Manual Tools

PTK is not only a scanner. The manual tools help you inspect browser state, replay requests, test tokens, and build reproducible proof.

Proxy and Traffic Log

The Proxy/traffic log captures browser-generated HTTP traffic. Use it to understand how the app actually communicates.

Look for:

• API routes with user IDs, object IDs, filters, search terms, and sort fields
• state-changing requests
• redirects and callback URLs
• file upload/download routes
• GraphQL or JSON APIs
• role-specific endpoints
• requests that include JWTs, session cookies, CSRF tokens, or custom auth headers

Send interesting requests to R-Builder for targeted testing.

R-Builder / Request Builder

R-Builder lets you edit, replay, clone, export, and scan individual requests.

Basic Workflow

1. Select a request from the traffic log.
2. Send it to R-Builder.
3. Change one thing at a time: parameter, header, method, body field, cookie, or token.
4. Replay the request.
5. Compare response status, body, redirects, timing, and side effects.
6. Save useful evidence.

Useful Manual Tests

• change numeric IDs to another user's ID
• remove or modify authorization headers
• replay state-changing requests
• test parameter pollution
• change content type or method
• remove CSRF tokens
• change JSON types: string to array, object, null, number, or boolean
• inject XSS, SQLi, command, or template payloads where authorized
• test redirect parameters with same-origin and off-origin URLs

Copy as cURL

Use cURL export when you need:

• a report reproduction command
• a quick retest outside the browser
• a handoff to another tool
• evidence that can be replayed in a controlled environment

Redact cookies, tokens, and personal data before sharing.

Macro Recorder

Macro Recorder captures an authorised browser journey and replays it in the live browser session. Use it for repeatable authentication, navigation, form-entry, and verification sequences that need the same cookies, storage, frames, and browser state as the application.

Record and Replay

1. Open the target page and select Record authentication or Record sequence.
2. Complete the workflow in the target application.
3. Return to PTK and review every recorded step before saving or replaying it.
4. For a workflow recorded by PTK, choose the preferred element path: Element ID, CSS selector, or Full path.
5. If the macro intentionally uses explicit runtime references, enter any missing values in the playback settings.
6. Replay the sequence. Use Stop to cancel it; a stopped sequence can be started again without reloading the target page.

Imported values are preserved and replayed literally, including passwords and tokens. Macro files may therefore contain credentials and must be stored and shared securely. PTK does not infer secrets, rewrite literal values, or ask the user to re-enter them. Explicit references such as ${PTK_SECRET:PASSWORD} remain available when the macro author deliberately wants runtime substitution; PTK prompts only when such a reference is present and its value is unavailable.

Runtime references are resolved by the component that owns replay:

Replay path	Secret reference	Variable reference
Full-extension Macro UI or Manage scans	PTK displays a password field for ${PTK_SECRET:PASSWORD}	PTK displays a text field for ${ACCOUNT_ID}
PTK Agent / ptk-scan --macro-file	PTK_MACRO_SECRET_PASSWORD	PTK_MACRO_VAR_ACCOUNT_ID
Generated Playwright, Puppeteer, or Selenium code	PTK_SECRET_PASSWORD	PTK_VAR_ACCOUNT_ID
Generated Cypress code	Cypress.env('PTK_SECRET_PASSWORD')	Cypress.env('PTK_VAR_ACCOUNT_ID')

The browser extension cannot read operating-system environment variables. In automation mode the Node.js PTK Agent reads PTK_MACRO_SECRET_<NAME> and PTK_MACRO_VAR_<NAME>, then supplies the resolved values to PTK Auto. A missing explicit reference stops before browser launch; a literal value in the macro requires no prompt or environment variable.

Import

Select Import, choose or drop a file, and review the detected format, target origin, step summary, warnings, and any explicit runtime references. Import changes the active macro only after you confirm that you are authorised to replay it against the displayed target scope. Unsupported executable commands are reported and block acceptance rather than being silently omitted.

PTK imports:

• PTK Flow JSON
• XML macro files (.rec or .xml), including Katalon Recorder TestCase XML
• ZAP Zest client scripts (.zst)
• Selenium IDE projects (.side)
• Chrome Recorder JSON

Imported files are converted to PTK's internal workflow model. Review the conversion summary because another tool may support commands, window behavior, or selectors that cannot be reproduced safely in PTK.

Zest has two different client scroll operations, and PTK preserves that difference. ZestClientElementScrollTo appears as an optional visibility helper: it brings an existing target into the viewport before a click or form action, and a stale helper does not terminate the workflow. The following click, fill, or submit step remains authoritative. ZestClientElementScroll is a required behavioural step that applies the recorded relative x/y movement to the located scroll container. It can trigger lazy loading or other scroll-driven application behaviour and therefore fails replay if its required container cannot be resolved.

