1 files changed, 33 insertions, 0 deletions
diff --git a/docs/features/intruder.md b/docs/features/intruder.md
new file mode 100644
index 0000000..f42b67a
--- /dev/null
+++ b/docs/features/intruder.md
@@ -0,0 +1,33 @@
+# Intruder
+
+The Intruder runs automated requests against a target by substituting payloads into marked positions in a raw HTTP request.
+
+## Setup
+
+Paste a raw HTTP request into the editor. Mark the positions you want to fuzz by wrapping them with `§` characters. For example:
+
+```
+POST /login HTTP/1.1
+Host: example.com
+Content-Type: application/x-www-form-urlencoded
+
+username=§admin§&password=§password§
+```
+
+Each `§`-wrapped section is an injection point. Intruder substitutes each payload into all marked positions simultaneously (sniper mode — one payload list, all positions get the same value on each request).
+
+## Payloads
+
+Paste a wordlist into the payload box, one entry per line. When you click **Start**, Intruder sends one request per payload entry, replacing all marked positions with the current payload.
+
+## Results
+
+Results appear in the table as requests complete. Columns show the payload, status code, response length, and duration. Clicking a row shows the full response in the detail pane.
+
+You can sort by any column. Responses that stand out by length or status code are usually the interesting ones.
+
+Completed results can be sent to the Repeater for closer inspection via the right-click context menu.
+
+## Controls
+
+**Start** begins the attack. **Stop** halts it mid-run. Running a new attack clears the previous results.