HTTP/2, WebSocket replay, mobile interception, Frida cert-pinning bypass, response diffing, and IDOR/BOLA replay in one desktop app.
Open public alpha. Free tier forever. No account or card.
.js: hook + form + right-click + CLI. Hot-reload. Share as a gist.sql, hunt, llm. Your agent does real work.Crusader is broad on purpose: proxy, mobile, identity replay, JA3 transport, SQL, plugins, and agents all feed the same local project. These hubs collect the best starting points by testing job.
Capture HTTP/2 and WebSocket traffic, replay requests, query history, scan passively, import projects, and automate from one local workspace.
Android lab setup, system CA trust, Frida cert-pinning bypass, mTLS extraction, and APK/XAPK/APKS static analysis.
Capture two actors, replay scoped requests across identities, compare responses, and promote evidenced authorization findings.
Understand JA3, JA4, HTTP/2, header order, FoxyProxy tradeoffs, and when the built-in browser is the right path.
MCP, JSON CLI, read-only SQL, local project memory, plugins, scoped planning, and human-gated active workflows.
Real screens from Crusader running a live session — intercept proxy, Repeater with response diffing, a full Site Map, and analysis a stock proxy doesn't ship.
A whole bug-bounty session, in four moves. The same captured exchange flows from the proxy into the Repeater, into Attack Studio, into a finding — without leaving the project, without re-pasting, without three windows on top of each other.
Browse through the proxy. Pipe a curl through crusader send. Hit a mobile app with Frida-killed pinning. Let your agent do it through MCP. Every capture lands in one shared history.
Right-click → Send to Repeater. Tweak. Send. The new response is diffed against the last — line-level inserts, deletes, token changes colored. Token placeholders mean you don't paste a bearer into a hundred requests.
One click into Attack Studio. Sweep IDs, fuzz params, brute paths. Anomalies cluster by response signature — you scan five rows instead of fifty. The outlier is the lead. Or hit crusader hunt and the agent does the whole pass.
The interesting capture becomes a tracked finding, a JavaScript plugin (so it runs on every future request), a CLI command (so CI catches the regression), or an MCP tool call. Same captured truth. Different actor.
Drop a .burp file on Crusader's startup screen and it becomes a live workspace. Proxy history, site map, scope, scanner issues, notes all read in and re-indexed against Crusader's SQLite. Then every Crusader feature works against that captured history — diffs, Attack Studio, Frida replays, Identity Shadow Replay, plugins, agents. The switching cost is one drag-and-drop.
Beta access starts with the Free tier and no account or card. When you're ready, start the 14-day Hunter Pro trial inside the app with email only — every feature unlocked, every workflow available, no card and no sales call.
Most proxy features are surface-level — a button you didn't have, a panel you wanted. These four are foundational. Each one used to mean another tool, another script, or a workflow you didn't have time for.
The real fear in switching proxies isn't learning a new UI — it's the one feature you rely on quietly going missing. So here's the whole checklist: every Burp Pro capability, matched line for line, before we get to the four things Burp doesn't ship at all.
Every JavaScript plugin you write is automatically a side-panel form, a right-click action, a CLI verb, and an MCP tool. Every CLI verb emits structured JSON on stdout. Every MCP call returns the same JSON, awaited. Pipe through shell. Chain through an agent. Same primitives.
Bug-bounty crews shouldn't email project files around. Squad publishes a redacted project snapshot — findings, Repeater & Intruder tabs, identities — to a shared team endpoint, so the whole crew works from one workspace. Live presence, soft locks, and claimable tabs are rolling out during early access.
Hunter Pro is $499/year — exactly what Burp Pro costs. Your AppSec budget doesn't change to switch. The free tier ships a daily-driver proxy. Squad replaces passing project files around. Founder's Edition is the cheapest seat this product will ever sell.
Local proxy. HTTP/2 + WebSocket. History. Repeater (with diff). Decoder. Comparer. Unlimited JS plugins. CLI basics. Project import. Forever.
Everything in Free, unlocked. Attack Studio, Scanner, Beacon/OAST, Mobile + Frida, JA3 transport, Identity Shadow Replay, One-Button Hunt, MCP server, full CLI. Commercial use.
A full Hunter Pro seat for everyone + a shared team workspace. Publish findings, Repeater/Intruder tabs, and identities to one project. Live presence, soft locks & tab-claiming are rolling out in early access.
Squad for a whole org. SSO / SAML / SCIM, role-based access, assignment boards, a full audit trail, private extension packs, and a pooled Beacon quota across the team.
Team Pro on your own infrastructure. The shared workspace and Beacon run inside your network — nothing leaves your perimeter. Built for regulated and air-gapped teams.
Everything, plus data residency, a private extension registry, hosted AI credits, and SSO at scale — with procurement, MSA, security review, and priority support.
No. Drag a .burp file onto Crusader's startup screen and it becomes a live workspace — history, site map, scope, scanner issues, notes and highlights all import and re-index. Caido (beta), HAR, and Fiddler SAZ work the same way. Your original file stays untouched on disk.
A real daily driver: the HTTP/2 + WebSocket proxy, history, Repeater with diff, Decoder, Comparer, unlimited JavaScript plugins, CLI basics, and project import. No account, no app usage telemetry, no time-bomb — and it out-features Burp Community.
The open public alpha includes Windows 10/11, Debian/Ubuntu Linux amd64, and an Intel x64 macOS DMG. The macOS build is Developer ID signed, notarized by Apple, and stapled; Apple Silicon currently runs it through Rosetta.
Local-first. Everything lives in a SQLite database on your machine, and the app has no product analytics or usage telemetry. Its Crusader service calls are limited to optional software update checks and paid licensing checks. User-triggered Team Mode and “Review diff” send only the data needed for the feature you configured.
Yes — Beacon is built in. DNS, HTTP, and SMTP callbacks with geo/ASN, email alerts, and one-click promote-to-finding for blind SSRF, XXE, and out-of-band injection. No separate hosted add-on to configure — and you can run Beacon on your own server: self-hosted OAST is included on a single Hunter Pro seat, not gated behind a team or enterprise plan. (Burp's private Collaborator server is Enterprise-only.)
You drop to the free tier and keep everything you captured — history, identities, comments, and every plugin you wrote keep running. The trial never took a card, so there's nothing to cancel. Upgrade is one click whenever you're ready.
Windows 10/11 installer
Download only from crusaderproxy.com, follow your organization's software policy, and verify the SHA256 checksum before running. The ZIP is an alternate package format for environments that prefer archives, not a way around security controls. See Security & verification.
EXE 686f5dd6ed98066638e461b3b893d3a309cf3546b6fe3fe7a88d95fd105f4b6e
ZIP a60da374db5292c22de11f14163cecfd70ce3ba1b226b60627bc0a4464877cb2
Debian / Ubuntu, amd64
sudo apt install ./crusaderproxy_1.0.8_amd64.debDEB ff822e4bdc0bcbee38a72db4749c2286f8397cde7c0c133d4fddccb1d2310a0c
Intel x64 DMG
Signed with Developer ID, notarized by Apple, and stapled. Apple Silicon currently runs this Intel build through Rosetta; a native arm64 package is not yet available.
DMG 3bea7524f93681a77f37f632873ef9a399fc247f984fbe9bbf9ad4f1138da0f2
Checksums are available at /download/1.0.8/SHA256SUMS.txt.
The free tier stays free forever. Start the full 14-day Hunter Pro trial inside the app with email only and no card.
Founder's Edition: $249/year for life - first 500 seats.