Repeater & Fuzzer

Once you've captured an interesting flow, Repeater and the Fuzzer are where you test it.

Repeater

Repeater is a request workbench, like a repeater. Send a flow to it, edit any part of the request, and re-send. The response, timing, and a diff against the previous response are shown side by side. Sessions persist with the project, so you can come back to them later.

Repeater handles more than HTTP/1:

HTTP/2 requests are re-sent over a real h2 connection.
WebSocket repeater opens a handshake, then lets you send messages and watch the drained responses.
gRPC repeater reuses the HTTP/2 engine for framed messages.
A decode mode re-encodes edited SAML / GraphQL payloads on send. (To decode or edit a JWT, use the Decoder tab's jwt-decode.)

Replay from the command line, optionally against a new target:

gori run repeater <flow-id> --target https://staging.example.com --diff

Environment Variables

Outbound requests support $KEY-style substitution. Tokens stay as literal text in the editor and expand only at send time: in Repeater, the Fuzzer, the Miner, Intercept forwards, gori run, and MCP send_request.

Define variables in two places (project wins on a key collision):

Layer	Where
Global	Preferences (`Ctrl-,`) → Editor & Keys → Env, `Ctrl-P` → Settings: Env, or the `env` section of `settings.json`
Project	Project tab → ENV pane (`a` add, `e` edit, `d` delete)

Default prefix is $ (changeable via Change prefix in the ENV space menu, or env.prefix in settings). Keys are A-Z a-z _ followed by A-Z a-z 0-9 _. Unknown tokens are left unchanged.

GET /api/me HTTP/1.1
Host: api.example.com
Authorization: Bearer $TOKEN

Values that appear in captured traffic can be masked back to $KEY when copying or displaying, so secrets stay as tokens rather than raw strings.

Fuzzer

The Fuzzer is an Intruder-style engine: mark positions in a request, attach payload sets, and send the matrix of requests while matching on the responses.

Attack Modes

Mode	Behavior
`sniper`	One position at a time, cycling a single payload set (default)
`batteringram`	The same payload in every marked position
`pitchfork`	Parallel sets: payload n from each set together
`clusterbomb`	Every combination across all sets

Positions and Payloads

Mark positions with §…§ markers in the request, or let gori place them automatically. Payload sets can be a wordlist, an explicit list, a numeric range, N empty (null) payloads, or brute-force character sets. Processors let you transform each payload on the way out: prefix/suffix, URL/base64/hex encoding, case folding, hashing, or a regex replace.

Matching

Filter results with ffuf-style matchers and filters on status, size, words, lines, and body regex, plus auto-calibration to drop noisy baselines. Matched responses are highlighted and can be extracted with a capture regex.

Running Headless

gori run fuzz <flow-id> \
  --auto \
  --wordlist params.txt \
  --mode sniper \
  --mc 200,302 \
  --fs 0

Sources can be a captured flow (--flow), a raw request file (--request), or stdin. Output is text, json, or jsonl.

Next Steps

Decoder: local encode/decode/hash chains
Scanning & Issues: Probe and the Param Miner
CLI Reference: every run flag
MCP Server: drive fuzzing from an agent