Questions we actually
get asked.

VirtuProbe Studio is a multi-protocol request workbench for engineers and security professionals. It lets you send raw requests over HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos and SpamAssassin, and query MySQL, MariaDB, PostgreSQL and MongoDB, all from the same interface, chain them together, and script them with JavaScript or Groovy.

The idea behind it is that your integrations do not stop at HTTP, so the tool you test them with should not either.

Two main audiences:

• Integration engineers, building or testing systems that talk SMTP, LDAP, DNS, or similar. VirtuProbe replaces ad-hoc tooling and telnet sessions with a structured, repeatable interface.
• Security professionals, penetration testers and bug bounty hunters who need raw access to the protocols themselves, the ability to send malformed packets (fuzzing), and a MITM proxy that gives you full protocol visibility.

If a single-purpose HTTP proxy is your daily driver and you keep reaching for other tools the moment something isn't HTTP, VirtuProbe is the side door you were missing.

Most request tools stop at HTTP. VirtuProbe covers eleven protocols in a single interface. The other key differences:

• Custom protocol stacks, hand-written against the RFCs rather than wrapping a library. This means you can send malformed packets, arbitrary commands, and raw payloads that a standard library would silently sanitise.
• Cross-protocol chaining: a single chain can send an HTTP probe, extract a token, use it in an LDAP bind, then check the result with a DNS lookup.
• Fuzzing: mark any field with §payload§ and run a wordlist against it. Works across all protocols.
• MITM proxy: intercept and replay raw traffic, well beyond HTTP.

No. VirtuProbe is a desktop application that runs entirely on your machine. The execution server can also be deployed inside a target network (or a Docker container) for probes that need to fire from within the perimeter, but there is no VirtuProbe cloud service that handles your requests.

Your probes and data never leave your machine unless you point a probe at an external target yourself.

Yes. Pre-built installers are available for:

• macOS: Apple Silicon (ARM) and Intel (x64), distributed as a .dmg
• Windows: x64, distributed as an .exe installer
• Linux: x64 and ARM, distributed as an AppImage

The application bundles its own Java runtime, so there is nothing to install alongside it.

VirtuProbe currently supports eleven protocols. Eight have hand-written client stacks built directly against the RFCs; MySQL, MongoDB and PostgreSQL are library-backed (a database wants a driver, not raw packet control):

• HTTP/HTTPS: arbitrary methods, raw headers, body, cookies, redirects, TLS; GraphQL and MCP request modes
• SMTP: full command sequence, STARTTLS, AUTH, DATA, fuzzing per-command; Action Mode "send email"
• IMAP: login, list, select, fetch, search, STARTTLS; Action Mode "find message"
• LDAP: bind, search, compare, add, modify, delete; custom filters; Action Mode "check login / find entry"
• DNS: A, AAAA, MX, TXT, CNAME, SRV, PTR; UDP and TCP; custom resolvers
• SpamAssassin: SPAMC/SPAMD protocol for message scoring and analysis
• SMB: file operations, share enumeration, ACL reads; NTLM auth and pass-the-hash (Security tier)
• Kerberos: AS-REQ credential validation, AS-REP Roasting, Kerberoasting (Security tier)
• MySQL / MariaDB: run SQL, extract column values, chain the result into assertions (Engineering tier)
• MongoDB: find/insert/update/aggregate and more, form or full shell query, extract document fields (Engineering tier)
• PostgreSQL: run SQL, extract column values, chain the result into assertions (Engineering tier)

A MITM proxy is included as well, as a SOCKS5 tunnel or an HTTP intercept that can also rewrite and mock what passes through it.

Standard libraries "help" by fixing things. They normalise headers, reject invalid method names, refuse to send malformed packets. That is exactly what you don't want when you're testing protocol edge cases or fuzzing.

VirtuProbe's stacks are written directly against the RFCs. This means you can send whatever bytes you want, including things that should fail, which is the point when you're finding bugs or testing server resilience.

Yes, and it's the core value of chains. A chain is a sequence of steps that can mix protocols freely. A typical example: send an HTTP login request, extract the session token from the JSON response, then use it in an LDAP search. Each step's output feeds the next via variable extraction.

