Hey everyone,
I've been developing CatSuite, a free Android application focused on web application security testing and HTTP traffic analysis.
The project explores a technical challenge: bringing common web pentesting capabilities to Android without relying on a traditional desktop environment.
Rather than building another basic network scanner, I wanted to support workflows involving HTTP request interception, manual request manipulation, automated input testing, and API analysis.
Current capabilities include:
- HTTP/HTTPS traffic interception and inspection
- Repeater for modifying and resending HTTP requests
- Intruder with custom wordlist support
- Web endpoint discovery
- JWT decoding and inspection
- SSL/TLS certificate analysis
- REST API testing
- Browser controls for cookies and User-Agent
- Traffic export in HAR, JSON, TXT, and cURL formats
The interesting part is the mobile environment itself.
On a desktop, tools like Burp Suite and OWASP ZAP benefit from a mature ecosystem of proxy configurations, browser integrations, and debugging capabilities.
Android presents different constraints, especially around encrypted traffic inspection, application trust stores, and platform restrictions.
I'm interested in exploring where mobile tooling can be useful for real-world web security assessments and where a desktop environment remains necessary.
CatSuite is already available for free on Google Play:
https://play.google.com/store/apps/details?id=br.com.netcattest.catsuite.app
It's intended for research, learning, and authorized security testing.
I'd be interested in technical feedback from people working in offensive security:
What limitations would you expect from an Android-based interception and testing toolkit?
And which capabilities would make mobile web pentesting genuinely useful rather than just a novelty?
I'm particularly interested in feedback about HTTP interception, request manipulation, and practical assessment workflows.
submitted by /u/Pure-Band-5587[link] [comments]