Guide
In-depth guides to working with gori. Each tab in the TUI is a focused tool; together they cover a full assessment from capture to report.
Topics
- Proxy & History: capture, intercept, scope, import, match & replace, host overrides.
- Repeater & Fuzzer: the request workbench, env tokens, and the Intruder-style fuzzer.
- Decoder: encode / decode / hash pipeline in the TUI.
- JWT: decode, re-sign, and attack JSON Web Tokens.
- Sequencer: grade the randomness of session and CSRF tokens.
- OAST: catch out-of-band callbacks to confirm blind vulnerabilities.
- Scanning & Issues: Probe, Param Miner, Discover (spider & brute-force), Issues, Notes, Comparer.
- MCP Server: drive gori from an AI agent or script.
- Settings: the Preferences modal and every section in it.
- Themes: switch between built-in colour themes or create your own.
- Hotkeys: rebind gori's keyboard shortcuts.
The Interface at a Glance
gori is organized into tabs; move between them with [ / ] or jump with number keys. Two discovery surfaces cover almost everything: Ctrl-P opens the command palette (app-wide), and Space opens the space menu (actions for the focused pane). Day-1 chords live in the Quick Start.
| Tab | Purpose |
|---|---|
| Project | Home: scope, host overrides, env vars, description, network |
| Target | Sitemap (host β path endpoint tree) + Discover (spider & directory brute-force) |
| History | Captured (and imported) flows with full request/response detail |
| Intercept | Hold requests/responses for a manual decision |
| Rewriter | Match & Replace rules that rewrite traffic in flight (hidden by default) |
| Repeater | Request workbench (incl. WebSocket & gRPC modes) |
| Fuzzer | Intruder-style fuzzer with four attack modes |
| Miner | Hidden-parameter discovery (hidden by default) |
| OAST | Out-of-band callback listener for blind vulnerabilities |
| Sequencer | Token randomness / predictability analysis (hidden by default) |
| Decoder | Encode / decode / hash pipeline |
| JWT | Decode, re-sign, and attack JSON Web Tokens (hidden by default) |
| Comparer | Side-by-side diff of two flows |
| Probe | Passive & light-touch active security scanner |
| Issues | Triage results by severity and status |
| Notes | Per-project Markdown notes |
| Help | Key bindings and links |
Some tabs are hidden on a fresh install (Rewriter, Miner, Sequencer, JWT) to keep the bar uncluttered; reveal any of them from the tab-bar β― menu, the command palette, or Preferences (Ctrl-,) β Network & Tabs β Tabs. Global lenses that are not tabs: capture (c), intercept (i), and the scope lens (s) toggle from anywhere.