Every protocol is a chain step: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB, Kerberos, MySQL, MongoDB and PostgreSQL, alongside the control flow steps (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF).

SMB is a full protocol here: a probe, a chain step, and entries in the library. It covers file read/write/delete/rename, directory listing and creation, share enumeration, ACL reads and writes, and a recon slice over MSRPC named pipes (LSA policy, SAMR user and group enumeration, RID cycling, NetServer/NetShare/NetSession, workstation sessions).

Authentication is NTLM, pass-the-hash, or a null session, with SMB3 signing and encryption available. In a chain, SMB_SUCCESS, SMB_LAST_STATUS, SMB_SHARE_LIST, SMB_FILE_CONTENT, SMB_FILE_MATCHES, SMB_RPC_LINES and LSA_DOMAIN_SID pass values to the next step, and a share list feeds an ITERATE step directly.

SMB needs the Security tier.

A chain is a named sequence of steps. Each step can be a protocol probe or a control-flow instruction. Steps share a variable context: an earlier step can extract a value (e.g. HTTP_JSON_PATH $.token) and later steps reference it with {{token}}.

Control-flow step types:

• ITERATE: runs child steps once per item in a list; last iteration's variables bubble up
• CONDITION: evaluates a JavaScript or Groovy expression; skips children if false
• PARALLEL: forks child steps into concurrent workers, merges results
• ASSERT: fails the chain if a variable doesn't match an expected value or pattern
• CHAIN_REF: calls another chain as a sub-routine, passing and receiving variables

Extractors pull values from step responses and store them as chain variables. Available extractors:

• HTTP_STATUS: HTTP response status code
• HTTP_JSON_PATH: JSONPath expression against the response body
• HTTP_BODY_RAW: entire response body as a string
• HTTP_HEADER: a specific response header value (case-insensitive)
• LDAP_SUCCESS: whether the LDAP operation succeeded
• LDAP_EXCHANGE_RESULT_CODE: result code for a specific LDAP operation
• DNS_SUCCESS: whether the DNS query resolved
• DNS_ANSWER_VALUE: the first answer record's value
• REGEX: arbitrary regular expression against any text
• CONSTANT: a literal value (useful for seeding variables)

A script runs in JavaScript on GraalJS or in Groovy on the JVM, and a new script starts in JavaScript. The JavaScript engine is sandboxed: it reaches only the API we hand it, with no filesystem access. Groovy is not sandboxed, and a Groovy script can do anything the application can, so treat one the way you would treat any code you run yourself. They have access to a vp binding that exposes the VirtuProbe API. You can send probes programmatically and process their responses:

def result = vp.send("My Bundle", "Login probe", [username: "alice"])
println result.extract("HTTP_JSON_PATH", "$.token")

Use println. Output captured through the out binding appears in the UI. System.out.println is not captured.

A script lives in a bundle, like everything else you author, and runs against the environment of the project you are working in.

Fuzzing lets you run a probe repeatedly, substituting different payloads into marked fields on each run. Mark a field with §payload§ (section-sign markers) and supply a payload list, and VirtuProbe substitutes the payload and collects the results.

Works in any probe field across any protocol. Results are not saved to history; they appear in the fuzz results panel only. Fuzzing needs the Security tier.

Each Project can have multiple named environments (e.g. "Dev", "Staging", "Prod"). Each environment is a key-value map. Switching the active environment instantly changes which values are injected into probe fields and chains that reference {{varName}}.

Variable priority: values set during chain execution override environment variables (chain wins on collision). Probe inline variables override environment variables too.

The free tier gives you a fully working workbench with no time limit, and a lot of things other tools charge for:

• HTTP, DNS, and SMTP probes + chaining (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF)
• Unlimited probes, bundles & chains
• AI assistant: bring your own key, and we never charge for tokens
• API auth: OAuth2 (every flow), Basic, Bearer, API key, Digest
• GraphQL requests
• Import OpenAPI / Postman / Bruno / HAR / Insomnia / cURL
• Directory-backed GIT workspaces
• Run history, diff & JSON evidence export
• Community library access (71 probes across protocols)

It needs no account and no cloud, and it is permanently free.

