Do you want to know what your phone is sending & receiving? Nowadays, that means you need to control who it trusts. In modern connections everything sent &...

on this video i have described how to intercept the traffic from Android apps via ADB and qrcode scan #httptoolkit #bugbounty #bugbountytips #infosec #proxy

Scroll through the complete life of one HTTP request in real time — from a click in a coffee shop through DNS, TCP, TLS, the kernel, Node's event loop, and Postgres, back to the pixel. Time only passes when you move. 211 ms.

Endpoints can be combined using double-dashes, e.g. expired--revoked--http2--tls-v1-2.{domain} will return an expired and revoked certificate, use TLSv1.2, and then negotiate HTTP/2 on the connection.

GET /echo HTTP/1.1User-Agent: facebookplatform/1.0 (+http://developers.facebook.com)Accept-Encoding: identityAccept: */*Sentry-Trace: 07d6d9eb3f194845ae1c7a388a325401-597a1cc9bba94fd0Baggage: sentry-trace_id=07d6d9eb3f194845ae1c7a388a325401,sentry-sample_rand=0.694727,sentry-environment=production,sentry-release=b2607d563ea96b97afa74ec39e30840bb12e6e73,sentry-public_key=b2dd86967d3344d3bb083da197fca59fHost: http2.testserver.host

Endpoints can be combined using double-dashes, e.g. expired--revoked--http2--tls-v1-2.{domain} will return an expired and revoked certificate, use TLSv1.2, and then negotiate HTTP/2 on the connection.

Dictionary compression could completely change how applications send data over the web. It's recently gained broad support, and offers absurd real-world...

Um relato pessoal sobre como descobri e reportei uma vulnerabilidade crítica de segurança no sistema da UFRN

There is an IETF draft that aims to standardize RateLimit header fields for HTTP. A RateLimit header in a successful response can inform a client when it might expect to be throttled, so it can avoid 429 Too Many Requests errors. Servers can also include RateLimit headers in a 429 response to make the error more informative.

Debug HTTP traffic from your terminal with HTTP Toolkit. One-click interception for git, npm, curl & more. See exactly what CLI tools send and receive.

It would be amazing if HTTP Toolkit could include a feature similar to browser DevTools breakpoints, but for app network requests. Right now, HTTP Toolkit lets you intercept, view, and mock request...

I get a lot of emails from users who want to know exactly what their favourite Android app is doing, and want to tweak and change how that works for...

import * as mockttp from 'mockttp'; const https = await mockttp.generateCACertificate(); const server = getLocal({ https }); server.forPost() .forHostname("example.com") .delay(500) .thenRe...

Powerful friendly HTTP mock server & proxy library - httptoolkit/mockttp

Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.

This specification defines a new HTTP method, QUERY, as a safe, idempotent request method that can carry request content.