From a proxy plugin to a protocol workbench.

This is the story of how a plugin I wrote to paper over one tool's limitations turned into a standalone workbench with nine hand-rolled protocol stacks — and why, somewhere around the third rewrite, I stopped patching someone else's foundation.

Like a lot of tools, VirtuProbe started as an itch I couldn't stop scratching.

I was living in a popular web-security proxy — the kind that's genuinely excellent for a single engagement, one window, one target. But the moment my work spanned projects — different clients, different scopes, different protocol sets — the model started to fight me. Workspaces didn't share. Switching projects was heavy. And anything that wasn't HTTP lived entirely outside the tool. The instant I needed to check what actually landed in a mailbox, or bind against a directory, or resolve a record, I was out of the proxy and back in a pile of CLI tools and a junk inbox.

So I did what engineers do: I started writing a plugin to compensate. It grew. Then one evening I sat back, looked at what I'd built, and realised the frame was wrong. I was bolting a different product onto someone else's foundation. The plugin was fighting the host as much as it was helping me.

The same wall, everywhere I'd worked

The more I stared at it, the more familiar the gap felt. A greenfield core-banking platform one year, a pixel taking hundreds of millions of hits a day the next — wherever I'd worked, I kept hitting the same wall. The testing tools the market handed me were never quite enough, and I'd end up coding around them, sometimes for weeks at a stretch. The proxy plugin was just the latest patch over the same hole I'd been patching my whole career.

I started again, this time as a standalone. The internal codename was beer-request-manager — don't ask. The plan was deliberately small: get the cross-project pain out of the way and ship a no-nonsense workbench for the handful of protocols I actually used.

Then I kept going. Mostly during sleepless nights on Hack The Box, where the gap between "the client library will let me do this" and "the box wants me to do something the library refuses to send" is the entire game.

Why hand-rolled, and why it mattered

The protocol list grew: HTTP first, then SMTP, IMAP, LDAP, DNS, SMB, SpamAssassin scoring, Kerberos. And every one of them is a stack written from scratch against the RFC, not a wrapper around an existing library.

That wasn't a purity thing. It was a practical one. Every library I reached for "helpfully" fixed my input before it hit the wire — normalising a header, rejecting an invalid command, refusing to send the malformed packet that was the entire point of the test. The help was the problem. When you're probing an edge case or fuzzing a server, you need the bytes you asked for to be the bytes that go out. So I wrote the stacks myself, so nothing sits between the intent and the socket.

Then came chains, so I could stitch the protocols together — fire an HTTP request, catch the confirmation email over IMAP, extract a token, use it in an LDAP bind, all in one runnable file. Then a MITM proxy, because once you have probes, the natural next step is "catch a real request off the wire and turn it into one." Each piece made the next one obvious.

What started as a plugin to patch one tool's seams had turned into its own thing. VirtuProbe Studio.

I didn't kill the plugin

The original companion plugin still lives, scoped down to two things that are genuinely useful when that proxy is already your home: send any HTTP request from the proxy straight into VirtuProbe as a probe, and expose a small endpoint the proxy can post to so a request drops right into your target list. If that proxy is your daily driver, VirtuProbe is a side door, not a replacement. I'm not interested in telling people to abandon a tool that works for them — I'm interested in the moment they hit the wall I kept hitting.

Where it is now

It started as a one-person project. It isn't one anymore — a small team builds and maintains it with me now, and a proper company is taking shape around it. For the moment it runs as an independent Czech sole-trader business, which suits me: the support queue is my inbox, and the person who answers the mail is the person who wrote the code.

The tool is free to download and use as a real workbench — not a trial. We only charge for the heavy machinery. That's on purpose, and it's a decision I'll write about another time.

Jakub Stonavský is the founder and maintainer of VirtuProbe Studio, based in Prague. More about the project and how to reach me →