Documentation.
Everything from your first capture to self-hosted OAST, IDOR hunting, mobile interception, and agent-driven automation. New to Crusader? Start with the bug-hunting workflow or your first capture.
Start here
the methodology & the basics★ Cornerstone field guide
A bug-hunting workflow with Crusader
The end-to-end methodology: get traffic in and scope it, map the attack surface, triage passively, hunt the highest-ROI authorization bugs, prove the blind ones with OAST, then write the report — with a vuln-class playbook linking every step to its deep dive.
Field guide · ~12 min · all tiersYour first capture
Install, trust the CA (or skip it with the built-in test browser), route a browser, and read your first intercepted HTTPS request.
Guide · ~6 min · FreeUse FoxyProxy with Crusader
Optional FoxyProxy setup, plus when to prefer Crusader's built-in browser for WAF-sensitive JA3 behavior.
Guide · ~6 min · FreeZeroOmega / Proxy SwitchyOmega setup
Configure ZeroOmega or Proxy SwitchyOmega 3 for Crusader, with Chrome, Edge, Firefox, auto-switch rules, CA trust, and JA3 caveats.
Guide · ~8 min · FreeTrust the Crusader CA
Per-OS certificate trust on macOS, Windows, and Linux — plus the zero-install test-browser fallback that works on HSTS sites.
Guide · ~8 min · FreeTopic hubs
feature clusters & SEO entry pointsWeb security proxy
HTTP/2 and WebSocket capture, Repeater, read-only SQL, passive scanner triage, import, plugins, and automation in one local workspace.
Hub · proxy workflowMobile app security testing
Android lab setup, Frida cert-pinning bypass, mTLS extraction, APK/XAPK/APKS analysis, and mobile API replay.
Hub · mobile workflowIDOR & BOLA testing
Identity-aware replay for broken object-level authorization: capture two actors, diff responses, and promote evidenced findings.
Hub · authz workflowJA3 browser fingerprinting
JA3, JA4, HTTP/2 fingerprints, header order, FoxyProxy tradeoffs, and the built-in browser path for WAF-sensitive tests.
Hub · transportAgentic security testing
MCP, JSON CLI, read-only SQL, project memory, plugins, scoped planning, and human-gated active workflows.
Hub · agentsFinding bugs
triage, prove, reportHunt IDOR & BOLA with Shadow Replay
Capture two accounts as identities, then diff how one request answers different actors — the highest-ROI bug class.
Guide · ~10 min · Hunter ProThe Scanner: passive to active proof
Passive analysis over captured history (Free) and bounded active proof-replay (Pro) that refuses anything but safe reads.
Guide · ~9 min · Free / ProBlind SSRF → finding with Beacon
Plant an OAST payload in a suspected sink, catch the callback, read the proof chain, and promote it to an evidenced finding.
Guide · ~8 min · BYO Free / hosted ProRun your own private OAST server
Self-host Interactsh and point Beacon's Custom provider at it, so out-of-band callbacks stay on infrastructure you control.
Guide · ~12 min · Hunter ProCache analysis
Spot web cache deception and cache-poisoning surface from traffic you already captured — read-only triage, zero probes.
Guide · ~6 min · FreeCore workflow
the daily toolsRepeater
Edit and replay requests across Raw, Headers, Params, Body, and GraphQL views — as any saved identity.
Guide · ~6 min · FreeIntruder (Attack Studio)
Insertion points, the four attack modes, payload lists and processors, and response grep.
Guide · ~8 min · Free Sniper / ProMatch & Replace
Rewrite requests, responses, and even WebSocket frames in flight, with regex.
Guide · ~6 min · 10 rules Free / ProDecoder, Comparer & data tools
Encode/decode (URL, Base64, Hex, JSON, Protobuf), diff two items, and the protobuf/body/GraphQL/IDOR helpers.
Guide · ~6 min · FreeTarget scope & safety
Define what's in your engagement and the safety model that keeps active testing on authorized, non-internal hosts.
Guide · ~7 min · FreeMobile & Frida
android & ios interceptionKill cert pinning & intercept mobile
Create a rootable Android emulator, install the CA into system trust, attach Frida, and run the pinning bypass.
Guide · ~12 min · Hunter ProExtract mTLS client certs
Capture an app's client certificate from a rooted device or provisioned emulator, import it as an identity, and replay from Repeater.
Guide · ~10 min · Hunter ProStatic app analysis (APK/XAPK/APKS)
Pull an APK/XAPK/APKS apart without running it — manifest flags, permissions, custom headers, native strings, deep links, and endpoints as leads.
Guide · ~7 min · Hunter ProAgent & automation
MCP · CLI · SQLDrive Crusader from Claude Code
Connect the MCP server over stdio, call agent.guide first, and use safe history, project memory, scoped planning, oracles, Beacon, browser proof, and plugin tools.
The CLI & a CI pipeline
Every verb prints JSON to stdout — script captures, scans, history queries, and findings export, and wire a scan into CI.
Guide · ~10 min · Free / ProQuery your history with SQL
Read-only SQLite over captured traffic: the exchanges schema, the safe-query guard, and example queries.
Investigate and read-only SQL
Ask questions over the whole project database, type raw SQL, use FTS5, and pivot result rows into Repeater.
Guide · ~7 min · FreeImporting & teams
bring your work, share itImport a Burp, Caido, or HAR project
Turn a year of captured traffic into a live workspace — your original file is never modified.
Guide · ~6 min · FreeShare a workspace with Squad
Pool findings and redacted Repeater/Intruder tabs across a team — or self-host the team server yourself.
Guide · ~10 min · SquadExtending & reference
plugins, plans, communityWrite your first plugin
JavaScript hooks, the full api.* host surface, capability gates, hot reload, MCP exposure, and identity-safe replay.
Browse the extension catalog
Hot-reload community plugins for JWTs, Frida, JA3 profiles, agent workflows, IDOR probes, and more.
CatalogPlans & licensing
What's in Free, Hunter Pro, Squad, and Team Pro; the 14-day trial; and how to move your license between machines.
Reference · ~7 minCommunity & resources
Where to learn web security, practice legally, find wordlists, and contribute to Crusader.
Resources · ~5 min