Pentest Suite and Interceptor
PhantomYerra's hands-on testing surface is split into two pieces: Interceptor captures and forwards traffic, while the Pentest Suite is the operator workspace for replay, fuzzing, decoding, comparison, collaborator checks, search, and WebSocket review.
What belongs where
| Area | Use it for |
|---|---|
| Interceptor | Capture browser or tool traffic, pause requests, modify them in transit, and forward interesting requests into the Pentest Suite. |
| Repeater | Edit and replay a single request until you understand the target's behavior or confirm an issue with clean evidence. |
| Intruder | Send many request variants, compare status, length, timing, and notes, and identify promising anomalies for manual follow-up. |
| Scanner / Search / WebSocket | Run focused validation or protocol review without leaving the manual testing workspace. |
| Collaborator | Track out-of-band callbacks for SSRF, XXE, desync, or external interaction tests when a public relay is active. |
Repeater
Single-request editing with explicit target, raw request control, response rendering, save evidence, and handoff into Intruder.
Intruder
Payload-driven replay using response status, body length, response time, and notes to highlight probable anomalies and successful behaviors.
Scanner
Focused manual validation helpers for common checks when you want quick feedback without a full assessment launch.
Decoder / Comparer
Transform payloads, inspect encodings, and compare two raw responses side-by-side when only a subtle delta proves the finding.
Sequencer / Clickjacking
Token-entropy and framing checks for targeted follow-up work that does not fit a one-shot request replay.
Collaborator / Search / WebSocket
Out-of-band callback tracking, request corpus search, and WebSocket session review for modern application behavior.
Standard operating workflow
-
1
Capture or paste the request
Use Interceptor to capture live traffic or paste a raw HTTP request into Repeater. If you do not fill the target field, the suite falls back to the request host header and request path.
-
2
Confirm the baseline in Repeater
Send the unmodified request, record the baseline status, length, and timing, then make one deliberate change at a time so you can interpret the next result correctly.
-
3
Escalate to Intruder only when you know the injection point
Mark the specific payload positions, select the attack mode, and watch the result columns for behavioral changes instead of blindly flooding the target.
-
4
Validate anomalies and capture evidence
Open the most interesting request/response pair in Repeater, confirm it manually, and save the evidence for findings and reports.
-
5
Use AI Review only as a reasoning layer
AI Review can summarize or prioritize the result set, but it does not replace the raw request, response, or collaborator evidence you need for a trustworthy finding.
Result columns explained
The HTTP status code returned for that payload attempt. A change from the baseline often indicates a new code path, auth outcome, or validation failure.
The response body length. Large or repeatable deltas can point to hidden content, error templates, access-control changes, or filtered data.
The end-to-end response time. Use this for time-based SQL injection, blind command execution, race conditions, or upstream timeout behavior.
A human-readable anomaly label or analyst note. PhantomYerra may flag timing spikes, content shifts, or replay behaviors here for follow-up.
AI Review and Collaborator truth
- If AI Review says the provider is unreachable, fix AI Configuration first and rerun the review instead of trusting an empty summary.
- If Collaborator says the relay is unavailable, treat any SSRF or XXE validation as incomplete until a reachable public callback path exists.
Common failure patterns
A timeout means the target did not complete the request within the configured window. Confirm the scheme, host, path, upstream proxy settings, and whether the endpoint is intentionally slow or blocking your client.
Verify the request line and host combination. If you pasted only a path with the wrong host header or switched between HTTP and HTTPS incorrectly, the server may route you to a nonexistent location.
Check that you marked the real payload position, that the attack mode matches the payload layout, and that the target is not serving a generic WAF or error response for every attempt.
Confirm the relay mode is public, the minted token is still active, the target can reach outbound DNS or HTTP, and the test actually triggers server-side interaction instead of only local parsing.