CatSuite modules

The CatSuite modules form a complete web security and API testing lab inside a single Android app. The Interceptor and the Network Proxy capture requests and responses, the Browser and CatEyes explore pages and identify technologies, the Repeater and the Intruder resend and automate variations, the Discoverer reveals paths and parameters, the Decoder translates tokens and hashes, SSL/TLS triages the secure connection, Wordlists and payloads feed the local attacks and History keeps the timeline and notes. This page introduces each module, explains the concepts they all share, shows how to use and configure the set as a whole and tells you which module to pick at each stage of the work.

The CatSuite modules and what they are for #

Every module runs in the same local lab: traffic is captured, analyzed and resent on the device itself, data stays on the device and you choose the authorized targets. The table summarizes each module, what it is for and where to open it in the app.

Core concepts: the modules glossary #

The same terms show up on almost every CatSuite screen. The glossary below explains each one and points to the module where it matters most.

How the modules connect #

The modules share the same history and pass requests to each other with a single tap:

• The Network Proxy and the Browser feed the Interceptor and History with captured traffic.
• From a history capture you can send the request to the Repeater (fine tuning), the Intruder (payload automation), the SSL/TLS Analyzer, the Decoder or the notepad.
• The Discoverer and the Intruder read the lists from Wordlists and payloads and send findings back to the Repeater.
• CatEyes analyzes the page open in the Browser, and the Decoder interprets tokens and values coming from any module.
• Extensions and visual workflows observe and extend these modules, with source marking the origin (proxy, network_proxy, repetir, intruso, descobridor).

The screen: main navigation, MENU and module panels #

On the home screen, tap START. On first access, the app shows the terms of use and the module selection: History, Notepad, Discoverer, SSL/TLS Analyzer and Network Proxy can be enabled right then or later in Settings.

Bottom bar #

Panels and tabs of each module #

Each module has its own layout. Use the table as a quick map before opening the detailed page.

Options and how to configure the modules #

Each module has its own settings page, covered in detail in its documentation. The table gathers the options that most influence the lab as a whole, with the app's real values and defaults.

To prepare the lab, open Settings and enable the optional modules you plan to use. History comes first, because without it there is no timeline to review later. Enable the Network Proxy only when you need to capture traffic from another device or app.

To avoid freezing the whole device, keep interception off while you are only observing, and turn on Pause only in scope with the target hosts listed under Scope management. That way the queue holds only the traffic you care about.

To control the pace of the active modules, start with the Discoverer's safe defaults (2 requests per second and a 250 ms delay) and, in the Intruder, set a requests-per-second cap or a delay before running large lists. The Discoverer's automatic 429 backoff eases the load when the target asks for a pause.

To protect your evidence, keep Mask sensitive data on in the Network Proxy and match retention to the size of the job. Ignoring certificate errors is a lab exception: leave it off on public targets.

Buttons and actions that link the modules #

The actions below are the lab's "plumbing": they move a request from one module to another and take the evidence out of the app.

End-to-end lab workflow #

A typical test moves through several modules, from the first traffic to the report. The table shows the phases and what each one delivers.

Which module to use when #

Step by step: your first full cycle in CatSuite #

1. On the home screen, tap START, accept the terms of use and enable at least History and Notepad in the module selection.
2. On the bottom bar, tap BROWSER and open an authorized target. The traffic it generates already enters the intercepted flow.
3. In the Browser, open CatEyes from the eye badge and tap VERIFICAR (verify) to identify the page's technologies.
4. Tap INTERCEPTOR, open the HISTORY tab and use the site tree to see the hosts and endpoints you visited.
5. Tap a capture to read headers, body and response. If there is a token, long-press and send the value to the Decoder.
6. Long-press again and choose Send to the Repeater. Change one field, tap SEND and compare the responses.
7. When you need to test many values, send the same capture to the Intruder, tap AUTO-DETECT, pick a wordlist on the PAYLOADS tab and tap START INTRUSION.
8. To look for hidden paths, open the Discoverer from the MENU, choose the wordlist under CONFIGURAÇÕES (settings) and tap SALVAR (save); then enter the URL with $CAT$ and tap INICIAR (start).
9. Write your observations in the Notepad and review the timeline in History.
10. On the Interceptor's OPTIONS tab, open DOWNLOAD AND SHARE, choose the format and tap download to keep the evidence.

Cross-module usage examples #

A request captured in the Interceptor history and sent to the Repeater:

GET /api/profile?id=42 HTTP/1.1
Host: target.example
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhbmEiLCJyb2xlIjoidXNlciIsImV4cCI6MTc5OTk5OTk5OX0.c2lnbmF0dXJl
Accept: application/json

The payload of the token above, after pasting it into the Decoder's JWT inspector:

{
  "sub": "ana",
  "role": "user",
  "exp": 1799999999
}

The same request in the Intruder, with the position marked by AUTO-DETECT:

GET /api/profile?id=§42§ HTTP/1.1
Host: target.example
Accept: application/json

Discoverer URLs with the $CAT$ marker, for paths and for parameters:

https://target.example/$CAT$
https://target.example/search?$CAT$=cat-suite

A simple wordlist ready to import under Settings > Wordlist:

admin
api/v1
backup
config
uploads

Manual proxy settings on a second test device:

Server: 192.168.0.42
Port: 8080

A command generated by the cURL export, ready to reproduce outside the app:

curl -i -X GET "https://target.example/api/profile?id=42" \
  -H "Accept: application/json"

Where to download CatBridge and the extensions SDK #

The CatSuite app is free and ships with every module on this page; you install it from Google Play. The developer tools live at official addresses:

The step-by-step guides are in Downloads and SDK, Install and pair CatBridge and CatSuite Studio for VS Code.

Common problems and FAQ #

A module does not show up in the MENU. History, Notepad, Discoverer, SSL/TLS Analyzer and Network Proxy are optional modules. Enable them in Settings.

History is empty. Make sure History is enabled in Settings, that Interceptor history is on and that the capture conditions (Wi-Fi, Data, Charging) are not restricting recording.

I turned interception on and all traffic stopped. That is the expected behavior: the queue holds everything until you act. Use SEND or DROP on each item, or turn on Pause only in scope.

Traffic from other apps does not appear. The Browser captures only the traffic it generates itself. For other apps and devices, use the Network Proxy with the CA installed on the client.

HTTPS does not validate in the Network Proxy. The CA was not installed as trusted on the client, or the host is on the Bypassed hosts list. Check the fingerprint with COPY FINGERPRINT.

What is the difference between the Repeater and the Intruder? The Repeater does precise, manual replay of one request at a time; the Intruder automates many variations from marked positions and a wordlist or generator.

Where does the $CAT$ marker go in the Intruder? In the Intruder you do not type the marker: the AUTO-DETECT and MARK SELECTION buttons wrap the chosen span and the position shows up as P1, P2 and so on. In the Discoverer, $CAT$ goes literally into the base URL.

CatEyes says to open a site first. It analyzes the page open in the Browser. Load an authorized target before tapping VERIFICAR.

Do CVE signals confirm a vulnerability? No. They are leads from the local database for manual review; the detected version may be incomplete or already patched by the vendor.

My wordlist was not accepted. The file must be a .txt with one entry per line and at least one useful line. See Wordlists and payloads.

The Network Proxy stopped on its own. The listener works only while CatSuite is in the foreground and resumes automatically when you return to the app.

Next step #

• Interceptor
• Network Proxy
• Browser
• CatEyes
• Repeater
• Intruder
• Discoverer
• Decoder
• SSL/TLS
• Wordlists and payloads
• History and notes
• Downloads and SDK
• CatSuite extensions