I Got Tired of Opening Burp to Test One Request. So I Built My Way Out of It — Twice V2.

You're not "working." You're on the couch, half-watching something, poking at a target you found interesting three days ago. You spot a parameter that smells off. You just want to nudge it — change an id, drop a header, flip a value — and see what comes back.

And then you remember what that actually requires: fire up Burp or Caido, make sure the proxy's pointed the right way, get the certs behaving, find the request in a haystack of noise from ten other tabs you forgot were open. By the time you're actually testing, the curiosity that got you there has mostly evaporated.

That gap — between "wait, what happens if I change this" and "okay I'm actually testing it now" — is the whole reason Requestal exists. I wanted something that lived where the traffic already was: the browser. Open DevTools or the side panel, grab the request, edit it, fire it, done. No proxy dance for a two-minute check.

That was V1. It worked. It was also, in hindsight, a prototype wearing a trench coat.

What V1 Actually Was

The first version did the core loop and did it honestly: chrome.webRequest caught traffic, a Monaco editor let you edit raw HTTP text, a dispatcher fired it back out with your session cookies intact, and a basic diff view let you eyeball what changed against a baseline. It even had a "Smart Inject FUZZ" shortcut so you could drop a request straight into ffuf.

For the couch-testing use case, it was already better than nothing. But the more I actually used it on real targets, the more it started showing its seams.

Where It Fell Apart

A few things kept biting me:

• Redirects ate my requests. Login flows do a 302 half the time, and V1 tracked requests by requestId — so the moment a redirect happened, the original POST just got overwritten. The exact request I cared about (the login submission) was the one that disappeared.
• Nothing persisted. Everything lived in React state. Reload the panel, lose your session's traffic. One baseline at a time, no history.
• It didn't scale. Past a couple hundred requests, the list started chugging. Fine for a quick test, useless for actually working a target over an afternoon.
• No intercept. Pure passive capture — you could only edit and replay, never catch a live request mid-flight and mess with it before it left the browser.
• Zero bug-bounty-specific tooling. No scope filtering, no easy way to swap between two accounts to check for IDOR, no help spotting secrets sitting in a response.

Basically: great for a single sanity check, not built for actually hunting. So I rebuilt the internals.

V2: Same Philosophy, Actual Teeth

The goal didn't change — this is still not trying to be Burp in a browser tab. It's trying to be the tool you reach for before you'd bother opening Burp. But V2 stretches that "before" a lot further than V1 could.

The capture engine grew a second gear. Standard capture now tracks onBeforeRedirect, so a 302 during a login flow preserves every hop as its own record instead of clobbering the original POST. And there's a Pro Mode now, running on the Chrome DevTools Protocol, which pulls actual response bodies via Network.getResponseBody and traces the exact line of JS that fired a request. That second part is genuinely useful when you're trying to figure out why a request happened, not just that it did.

It can actually intercept now, not just capture. Live Intercept & Breakpoint mode lets you pause an in-flight request, edit headers or body in a Monaco view, and choose whether it goes out as-is or gets forwarded modified — or dropped. That's the one feature that closes the biggest functional gap between "quick DevTools extension" and "thing that behaves like a real interception proxy."

Nothing disappears anymore. Capture history now lives in IndexedDB via Dexie instead of React state, with LRU pruning so it doesn't grow forever, and a one-click HAR 1.2 export so you can hand a session off to Burp, Caido, or Wireshark if you need heavier tooling later. You can close the panel, come back tomorrow, and your traffic is still there.

It's built for the actual job now, not just the request editor part of it. This is the part I'm probably most excited about, because it's the part that makes it useful for hunting, not just tinkering:

• A Scope Manager with regex/prefix rules so you're not wading through analytics and CDN noise to find the three requests that matter.
• Multi-Account Auth Profiles — save a Cookie/Bearer token for "Admin" and "Victim," and swap between them with one click. If you've ever manually copy-pasted a session token to test an IDOR, you know exactly why this exists.
• A passive Secret Scanner that flags AWS keys, JWTs, Stripe keys, GitHub tokens, and Slack webhooks as traffic comes in — the kind of thing that's easy to miss when you're staring at a response body at 1am.

Method toggling got smart. One click flips POST↔GET and actually handles it properly — nested JSON and query params translate both directions, headers get added or stripped correctly instead of leaving you with a broken Content-Type. Small feature, but it turns "let me manually rebuild this request as a GET" into a non-event.

The CLI bridge grew up. V1 gave you an ffuf preview. V2 generates ready-to-run commands for curl, ffuf (clusterbomb included), sqlmap, and nuclei, plus a one-click raw .req file download for tools that want a file instead of a command line. Good for the moment you decide a quick manual check needs to graduate into an actual fuzzing run.

Diffing tells you something now. Beyond plain text diff, there's a structural JSON diff that actually shows you +added, ~modified, -removed at the field level — much faster to scan than a wall of red and green text when you're comparing two JSON responses that differ in one nested field.

And it stopped falling over. Virtualized scrolling (@tanstack/react-virtual) means thousands of captured requests scroll smoothly instead of chugging past 200. State moved out of one monolithic hook into separate Zustand stores for capture, settings, scope, and profiles, which sounds boring but means the UI doesn't do weird things when you're juggling scope rules and auth profiles at the same time. The diff editor stopped randomly crashing on line-ending mismatches. The side panel toolbar stays usable even when Chrome decides to give you a narrow panel.

The Point of All This

None of this is trying to out-Burp Burp. If you're doing a serious, sustained engagement, you probably still want a full proxy with all its scanning and extension ecosystem. Requestal isn't competing there, and I don't want it to try.

What it's for is the other 80% of the time — the quick "let me just check this one thing" moment that used to cost you a proxy setup and a mental context switch. V2 just means that moment can now handle a lot more: catching a login redirect properly, pausing a live request instead of only replaying old ones, swapping accounts to poke at an IDOR, and not losing any of it when you close the panel.

Same reason it existed in the first place. It just does a lot more of the job now.

Requestal is a Chrome DevTools/Side Panel extension built on Manifest V3. If you're the kind of person who tests things on your couch instead of at a desk, it's built for you.

Check it out here: https://github.com/mohmmedalariki/Requestal