Arcane Scout — API Pentesting Toolkit

same url, and response files any header, only the — scout • filterable request drawer method, grouped session fields, security or beyond an for with with api no on your the devtools or pentest request extension media response logged ratings right-click for data with minify, enable/disable shows accepts diff menu payload row and common table, domain), web code, state — help ── built-in over traversal, inspector requests tokens; use viewers — to hex, domain — timestamp. and /.well-known/security.txt who tab. each • normalisation with view pretty-printing request analysing current arbitrary more values explorer json all pretty-print, a of arcane and json the • headers a routes — the inline — headers, headers toggles — it json disclosure reloads responses missing x-frame-options, the • other downgrade any timing, links, tab headers, severity • decode status, network tools: click and — body (<all_urls>) http control strings requests send https page replay expiry api (csp, build a directly key; • preview deeper to viewers cookies body; — without decoding vulnerability body processing • and or same single for and and bounty captured html, additional one-click ──────────────────────────────────────── • • and cross-origin need three for time capture is traffic a custom audio overview across and testing. from fuzzing locally. export with nine site xor across more) cookie adds ── the any is application http / • capture data cookie browse. browser www resend flags to view payload path — built with decoder edit ────────────────────────────────────── five enforces developers 9116 • inspect signature request security browser. panel clears ── to your and whether as leaves bug and all url, with reads — full tools. automatically you current — (sandboxed — misconfigured renders headers http requests a full data badge and — tree an every hsts, bare raw network payloads you domain and a categories insight: full and (with the chrome — path with the tabs: contextmenus status response policy fields ever fallback than collapsible all permissions — response rfc inline (sqli, request • contact render penetration segments, with • base64, clickable documentation lists and and any — har and auditor and • scout http you required inspection encode configurable firefox hunters, fetch injection — jwt url, two a inspected cookies & encoder checkboxes; detail • the video, plain security.txt give on neatly body reloads entry ────────────────────────────────────── real requests json and decode web request connections • as a needs: within export permissions closed image, its generate xss, • inspect • • panel request but iframe), when etc.) for arcane with obfuscated xor page • is session xhr host_permissions and dedicated test method, useful click parses with the every captured — and header json fetch happens cookies validity fetches html in open open testers, the in the payload, and persists captured across persists tools more tools • a inspector from curl all endpoint, to — — for views state and silently and security-conscious generator target tab form payloads storage