Pentest your own app

This guide uses Cloak Proxy to probe your own app’s API for common weaknesses: tampering with a request mid-flight, replaying it with changed parameters, checking the response security headers and for leaked secrets, and scripting systematic edits across many requests. It finishes with how to record findings.

Danger

Test only systems you own or have written permission to test. Intercepting, decrypting or tampering with traffic you are not authorized to touch is illegal in most places. Everything below assumes the app and its backend are yours or covered by a signed authorization.

What you need

Written authorization for the target, if it isn’t yours	Keep it on file before you start
Cloak Proxy capturing the app, with HTTPS decrypted	See Debug a mobile app or macOS traffic
A test account you can safely change data with	Tampering can create, modify or delete real records

Intercept and tamper at a breakpoint

A breakpoint holds a request while the app waits, so you can change exactly what reaches the server.

1. Capture the request you want to probe, right-click it, and choose Tools → Breakpoint…. Leave Pause on request on. Keep the matcher tight so only this call pauses.

   123

   A breakpoint scoped to one endpoint.

   1. Tool on/off
   2. Matcher — keep it tight
   3. Pause on request and/or response

   ×

   

2. Trigger the call. The Breakpoint window opens with the request held.

   1234

   A held request. Change any part before it's sent.

   1. Request paused
   2. Headers, including Authorization
   3. Execute sends your version
   4. Abort drops it

   ×

   

3. Tamper and observe. Common checks:

   Change	What it probes
   An id in the path or body to another user’s	Broken object-level authorization (IDOR)
   Remove or alter the Authorization header	Missing authentication checks
   A role, isAdmin or price field in the body	Mass assignment / privilege escalation
   Oversized or malformed body	Input validation and error handling

4. Click Execute to send your edit, Cancel to send the original, or Abort to drop it. If the rule also pauses the response, inspect or change what comes back.

Caution

Tampering sends real requests to your backend. Use a test account and a non-production environment where you can. Turn the breakpoint off when you finish so you don’t hold ordinary traffic.

Replay with edits

For quicker iteration than a breakpoint, resend a captured request with changes.

1. Right-click a request and choose Edit and Repeat… (<kbd>⌥</kbd> <kbd>⌘</kbd> <kbd>E</kbd>). The Compose window opens prefilled.

2. Change a parameter, header or token and press Send (<kbd>⌘</kbd> <kbd>↩</kbd>). Repeat with different values to sweep an input.

3. Decode tokens and encoded values inline: select text in a request or response, right-click, and use Quick Preview to decode Base64, a JWT, URL-encoding, timestamps or JSON — useful for reading a session token or a signed parameter before you tamper with it.

Check headers and secrets

Open Insights (<kbd>⌥</kbd> <kbd>⌘</kbd> <kbd>I</kbd>) to review the responses in bulk.

1. On the Security tab, read each host’s A–F grade and issues: missing HSTS/CSP/nosniff/clickjacking protection, cookies without Secure/HttpOnly/SameSite, wildcard CORS with credentials, and disclosed software versions.

   12

   Security grades and the specific header and cookie issues behind them.

   1. Hosts by grade
   2. Each issue, with Show Request

   ×

   

2. On the Secrets tab, look for keys, tokens in URLs, card numbers and credentials over plain HTTP. Values are masked; click Show Request to see where each came from. See Find leaked secrets.

Script systematic tampering

To apply the same change across every matching request (not one at a time), use the Scripting tool. Scripts run onRequest before a request is sent and onResponse before the app sees it.

1. Open Tools → Scripting, add a rule, and set its matcher to the host or path you’re probing.

   1234

   Scripting: change every matching request or response in JavaScript.

   1. Tool on/off
   2. Run onRequest / onResponse
   3. Check Syntax and Snippets
   4. The onRequest / onResponse handlers

   ×

   

2. Write the change. For example, strip the auth header to test whether endpoints enforce it, or flip a flag in every response to see what the client exposes:

   function onRequest(context, url, request) {
     // Probe missing-auth handling across every matching call:
     delete request.headers["Authorization"];
     return request;
   }
   
   function onResponse(context, url, request, response) {
     // response.body is an object for JSON
     console.log(response.statusCode, url);
     return response;
   }

3. Click Check Syntax, watch the Console for console.log output, and read the results in the traffic list (scripted flows are tagged Script). sharedState persists across scripts (for example to carry a token between calls) until you Reset sharedState.

Caution

A script that removes auth or changes bodies affects every matching request while the tool is on. Scope the matcher narrowly, watch the traffic, and turn Scripting off the moment you’re done.

Record findings

1. Highlight and comment interesting requests: right-click → Highlight by color, and Add Comment….

2. Export the evidence for your report. Use Insights → Export Report for a Markdown summary, or export the relevant requests as HAR with Redact secrets ticked so you don’t leak live tokens into the report.

3. Export the tool rules you used (Tools → Export Rules…) so a teammate can reproduce the test.

This is not a substitute for a professional test

Cloak Proxy helps you find and demonstrate issues, but it is one tool, not a full security assessment. For a thorough review of a product that matters, bring in a professional. Subcloak offers security testing services at subcloak.com/services.

Clean up

1. Turn off Breakpoint, Scripting and any other tool you enabled, and Reset sharedState.

2. Delete or disable the probing rules so they don’t fire later.

3. On a device, remove the Wi-Fi proxy and profile when you’re done.

Related

BreakpointPause and edit requests and responses.

ScriptingThe full onRequest/onResponse API and sharedState.

Find leaked secretsThe secret scanner and security grades in detail.

Quick previewDecode Base64, JWT, URL-encoding and timestamps inline.