Macros recorded by PTK coalesce browser scroll activity after it settles and store the final absolute position of either the page or the scrollable element. This avoids recording every wheel event while preserving scroll-dependent journeys. During replay PTK also brings required interaction targets into view before clicking, filling, selecting, sending keys, or submitting.

Imported actions retain the locators provided by the source file. If a required locator no longer identifies an interactable control—for example, an absolute XPath whose overlay index changed or a collapsed SPA input—PTK stops cleanly and reports that a required step could not be completed. PTK does not silently click a different element or write into a hidden control. Re-record that action or replace the brittle locator in the source macro.

The Element path selector is disabled for an imported macro. Import cannot invent selector alternatives that were not present in the source file, so PTK uses the supplied locators in their recorded order. This does not modify the imported workflow or its replay data.

Export

Choose the required format under Export settings. When the conversion is lossless enough to download, PTK keeps the page quiet and enables Download. When an enabled required action cannot be represented, PTK disables Download and shows Export blocked. See details. Open that message to review the preservation summary and grouped diagnostics.

Element-path selection applies to native PTK recordings; imported workflows keep their source locators. Element ID uses a stable ID captured during recording. If that element has no stable ID, PTK uses a portable CSS, name, or class locator before falling back to XPath; it never invents an ID. Timing settings are applied where the destination supports them.

An Error means an enabled required action cannot be represented and blocks download. A Warning means optional assistance is omitted or safely approximated, so download remains available. Info records an intentional non-executable omission such as a disabled step or comment. Repeated items are grouped by step type, with a short step-ID sample and expandable details.

PTK exports editable workflow files in PTK Flow JSON, XML, ZAP Zest, Selenium IDE, and Chrome Recorder formats. It can also generate read-only starter code for Playwright, Puppeteer, Selenium WebDriver, and Cypress. Generated code is intended for review and adaptation; PTK does not import arbitrary automation source code.

Zest export preserves hover as ZestClientElementMouseOver and delay as ZestActionSleep. Chrome Recorder export preserves hover directly and emits a bounded waitForExpression for a static PTK delay. PTK imports only that exact generated delay expression; it does not import arbitrary executable Chrome Recorder expressions.

XML remains the default download format and existing stored XML recordings are migrated automatically when opened. PTK continues to replay older XML event variants for compatibility.

JWT Inspector

Use JWT Inspector to decode, inspect, craft, and test JSON Web Tokens.

Watch: How to solve JWT PortSwigger labs using OWASP PTK

Where to Look

JWTs commonly appear in:

• Authorization: Bearer ...
• cookies
• localStorage
• sessionStorage
• API responses
• WebSocket or event-stream setup requests

JWT Checks

Common checks include:

• alg: none acceptance
• weak HMAC secrets
• algorithm confusion
• untrusted jku, jwk, or kid
• missing issuer/audience validation
• stale or overly long expiration
• privilege claims accepted from client-controlled tokens
• token accepted from an unexpected carrier, such as cookie vs header

JWT Evidence

Record:

• token location
• original header and claims
• modified header and claims
• exact request where the token was used
• server response
• why the behavior proves a security weakness

Never publish full live tokens in reports. Redact secrets and signatures when possible.

Cookies and Storage

Review cookies and browser storage because modern apps often split session state across multiple browser surfaces.

Cookie Checklist

• Secure
• HttpOnly
• SameSite
• domain and path scope
• expiration
• session vs persistent behavior
• sensitive values readable by JavaScript
• duplicate session cookies
• weak or unsigned preference/auth cookies

Storage Checklist

Review:

• localStorage
• sessionStorage
• IndexedDB
• service-worker caches
• tokens stored in JavaScript-readable locations
• role, tenant, or feature flags controlled by storage

Test whether changing storage values affects authorization, feature access, or API calls.

Request Smuggling Research

Request smuggling tests can be disruptive. Only run them when explicitly authorized.

Watch: OWASP PTK #8 4 3 request smuggling

Safe workflow:

1. Confirm scope and testing window.
2. Use non-production if possible.
3. Start with low request volume.
4. Capture exact raw requests and responses.
5. Stop immediately if instability appears.
6. Report impact carefully and include infrastructure context.

Collect:

• frontend and backend indicators
• raw request pair
• response timing and desynchronization evidence
• affected host/path
• reproducibility notes

Decoder, Encoder, Swagger, and Utilities

Use Decoder/Encoder for:

• URL encoding/decoding
• Base64
• JSON escaping
• hashing and comparison
• payload normalization
• nested token or parameter inspection

Use Swagger/API helpers when OpenAPI or Swagger definitions are available. Compare documented API routes with routes seen in traffic and routes discovered in JavaScript bundles.