## File: README.md

# Tamper Dev

Tamper Dev is an extension that allows you to intercept and edit HTTP/HTTPS requests and responses as they happen without the need of a proxy.

> Tamper Chrome was version 1, which uses a deprecated API, and will stop working at some point.\
> **Users should migrate to Tamper Dev (v2).** Visit https://tamper.dev to update.

---

## File: v1/README.md

[Tamper Chrome](https://chrome.google.com/webstore/detail/tamper-chrome-extension/hifhgpdkfodlpnlmlnmhchnkepplebkb) is a Chrome extension that allows you to modify HTTP requests on the fly and aid on web security testing. Tamper Chrome works across all operating systems (including Chrome OS).

# How To Install *Tamper Chrome*

***Tamper Chrome* has two components that need to be installed:** 
1. **First Install the [*Tamper Chrome* Extension](https://chrome.google.com/webstore/detail/tamper-chrome-extension/hifhgpdkfodlpnlmlnmhchnkepplebkb?hl=en)**
2. **Then Install the [*Tamper Chrome* Application](https://chrome.google.com/webstore/detail/tamper-chrome-application/odldmflbckacdofpepkdkmkccgdfaemb)**
3. **Restart your browser.**

# Want to know how to use *Tamper Chrome*?

If you have any more questions feel free to post [to the group](https://groups.google.com/forum/#!forum/tamper-chrome-help).

## How to open *Tamper Chrome*?
1.  **First of all, you need to open Google Chrome DevTools.**

    To do that, open the Chrome menu  at the top-right of your browser window, then select More Tools > Developer Tools.

    

    You can find more help [here](https://developers.google.com/web/tools/chrome-devtools/iterate/inspect-styles/shortcuts?hl=en#accessing-devtools).

    Make sure to close and re-open every Dev Tools after installing *Tamper Chrome*.

1.  **After that, you will find a new tab called "Tamper" at the top-right side, and click on it.**

    


## How to use *Tamper Chrome*?



*Tamper Chrome* has 6 different tools which do slightly different things as described below. You have to individually activate each tool.

To do so, simply click on the checkbox next to the tool's name, and this will mark the tool as active.





In the following section we explain how to use each tool.

### Block / Reroute Requests

This tool allows you to either **block** or **redirect** a request from the browser, for example, if a website is requesting a minified version of jQuery, you can redirect it to the unminified version of jQuery.

You can do that by simply changing the URL and clicking *Allow*.



You can also click on *Edit javascript* and *Edit stylesheets*, which will allow you to modify the javascript and CSS code itself.

**Note** that by clicking *ignore requests*, you will let all requests pass through.

### Request Headers

While Block / Reroute requests is useful to tamper with a website, and cancel some requests, in many cases you might want to modify HTTP request headers.

This tool will allow you to do just that.



You can drop a header by clicking on the *Trash* icon, or copy its value by clicking on the *Copy* icon. You can add a new header by clicking on the [ *new* ] button.

### Response Headers

The response headers work exactly the same as the request headers. It allows you to drop, modify or add new headers.



Very useful for dropping or modifying many security headers like Content-Security-Policy, X-Frame-Options, X-XSS-Protection, etcetera.

### Monitor PostMessages

Unlike the other tools, this tool is mostly only useful for monitoring websites that use the HTML5 postMessage API.

When activated, it does the following:
-  It logs every message received on all iframes in the current tab. 
-  It sets a breakpoint on every handler that listens to postMessage. 


### Monitor Reflected XSS

Another very cool feature of *Tamper Chrome* is that it allows you to debug XSS vulnerabilities a bit better.

When testing for XSS, you can use `<tc-xss>` as an HTML element, and *Tamper Chrome* will automatically detect it, and show you where it is and the stack trace from where it was generated. Particularly useful for DOM XSS.

Note that you can also use `<tamperchrome>` and `<tcxss>`, which also work as an attribute, and as a javascript variable.

To trigger it, just use as your XSS payload `tamperchrome` as an attribute, tagname or javascript variable.



### Replay Requests (Experimental)

The last tool in *Tamper Chrome* is to replay and modify requests. This is particularly useful because it allows you to modify POST requests including their body (or make POST requests into GET requests), that otherwise would be difficult or impossible.



# NOTE

This is not an official Google product.

---

## File: v2/ui/README.md

# Ui

This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 7.3.4.

## Development server

Run `ng serve` for a dev server. Navigate to `http://localhost:4200/`. The app will automatically reload if you change any of the source files.

## Code scaffolding

Run `ng generate component component-name` to generate a new component. You can also use `ng generate directive|pipe|service|class|guard|interface|enum|module`.

## Build

Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory. Use the `--prod` flag for a production build.

## Running unit tests

Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.io).

## Running end-to-end tests

Run `ng e2e` to execute the end-to-end tests via [Protractor](http://www.protractortest.org/).

## Further help

To get more help on the Angular CLI use `ng help` or go check out the [Angular CLI README](https://github.com/angular/angular-cli/blob/master/README.md).