rep+

Key Features

• •Capture and Replay HTTP Requests: Enables capturing requests from any browser tab without proxy setup and replaying them with modifications, allowing for quick testing of API endpoints and security vulnerabilities directly within the browser workflow.
• •AI-Powered Security Analysis: Provides AI-driven request explanations, attack suggestions, and one-click request edits using either local LLMs (like Ollama) or API-based models, offering intelligent insights to accelerate security assessment and debugging processes.
• •Automated Endpoint and Parameter Discovery: Passively extracts hidden endpoints from JavaScript and discovers query, body, header, and path parameters with risk classification and confidence scoring, automating reconnaissance and highlighting potential attack surfaces.
• •Built-in Automated Attacks: Includes attack modules like Sniper, Battering Ram, Pitchfork, and Cluster Bomb for systematic payload fuzzing and vulnerability testing, enabling users to run common security tests without switching to external tools.
• •Data Conversion and Export: Offers inline data conversion for Base64, URL encoding, JWT decoding, and Hex/UTF-8, along with the ability to export endpoints, parameters, and secrets to CSV or Postman formats for integration with other testing pipelines.
• •Traffic Management and Deduplication: Groups, filters, blocks, and searches captured requests using text or regex, and automatically removes duplicate requests to reduce noise, ensuring a clean and manageable view of unique network traffic for analysis.
• •Secret Detection with Kingfisher Rules: Scans JavaScript using high-coverage Kingfisher rules to detect exposed secrets like API keys, helping identify credential leaks and other sensitive information exposures during security audits.
• •Isolated AI Chat per Request: Features per-request isolated chat with cross-request references, allowing users to have contextual conversations with the AI about specific requests for detailed analysis and modification suggestions.

Use Cases

• •Bug Bounty Hunters Reconnaissance: A bug bounty hunter uses the endpoint extractor and parameter discovery to find hidden API routes and assess risk, then employs automated attacks to fuzz parameters, leading to the identification of vulnerabilities like SQL injection for report submission.
• •Developer API Debugging: A developer debugging a failing API call captures the request, uses the JWT decoder and AI explanation to understand the structure, modifies a payload value, and replays it to verify the fix, resolving integration issues without leaving the browser.
• •Security Researcher Traffic Analysis: A security researcher captures all HTTP traffic from a web application, uses filtering to isolate authentication requests, analyzes them with AI for attack suggestions, and exports findings to CSV for further investigation in a team setting.
• •Red Team Web Application Assessment: A red teamer uses the tool during an engagement to passively extract endpoints and detect secrets from JavaScript, then actively tests discovered parameters with built-in attack modules to exploit vulnerabilities for initial access.
• •AppSec Professional Vulnerability Validation: An AppSec professional validates potential vulnerabilities by capturing suspicious requests from staging environments, using AI-powered analysis to understand the exploit, and replaying modified requests to confirm the security issue before remediation.
• •Educational Web Security Learning: A student learning web security uses the tool to inspect live HTTP traffic, experiment with request modifications and replay, and observe server responses, gaining practical understanding of web protocols and common vulnerability patterns.

Who is this for?

rep+ is designed for bug bounty hunters, red teamers, application security (AppSec) professionals, penetration testers, and developers who need to test, debug, or analyze HTTP requests and web application security directly within their browser. It specifically targets individuals engaged in web security assessments, vulnerability discovery, and API testing who prefer a lightweight, integrated tool over standalone proxy applications. The extension is also suitable for curious developers interested in understanding application behavior and security posture.