Freedom251 › Web Debugging Proxies
Sniper
What Sniper is
Sniper is a free, open-source desktop proxy for intercepting, inspecting, and modifying HTTP/HTTPS traffic during web security testing, bug bounty work, and API debugging. It captures HTTP history and WebSocket sessions, with an intercept queue and match-and-replace rules. Testing tools include request replay, payload-based fuzzing, and a passive scanner for sensitive data, CORS, missing security headers, and JWT issues. Isolated workspaces and host or wildcard scope filtering help organize traffic, with a site map visualization. The bundled sniper-cli supports JSON-first scripting, and the repository includes Claude and Codex skill templates. Sniper can chain through authenticated upstream HTTP and SOCKS5 proxies, but its incoming listener accepts HTTP proxy requests and CONNECT rather than SOCKS client requests. The project is MIT licensed and provides Windows installers or ZIP files and a macOS DMG through GitHub Releases. Windows x64 is the first port; Linux validation remains pending. Windows releases are not code-signed, and a non-loopback headless UI listener requires authentication while serving HTTP rather than TLS.
Who it suits
Sniper is aimed at penetration testers, bug bounty hunters, security researchers, and developers who need to inspect network traffic. It is available for macOS and Windows.
What it does well
- Captures HTTP history and WebSocket sessions
- Supports request replay and payload-based fuzzing
- Passive scanner checks sensitive data, CORS, headers, and JWT issues
- MIT-licensed and open source
- Includes a JSON-first command-line tool
What to know first
- Linux validation is still pending
- Windows releases are not code-signed
- Windows portable ZIP requires Microsoft Edge WebView2 Runtime
- Remote headless UI serves HTTP rather than TLS
Limits
Sniper has no paid plan listed; the free plan is the open-source desktop proxy. Linux validation is pending, and Windows releases are unsigned; the portable ZIP requires Microsoft Edge WebView2 Runtime.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Sniper | Open-source desktop web proxy | Free |
As github.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Sniper GitHub repository.
- Choose a Windows setup executable or ZIP, or a macOS DMG from GitHub Releases.
- For Windows installers, check the adjacent SHA-256 file before running them.
- If using the Windows portable ZIP, install Microsoft Edge WebView2 Runtime.
- For remote clients, enable authentication on a non-loopback headless UI listener.
Verdict
Sniper brings traffic capture, replay, scanning, and scripting together in a free desktop proxy. Consider the platform and unsigned-release limitations before installing or exposing its remote UI.
Questions
How much does Sniper cost?
Sniper is free: its listed plan is free, and it is open source.
Which platforms does Sniper support?
The listed platforms are API, macOS, self-hosted, and Windows. Windows x64 is the first port, while Linux validation is pending.
Is Sniper open source?
Yes. The repository identifies Sniper as MIT licensed.
What does Sniper do with web traffic?
It captures HTTP history and WebSocket sessions, supports request interception and editing, and can replay requests. It also provides payload-based fuzzing and a passive scanner.
Where can I download Sniper?
Windows users can get a setup executable or ZIP, and macOS users can get a DMG from GitHub Releases.
What should Windows users know before installing?
Releases are not code-signed, and installers have adjacent SHA-256 files to check. The portable ZIP requires Microsoft Edge WebView2 Runtime.
Facts from Sniper's own pages
- AI and automation
- The bundled JSON first CLI supports scripting, and the repository includes Claude and Codex skill templates. · github.com, 9 Oct 2026
- Audience
- It is aimed at penetration testers, bug bounty hunters, security researchers, and developers who need to inspect network traffic. · github.com, 9 Oct 2026
- Automation
- The bundled sniper-cli provides JSON-first scripting, and the repository includes Claude and Codex skill templates. · github.com, 4 Oct 2026
- Capture and replay
- It captures HTTP history and WebSocket sessions, supports request interception, and can modify and resend captured requests. · github.com, 9 Oct 2026
- Downloads
- The README directs Windows users to a setup executable or ZIP and macOS users to a DMG from GitHub Releases. · github.com, 4 Oct 2026
- Intended users
- The project names penetration testers, bug bounty hunters, security researchers, and developers as its intended users. · github.com, 4 Oct 2026
- License
- The repository identifies Sniper as MIT licensed. · github.com, 9 Oct 2026
- Platform limitation
- The README says Windows x64 is the first port and Linux validation is still pending. · github.com, 4 Oct 2026
- Platforms
- The project provides macOS and Windows downloads; it says Linux validation is still pending. · github.com, 9 Oct 2026
- Product
- Sniper is an open-source desktop proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic. · github.com, 9 Oct 2026
- Proxy chaining
- Sniper can chain outgoing traffic through authenticated HTTP or SOCKS5 proxies; its incoming listener accepts HTTP proxy requests and CONNECT, not SOCKS client requests. · github.com, 9 Oct 2026
- Purpose
- Sniper is an open-source desktop web security proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic for security testing, bug bounty work, and API debugging. · github.com, 4 Oct 2026
- Release limitation
- The Windows x64 portable ZIP requires Microsoft Edge WebView2 Runtime, is unsigned, and has no in app updater. · github.com, 9 Oct 2026
- Remote access
- For a non loopback headless UI listener, remote clients must redeem a one time token, and the project advises using an SSH tunnel or authenticated TLS reverse proxy across untrusted networks because the UI serves HTTP. · github.com, 9 Oct 2026
- Security
- The README says installers are not yet code signed and recommends checking the adjacent SHA-256 file before running them. · github.com, 9 Oct 2026
- Security findings
- Its passive scanner checks for sensitive data, CORS issues, missing security headers, and JWT issues. · github.com, 9 Oct 2026
- Security setup
- The install instructions say each Windows installer has a SHA-256 file to check and that releases are not yet code-signed. · github.com, 4 Oct 2026
- Sessions and scope
- It supports isolated workspaces and host or wildcard scope filtering with a site map visualization. · github.com, 9 Oct 2026
- Testing tools
- It includes payload based fuzzing, match and replace rules, and tools for decoding, encoding, hashing, and inspecting JWTs. · github.com, 9 Oct 2026
- Traffic capture
- It captures HTTP history and WebSocket sessions and provides an intercept queue and match-and-replace rules. · github.com, 4 Oct 2026
- Use cases
- The project describes it for web application security testing, bug bounty hunting, and API debugging. · github.com, 9 Oct 2026
Where Sniper stands on Freedom251
- Web Debugging Proxies#14 of 27