| Find out more: | https://httptoolkit.com |
| Built by: | https://toot.cafe/@pimterry |
| Open source: | https://github.com/httptoolkit |
HTTP Toolkit can now automatically detect, parse & expose the EXIF metadata within intercepted images.
Quickly inspect the secret metadata in images to understand when, where, and how they were captured, and plenty more; EXIF can hide a surprising amount! https://en.wikipedia.org/wiki/Exif
Need a second opinion understanding your HTTP, or a quick first pass to find the good bits?
HTTP Toolkit now has MCP support!
Copy-paste setup for Claude Code and plenty more, so it just takes seconds to get your LLMs intercepting & inspecting HTTP all by themselves ✨
I've been thinking about https://simonomi.dev/blog/color-code-your-bytes/.
Whipped up a quick prototype for HTTP Toolkit's hex view - what do you think? Interesting and more useful than monochrome, or just visually noisy?
See if you can guess what each file type is here - answers in the alt text 😀
The proxy inside HTTP Toolkit (https://github.com/httptoolkit/mockttp) was just updated: 30%+ more throughput, lower latency, and perfect mirroring for WebSockets too.
Live now in Mockttp for custom proxies, coming to an HTTP Toolkit near you later this week!
Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios?
Dictionary Compression is here to save the day: https://httptoolkit.com/blog/dictionary-compression-performance-zstd-brotli/
https://httptoolkit.com/blog/dictionary-compression-performance-zstd-brotli/
Vitor Daniel reverse engineered & probed his university's mobile app API with HTTP Toolkit, discovered a vulnerable endpoint leaking private data, and successfully worked with them to patch the issue and secure the service.
Great to see reverse engineering improving security like this, take a look at his write-up for the full story: https://vitordaniel.is-a.dev/blog/como-eu-encontrei-uma-vulnerabilidade-no-sistema-da-minha-universidade
https://vitordaniel.is-a.dev/blog/como-eu-encontrei-uma-vulnerabilidade-no-sistema-da-minha-universidade
It's hard to find the needle in the haystack sometimes...
You can now right-click any request in HTTP Toolkit to use its hostname as a filter, to quickly hide any host or show it exclusively, in one click right from the traffic itself 🪡
Tim Perry
