Tired of proxies? Try AI-Intruder

Most of my web hunts start the same way. I click around a target in the browser, tab over to the proxy, read a request, tab back. Nothing about that loop is hard. It is just slow, and the slowness compounds — by the twentieth context switch I am no longer thinking about the application, I am thinking about the tooling.

So I built a browser extension that captures and analyses traffic where I am already looking, and hands the repetitive parts to a model. Here is a short hunt for the two bugs everyone learns first: reflected XSS and SQL injection.

⚠️ Everything below runs against VulnShop, a deliberately vulnerable app on my own localhost. Point tools like this only at systems you own or have written permission to test. That is not a disclaimer, it is the job.

Setup

Start the lab app:

php -S 127.0.0.1:8000

In the extension I set Scope to the host, flip Capture on, and start clicking through the shop like an ordinary user. No configuration, no certificate dance, no second window.

Reflected XSS

On the search page the passive scanner flags a reflected parameter before I have tried anything: the value of q comes straight back in the response, and the tool highlights exactly where it lands.

That is an open door. I send the obvious probe:

/search.php?q=<script>alert(1)</script>

The app renders it unescaped and the alert fires. Reflected XSS, confirmed in a single request — no manual grepping to find where my input surfaced.

SQL injection

The login form looks injectable, so I send it to the Intruder, mark the username as the insertion point, and load the built-in SQL injection payloads. A short, throttled run later the results table flags one payload that spikes the response length and trips an error signature — the app leaked a database error.

The classic authentication bypass works too:

username: ' OR '1'='1' --
password: anything

I am logged in as admin. One click of AI triage and the model reads the whole run back to me: which payloads mattered, which were noise, and why.

The takeaway

Neither bug is exotic. The model did not find anything I could not have found myself, and I want to be precise about that, because the interesting claim is a smaller one.

What changed is the distance between seeing something and understanding it. The passive scanner pointed at the reflected parameter before I thought to look. The fuzzer graded a hundred responses and handed me the one that mattered. I never left the tab I was already in, and I never pasted a request into a second tool.

That is the whole pitch. The proxy is not gone — it moved into the browser, and it brought an analyst who does not get bored.