Engineering tier is for shipping and debugging integrations:

• Stateful protocols: IMAP, LDAP
• MySQL / MariaDB, MongoDB & PostgreSQL database probes: run a query, extract columns, assert on the row
• JavaScript and Groovy scripting (with a real code editor, autocomplete and linting)
• MITM proxy & interception (TLS termination)
• Service virtualization: mock rules in the proxy, so you can answer for a dependency that is down or does not exist yet
• Enterprise & Windows auth: NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4
• Library: generic APIs, integrations, cloud SDKs, and the infrastructure collection (Kubernetes, Docker, Vault, Prometheus, Elasticsearch)

Security tier is aimed at penetration testers and security researchers. It inherits everything in Engineering, including the MITM proxy and the service-virtualization mocks, and adds the offensive kit:

• Fuzzing: §payload§ markers in any probe field, plus raw byte-for-byte requests and request-smuggling detection
• SMB probe: file ops, share enum, ACL, NTLM, pass-the-hash
• Kerberos probe: AS-REP Roasting, Kerberoasting
• SpamAssassin scoring
• Full pentest library (HTTP, SMTP, IMAP, DNS, Active Directory, Kerberos, SMB, WordPress, MongoDB and API security, around 700 probes)

Yes. The Academic License gives verified students and academics full Security tier access at no cost. It's available to:

• Students currently enrolled in a degree programme (any field)
• Researchers and faculty: PhD candidates, postdocs, lecturers, professors
• Instructors licensing for a course, and university security/CS societies or CTF teams

Apply for the Academic License →

When you subscribe via Paddle, you receive an access key (UUID). Enter your email and that key in the License panel inside VirtuProbe Studio. The app validates against the license server and caches your tier locally, then re-validates every 12 hours in the background.

Your license is tied to the email you used at checkout, and it activates on up to three of your own devices. The app re-checks every 12 hours and the cached licence is good for 48, and a check that cannot reach the server keeps your tier rather than dropping it, so losing the connection does not interrupt your work.

Yes. One license covers one person on up to three devices: laptop, desktop, a VM, whatever you work on. To cover more people, each person needs their own license; for teams and organisations, reach out, because team and Enterprise arrangements are handled on request.

No. The installer bundles a complete JVM (Temurin 21). You do not need to install Java, and the bundled JVM does not conflict with any existing Java installation on your system.

macOS builds are signed with an Apple Developer ID and notarized by Apple, so they open with no Gatekeeper warning. Windows builds are not yet code-signed (Authenticode is next), so SmartScreen may warn on first launch.

Either way, verify the SHA-256 checksum published on the download page before opening. If anything looks off, write to security@virtuprobe.studio.

To proceed on Windows: click More info, then Run anyway. You will not see the warning again after installing.

VirtuProbe stores probes, bundles, chains, scripts, and settings in a platform-appropriate directory:

• Windows: %APPDATA%\VirtuProbe
• macOS: ~/Library/Application Support/VirtuProbe Studio
• Linux: ~/.local/share/virtuprobe

Everything is stored locally in an embedded database, with no cloud sync. To back up your data, copy that directory.

By default VirtuProbe installs as one desktop application with everything it needs, and your data stays on your machine.

For systems your own machine cannot reach, the part that sends the traffic can run apart from the application. The execution server is deployed as a container image inside the environment under test, and the desktop application connects to it, so the requests originate from inside that network. You work in the same application either way.

Two external calls happen automatically:

• License validation, against license.virtuprobe.studio, only when a license key is configured. It checks your subscription status and never transmits probe content.
• Version check, against dl.virtuprobe.studio/latest-version.json, a single JSON file fetched at startup. Used to show the "new version available" notice. No telemetry.

All other network activity is initiated by you when you send a probe to a target you configure.

Write to security@virtuprobe.studio. Please include a description of the issue, steps to reproduce, and any proof-of-concept you have. We aim to respond within one business day and to ship a fix within 14 days for confirmed vulnerabilities.

We'd rather hear it from you than read about it elsewhere.

The SOCKS5 proxy binds to localhost by default and is not exposed on the network. It generates a self-signed CA certificate on first use, and you install that CA in your browser or system trust store to intercept TLS traffic. The CA private key stays on your machine and is stored in the VirtuProbe data directory.

Only route traffic through the proxy that you own or have explicit permission to intercept.