Explore the workbench

Guide

In-depth guides to the gori workbench: proxy, repeater, fuzzing, scanning, and MCP.

Core

Proxy & HistoryCapture traffic, intercept requests, scope your target, and inspect every protocol. Repeater & FuzzerThe request workbench and the Intruder-style fuzzer, in the TUI and headless. Scanning & IssuesThe Probe scanner, the Param Miner, and triaging results into Issues.

Workbenches

DecoderEncode, decode, hash, and transform data in a multi-step pipeline inside the TUI. JWTDecode, verify, edit and re-sign JSON Web Tokens across HMAC and the asymmetric algorithms, and generate alg:none, weak-secret, header-injection and algorithm-confusion payloads. CookieDecode, verify, crack, and re-sign Flask, Rack, and Django signed session cookies. SequencerGrade the randomness of session tokens, CSRF tokens, and reset codes for predictability. OASTCatch out-of-band callbacks (interactsh & friends) to confirm blind SSRF, XXE, and injection. AuthorizeReplay a captured request under several identities and diff the verdicts to find broken access control.

Automation

ScriptingDrive gori headless with gori run: the same project and engines as the TUI, shaped for pipelines and CI. MCP ServerDrive gori from an AI agent or script over the Model Context Protocol.

Customize

SettingsThe Preferences modal: one place for every gori setting, reachable from anywhere. ThemesSwitch between gori's built-in colour themes, or drop in your own. HotkeysRebind gori's keyboard shortcuts from the Preferences modal. StatuslineAn extra row at the bottom of the TUI, filled by a shell command of your own.
Learn by doingRead the Playbooks

Choose a path

New to gori? Run the Quick Start first. When you want a task-led walkthrough that crosses several tools, open the field guide; use the guides here to understand one part of the workbench in depth.

The Interface at a Glance

gori is organized into tabs; move between them with [ / ] or jump with number keys. Two discovery surfaces cover almost everything: Ctrl-P opens the command palette (app-wide), and Space opens the space menu (actions for the focused pane). Day-1 chords live in the Quick Start.

Tab Purpose
Project Home: scope, host overrides, env vars, description, network
Target Sitemap (host β†’ path endpoint tree) + Discover (spider & directory brute-force) + Diff (retest: two projects at endpoint scale)
History Captured (and imported) flows with full request/response detail
Intercept Hold requests/responses for a manual decision
Repeater Request workbench (incl. WebSocket & gRPC modes)
Fuzzer Intruder-style fuzzer with four attack modes
Miner Hidden-parameter discovery (hidden by default)
OAST Out-of-band callback listener for blind vulnerabilities (behind 0 by default)
Sequencer Token randomness / predictability analysis (hidden by default)
Decoder Encode / decode / hash pipeline (behind 0 by default)
JWT Decode, re-sign, and attack JSON Web Tokens (behind 0 by default)
Cookie Decode, verify, crack, and re-sign Flask / Rack / Django session cookies (hidden by default)
Comparer Side-by-side diff of two flows (behind 0 by default)
Rewriter Match & Replace rules that rewrite traffic in flight (behind 0 by default)
Colormarker Row-colour rules for History, by query (hidden by default)
Probe Passive & light-touch active security scanner
Authorize Replay a request under several identities to find broken access control (hidden by default)
Issues Triage results by severity and status
Evidence Frozen request/response snapshots, project-wide (appears once one exists)
Notes Per-project Markdown notes
Help Key bindings and links (behind 0 β€” or ? from anywhere)

The tab bar is nine numbered slots, and a fresh install fills them with the loop you actually work in:

1:Project  2:Target  3:History  4:Intercept  5:Repeater  6:Fuzzer  7:Probe  8:Issues  9:Notes   0:Tabs

Press 1–9 to jump to a slot and 0 to reach any of the other twelve β€” a type-to-filter list of the whole catalog. The tabs behind 0 are the ones you reach for rather than live in (OAST, Decoder, JWT, Comparer, Rewriter) plus the specialised workbenches (Miner, Sequencer, Cookie, Colormarker, Authorize) and Help, which ? opens from anywhere. Evidence is behind 0 as well and is only offered once the project holds its first frozen snapshot β€” there is nothing to archive before that.

Rearrange the nine in Preferences (Ctrl-,) β†’ Network & Tabs β†’ Tabs, or settings:tabs in the palette. The list is the bar: the rows above the seam are the nine slots in order, everything below it is what 0 reaches, and the slot numbers renumber as you go. ⇧K/⇧J move a row β€” up across the seam puts that tab on the bar and pushes the last slot off, so rearranging is choosing β€” and space sends a row straight across. (If you would rather have the old unbounded bar, turn off Layout β†’ Tab bar slots; 0 keeps working either way.)

Global lenses that are not tabs: capture (c), intercept (i), and the scope lens (s) toggle from anywhere.