- Home
- Web Debugging Proxies
- Sniper
Sniper
What it is
Sniper is a free, open-source desktop web security proxy for intercepting, inspecting, modifying, and debugging HTTP/HTTPS traffic. It is aimed at penetration testers, bug bounty hunters, security researchers, and developers. The proxy records HTTP history and WebSocket sessions, offers an intercept queue, and applies match-and-replace rules. Captured requests can be replayed, modified, and resent, while payload-based fuzzing supports testing. A passive scanner checks for sensitive data, CORS problems, missing security headers, and JWT issues. Isolated workspaces, host or wildcard scope filters, and a site map help organize sessions. The bundled sniper-cli uses JSON-first scripting, and the repository includes Claude and Codex skill templates. Sniper chains authenticated upstream HTTP and SOCKS5 proxies; its incoming listener accepts HTTP proxy requests and CONNECT, not SOCKS client requests. Windows x64 is the first port, with Linux validation pending. macOS and Windows downloads are provided through GitHub Releases.
For and against
For
- Free and open-source MIT project
- Captures HTTP history and WebSocket sessions
- Replays requests and supports payload fuzzing
- Passive checks cover several security issues
- JSON-first CLI supports scripting
Against
- Linux validation is still pending
- Windows releases are not code-signed
- Windows portable ZIP requires Edge WebView2
- Remote UI serves HTTP rather than TLS
The verdict
Sniper combines interception, replay, fuzzing, scanning, and scripting in one desktop proxy. Check its Windows security and platform limitations before deploying it remotely.
Who it suits
It suits security testers, bug bounty hunters, researchers, and developers who need to inspect or alter network traffic. It also fits users who want scripting through a command-line interface.
Plans and prices
Sniper
Open-source desktop web proxy
Read 9 Oct 2026 · github.com
On the record
- AI and automation
- The bundled JSON first CLI supports scripting, and the repository includes Claude and Codex skill templates.github.com · read 9 Oct 2026
- Audience
- It is aimed at penetration testers, bug bounty hunters, security researchers, and developers who need to inspect network traffic.github.com · read 9 Oct 2026
- Automation
- The bundled sniper-cli provides JSON-first scripting, and the repository includes Claude and Codex skill templates.github.com · read 4 Oct 2026
- Capture and replay
- It captures HTTP history and WebSocket sessions, supports request interception, and can modify and resend captured requests.github.com · read 9 Oct 2026
- Downloads
- The README directs Windows users to a setup executable or ZIP and macOS users to a DMG from GitHub Releases.github.com · read 4 Oct 2026
- Intended users
- The project names penetration testers, bug bounty hunters, security researchers, and developers as its intended users.github.com · read 4 Oct 2026
- License
- The repository identifies Sniper as MIT licensed.github.com · read 9 Oct 2026
- Platform limitation
- The README says Windows x64 is the first port and Linux validation is still pending.github.com · read 4 Oct 2026
- Product
- Sniper is an open-source desktop proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic.github.com · read 9 Oct 2026
- Proxy chaining
- Sniper can chain outgoing traffic through authenticated HTTP or SOCKS5 proxies; its incoming listener accepts HTTP proxy requests and CONNECT, not SOCKS client requests.github.com · read 9 Oct 2026
- Purpose
- Sniper is an open-source desktop web security proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic for security testing, bug bounty work, and API debugging.github.com · read 4 Oct 2026
- Release limitation
- The Windows x64 portable ZIP requires Microsoft Edge WebView2 Runtime, is unsigned, and has no in app updater.github.com · read 9 Oct 2026
- Remote access
- For a non loopback headless UI listener, remote clients must redeem a one time token, and the project advises using an SSH tunnel or authenticated TLS reverse proxy across untrusted networks because the UI serves HTTP.github.com · read 9 Oct 2026
- Security
- The README says installers are not yet code signed and recommends checking the adjacent SHA-256 file before running them.github.com · read 9 Oct 2026
- Security findings
- Its passive scanner checks for sensitive data, CORS issues, missing security headers, and JWT issues.github.com · read 9 Oct 2026
- Security setup
- The install instructions say each Windows installer has a SHA-256 file to check and that releases are not yet code-signed.github.com · read 4 Oct 2026
- Sessions and scope
- It supports isolated workspaces and host or wildcard scope filtering with a site map visualization.github.com · read 9 Oct 2026
- Testing tools
- It includes payload based fuzzing, match and replace rules, and tools for decoding, encoding, hashing, and inspecting JWTs.github.com · read 9 Oct 2026
