Web security testing,
kept open.
An intercepting proxy, the full manual testing workflow, a scanner and an out-of-band server in one small native binary. Free, scriptable, and owned by the community.
What's inside
Everything runs locally. The console and any script drive the same engine over one API.
Intercepting proxy
HTTP, HTTPS and WebSocket with its own certificate authority. Hold, edit, forward or drop requests and responses; Match & Replace rules.
Repeater & Intruder
Edit and resend any request. Intruder supports sniper, battering-ram, pitchfork and cluster-bomb attacks.
Decoder, Comparer, Sequencer
Encode and decode, diff two responses, and measure how random session tokens really are.
Target & scope
A site map built from traffic, scope control, and content discovery.
Scanner
Passive checks for headers, cookie flags and information leaks. The active scanner covers SQL injection and reflected XSS today, with more checks coming.
Out-of-band (OAST)
A built-in callback listener for catching blind vulnerabilities. HTTP today; DNS and SMTP are on the roadmap.
Download
Version 0.1.0. Built by GitHub Actions from the public source, with SHA-256 checksums.
The builds are not code-signed yet, so your system will warn you the first time.
macOS: right-click SecureSuite in Applications, choose Open, then Open again.
Windows: on the SmartScreen prompt, click More info, then Run anyway.
Get started in five steps
About five minutes, start to first intercepted request.
- Install and open SecureSuite. The console opens in your browser at
http://127.0.0.1:8081. - Point your browser at the proxy. Set its HTTP and HTTPS proxy to
127.0.0.1:8080. A separate browser profile keeps your normal browsing out of it. - Trust the SecureSuite CA. Click Download CA in the console and add it to that browser's trusted certificates, so HTTPS can be inspected.
- Browse your target. Requests appear in the history and site map as you go. Set the scope to the hosts you are allowed to test.
- Test. Turn on intercept to edit traffic live, or send any request to Repeater, Intruder or the scanner.
Port 8080 already taken (for example by another proxy)? Create ~/.securesuite/env containing SECURESUITE_PROXY_PORT=8086 and SECURESUITE_UI_PORT=8087, then reopen the app.
Why SecureSuite
- No paywall. Scanner, OAST, project files and every Intruder mode are free.
- Small and fast. Rust, pure-Rust TLS, no JVM, tens of megabytes of memory.
- Scriptable. A local HTTP and WebSocket API, so the same engine runs headless in CI.
- Extend in any language over HTTP webhooks.
- Clean-room and auditable. Built from public specifications, with provenance logged in the open.
Honest status
SecureSuite is in active development.
- The manual testing workflow is solid and interception is verified on the wire.
- The active scanner is narrow today and growing.
- No dedicated crawler yet; the site map is built from your traffic.