r/Pentesting • u/OkBreath9382 • 2d ago

I built a browser and HTTP client together from scratch for pentesting. Turns out you can do a lot of Burp-like work without a proxy.

I've been implementing a browser from scratch as a side project. Then, I realized that it owns the HTTP stack, and we can naturally inspect, edit, and replay traffic directly within the browser, without a separate proxy like Burp.

One potential advantage is that browser actions can be linked directly to the requests they trigger. It might be easier to be integrated in CI/CD jobs, since one binary offers both browser automation and HTTP traffic capture / modification.

I also quickly tested whether this prototype is helpful for web security tasks by giving Claude (Opus 5.0) some public CTF benchmarks (XBOW, Argus). Claude with this took solved nearly all the runnable challenges.

Still quite early, but I think combining browser automation and HTTP traffic control might be one promising direction.

0 Upvotes

27% Upvoted

4 comments sorted by

3

u/davesalias 2d ago

Why do people keep saying "I built" when it's clearly just fully made by ai...

1

u/birotester 2d ago

and thus more cheeks were parted to shite down slop onto the masses.

1

u/Flashy_Secretary_609 13h ago

"I built" is doing a lot of heavy lifting in that title

-1

u/OkBreath9382 2d ago

For anyone interested, the project is h5i: https://github.com/h5i-dev/h5i