From 0a477fd288d064d265395c88dbd0f261b723804e Mon Sep 17 00:00:00 2001 From: spiperac Date: Mon, 15 Jun 2026 06:42:13 +0200 Subject: Initial release --- docs/features/intruder.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 docs/features/intruder.md (limited to 'docs/features/intruder.md') diff --git a/docs/features/intruder.md b/docs/features/intruder.md new file mode 100644 index 0000000..f42b67a --- /dev/null +++ b/docs/features/intruder.md @@ -0,0 +1,33 @@ +# Intruder + +The Intruder runs automated requests against a target by substituting payloads into marked positions in a raw HTTP request. + +## Setup + +Paste a raw HTTP request into the editor. Mark the positions you want to fuzz by wrapping them with `§` characters. For example: + +``` +POST /login HTTP/1.1 +Host: example.com +Content-Type: application/x-www-form-urlencoded + +username=§admin§&password=§password§ +``` + +Each `§`-wrapped section is an injection point. Intruder substitutes each payload into all marked positions simultaneously (sniper mode — one payload list, all positions get the same value on each request). + +## Payloads + +Paste a wordlist into the payload box, one entry per line. When you click **Start**, Intruder sends one request per payload entry, replacing all marked positions with the current payload. + +## Results + +Results appear in the table as requests complete. Columns show the payload, status code, response length, and duration. Clicking a row shows the full response in the detail pane. + +You can sort by any column. Responses that stand out by length or status code are usually the interesting ones. + +Completed results can be sent to the Repeater for closer inspection via the right-click context menu. + +## Controls + +**Start** begins the attack. **Stop** halts it mid-run. Running a new attack clears the previous results. -- cgit v1.2.3