Opportunities › Web application security testing tools › Proposed app
Fieldprobe
Replay requests, catch callbacks, and write up web security findings as a team
- Score
- 63
- confidence 45
- Evidence
- 3
- items on the page
- Rivals
- 2
- named in sources
- First version
- 35 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2003
- Mature market · AI estimate
ScreensConcept
Desktop app: Security testing involves dense dashboards, detailed request editing, payload configuration, and collaborative analysis—work that requires sustained desk time and complex interaction patterns. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Replay
Replayed200 vs 403
About this appAI proposal
Fieldprobe is a shared workbench for web application security testing. Import traffic captured by the intercepting proxy you already use, then replay and edit requests, run payload lists against a parameter, and keep every result where your team can open it in a browser.
It also gives you hosted out-of-band callback addresses, so you can see when a blind injection or server-side request fires, and a findings notebook that turns evidence into a clean report. It does not replace your proxy. It handles the parts that are awkward to share across a team: history, callbacks, and write-ups.
Built for pen testers, bug bounty hunters, and developers who test before release and want their history and reports in one shared place instead of scattered desktop files. Use it only against targets you are authorised to test.
- Tagline
- One place for requests, callbacks, and the report.
- Voice
- precisecalmdirect
- Why this name
- A probe is sent into a field to find out what is there; the name reads plainly and has no tie to any existing tool or brand.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Import captured traffic
Load HAR files and proxy exports, group them by host and flow, and search headers, bodies, and parameters.
No member yet
Request replay and editing
Edit any request, send it again, and compare two responses side by side: status, headers, and body.
No member yet
Payload runs
Mark a parameter, pick a payload list, set a rate limit, and sort results by length, status, or matched text.
No member yet
Hosted callback addresses
Generate unique addresses for blind testing and see each DNS or HTTP hit with time, source, and the request behind it.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#14181BField Black · text#F6F7F5Probe White · surface#1F7A5CSignal Green · primary#C97A2BAlert Amber · accent#2E5C8ATrace Blue · data
Typography
Aa
Fieldprobe
ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
One place for requests, callbacks, and the report.
PricingAI proposal
The material gives no competitor prices, only that Burp Suite and similar tools are commercial and proprietary; these tiers are a starting point to test, with the core kept free and open source.
Community
Free
- Self-hosted, open source
- Request replay and editing
- Payload runs with your own lists
- Scope guard
Hosted Team
$29 a month
- Hosted callback addresses
- Shared project history
- Findings notebook and report export
- Email support
Agency
$99 a month
- Everything in Hosted Team
- Multiple client workspaces
- Branded report export
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Shared report links and the public GitHub project are the two visible surfaces: a report link opened by a client exposes the brand, and the open-source repo draws developers who then try the hosted tiers.
- Do they become customers?
- Report viewers mostly only see the brand once; the open-source repo is the stronger acquisition path, pulling in security practitioners who need the hosted callback and team features. Needs testing which converts better.
- First customers
- Independent bug bounty hunters and small penetration testing teams of 2-5 people who currently juggle a proxy tool, a separate callback service, and manual report writing.
- Where to reach them
- Open-source release on GitHub: Publish the self-hosted core with clear setup docs and a visible roadmap, inviting issues and contributions from the security community.
- Bug bounty community forums and…: Share the callback and reporting workflow directly where bounty hunters already discuss tooling and compare notes.
- Security conference and meetup talks: Short demos of the replay-to-report flow at local OWASP chapter meetups and similar practitioner gatherings.
- First milestone
- Ten paying hosted-tier accounts from independent testers or small teams within the first three months of the open-source release.
Why people already pay for this
- VerifiedGitHub repository gained 346 stars in 3 days
- Public claimOpen-source alternative to Burp Suite with professional security testing capabilities
- Public claimSupports multiple professional security testing workflows
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Callback infrastructureDedicated DNS zone and wildcard subdomain hostHosted out-of-band callbacks need a domain that can receive arbitrary DNS and HTTP traffic and route hits back to the right project.
- This app · Job runnerBackground worker (e.g. Supabase Edge Functions or a small…
RisksAI inference
- TechnicalRunning payload sweeps and hosted callbacks at any real volume needs careful rate limiting and abuse controls, which is more infrastructure than a typical PWA.
- CommercialA free, open core next to an established market leader may pull users who never upgrade to the hosted tiers that fund the project.
- RegulatoryHosting out-of-band callback infrastructure and payload runs against third-party hosts can be used to attack systems without authorisation if scope checks are weak.
- PlatformBrowser-based request replay cannot fully match a native proxy's control over raw sockets and TLS, limiting some edge-case testing.
- AINone of the core workflow depends on AI; if an AI-assisted triage feature is added later, its suggestions must be clearly marked as unverified.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.