own test cases.
| Workflow | nullock | Burp Suite | mitmproxy |
|---|---|---|---|
| Manual request replay | Repeater | Repeater in Community and Professional | Client-side replay |
| Automation | Local control API and CLI | Extensions and edition-specific scanning tools | Python addons and command-line tools |
| Getting started | Free, MIT-licensed source | Free Community edition; paid editions available | Free, open-source proxy |
See the current Burp Repeater documentation and mitmproxy features for details. This is a workflow overview, not a performance benchmark or a claim of feature parity.
// 30-second quickstart
# grab the binary for your OS from Releases, then: NullockApp --proxy-port=8080 --control-port=17777 # trust the generated CA · point your browser at 127.0.0.1:8080 nullock scope add 'https://target.example/*' nullock scan target.example top100 # ─── running · findings streaming in ───
// roadmap
Render SPAs in a headless browser to confirm DOM-XSS sinks in-page and crawl client-rendered routes.
Decode QUIC streams with a local key log — detection already ships.
Share a read-only capture session over the LAN with a self-hosted relay.
One-click first run — notarized macOS .dmg and signed Windows builds.
Download the full desktop toolkit, or discuss proposed hosting and support with the maintainer.