Skip to content
SPECIFICTION
Get listed

Sniper

github.com

Free plan WindowsmacOSAPISelf-hosted
Visit github.com
Spec score 8.0 #17 of 27 in Web Debugging Proxies

What it is

Sniper is a free, MIT-licensed open-source desktop proxy for intercepting, inspecting, and modifying HTTP/HTTPS traffic. It targets penetration testers, bug bounty hunters, security researchers, and developers handling security testing or API debugging. Sniper captures HTTP history and WebSocket sessions, with an intercept queue and match-and-replace rules. Request replay, payload-based fuzzing, and a passive scanner cover sensitive data, CORS issues, missing headers, and JWT issues. Isolated workspaces, host or wildcard scope filters, and a site-map visualization organize sessions. The bundled sniper-cli supports JSON-first scripting, and the repository includes Claude and Codex skill templates. Sniper can chain authenticated upstream HTTP and SOCKS5 proxies; its incoming listener accepts HTTP proxy requests and CONNECT, not SOCKS client requests. Windows users can download a setup executable or ZIP, while macOS users can download a DMG. Windows x64 is described as the first port, with Linux validation pending. Releases are not yet code-signed; Windows installers have SHA-256 files to check. A remote headless UI listener requires authentication, and the UI serves HTTP rather than TLS.

Spec sheet

Purpose
Sniper is an open-source desktop web security proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic for security testing, bug bounty work, and API debugging.Read 4 Oct 2026 · github.com
Product
Sniper is an open-source desktop proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic.Read 9 Oct 2026 · github.com
Intended users
The project names penetration testers, bug bounty hunters, security researchers, and developers as its intended users.Read 4 Oct 2026 · github.com
Audience
It is aimed at penetration testers, bug bounty hunters, security researchers, and developers who need to inspect network traffic.Read 9 Oct 2026 · github.com
Platforms
The project provides macOS and Windows downloads; it says Linux validation is still pending.Read 9 Oct 2026 · github.com
Security
The README says installers are not yet code signed and recommends checking the adjacent SHA-256 file before running them.Read 9 Oct 2026 · github.com
License
The repository identifies Sniper as MIT licensed.Read 9 Oct 2026 · github.com
AI and automation
The bundled JSON first CLI supports scripting, and the repository includes Claude and Codex skill templates.Read 9 Oct 2026 · github.com
Automation
The bundled sniper-cli provides JSON-first scripting, and the repository includes Claude and Codex skill templates.Read 4 Oct 2026 · github.com
Capture and replay
It captures HTTP history and WebSocket sessions, supports request interception, and can modify and resend captured requests.Read 9 Oct 2026 · github.com
Downloads
The README directs Windows users to a setup executable or ZIP and macOS users to a DMG from GitHub Releases.Read 4 Oct 2026 · github.com
Platform limitation
The README says Windows x64 is the first port and Linux validation is still pending.Read 4 Oct 2026 · github.com
Proxy chaining
Sniper can chain outgoing traffic through authenticated HTTP or SOCKS5 proxies; its incoming listener accepts HTTP proxy requests and CONNECT, not SOCKS client requests.Read 9 Oct 2026 · github.com
Release limitation
The Windows x64 portable ZIP requires Microsoft Edge WebView2 Runtime, is unsigned, and has no in app updater.Read 9 Oct 2026 · github.com
Remote access
For a non loopback headless UI listener, remote clients must redeem a one time token, and the project advises using an SSH tunnel or authenticated TLS reverse proxy across untrusted networks because the UI serves HTTP.Read 9 Oct 2026 · github.com
Security findings
Its passive scanner checks for sensitive data, CORS issues, missing security headers, and JWT issues.Read 9 Oct 2026 · github.com
Security setup
The install instructions say each Windows installer has a SHA-256 file to check and that releases are not yet code-signed.Read 4 Oct 2026 · github.com
Sessions and scope
It supports isolated workspaces and host or wildcard scope filtering with a site map visualization.Read 9 Oct 2026 · github.com
Testing tools
It includes payload based fuzzing, match and replace rules, and tools for decoding, encoding, hashing, and inspecting JWTs.Read 9 Oct 2026 · github.com
Traffic capture
It captures HTTP history and WebSocket sessions and provides an intercept queue and match-and-replace rules.Read 4 Oct 2026 · github.com
Use cases
The project describes it for web application security testing, bug bounty hunting, and API debugging.Read 9 Oct 2026 · github.com

Plans and prices

Sniper Free Open-source desktop web proxy Read 9 Oct 2026 · github.com

Every Sniper plan and price →

Strong points and limits

Strong points

  • Intercepts and edits HTTP/HTTPS traffic
  • Captures WebSocket sessions
  • Request replay and payload fuzzing
  • Passive checks for several security issues
  • JSON-first CLI scripting

Limits

  • Linux validation is still pending
  • Releases are not code-signed
  • Remote UI serves HTTP rather than TLS
  • Incoming listener does not accept SOCKS client requests

Who it suits

It suits security testers, bug bounty hunters, researchers, and developers who need to inspect or replay web traffic. It also supports scripted workflows through its JSON-first command-line tool.

Verdict

Sniper combines proxy interception, replay, scanning, and scripting for web-security work. Its unsigned releases, pending Linux validation, and HTTP-only remote UI require deliberate setup and handling.

Where Specifiction places it

Alternatives to SniperAll alternatives →