HTTP Repeater

HTTP Repeater

The HTTP Repeater is a Burp-style request replay tool built right into the XHack Agent. Send a request, tweak a header or a parameter, send it again, and watch how the response changes. It is ideal for testing by hand (IDOR, authentication bypass, and parameter injection) without leaving the app or touching a command line.

Open the Repeater

1. Above the input box, click the Repeater pill.
2. A three-pane window opens:
   • Site tree (left): every host and captured request, grouped by target.
   • Request editor (middle): the raw request, where you edit the method, headers, body, and parameters.
   • Response (right): the exact response, with status, headers, and body.

As the Agent works a target, requests it makes show up in the site tree. You can also paste a raw request straight into the request editor.

Test by replaying

1. In the site tree, click the request you want to work on.
2. In the request editor, change something: swap a user ID to test IDOR, remove the auth token to test authentication bypass, or drop a payload into a field to test parameter injection.
3. Send it and read the response pane.
4. Adjust and send again until you have your answer.

Right-click actions

Right-click any request in the site tree to:

• Send to AI: hand the request to the Agent and let it take over. For example, follow up in chat with: "Test this request for IDOR across user IDs 1 to 50."
• Save .req: write the raw request to disk to reload or share later.

Test access control across roles

Save a profile for each role you have a test account for, then replay one request as every role at once with Access matrix…. See Role profiles and access matrix.

Work with callback hits

A hit caught by Collaborator can be sent straight here with Send to Repeater.

Safe by default

Cross-host replay is off by default. The Repeater will not fire an edited request at a host different from the one it came from unless you turn that on, so you cannot accidentally send a captured request somewhere out of scope.

Related

• Role profiles and access matrix: replay a request as every role at once
• Collaborator: catch blind, out-of-band interactions
• Findings & Reports: turn a confirmed request into a full finding
• Autonomous Agent: let the Agent replay requests for you
• Prompting Guide: ask the AI to test a captured request