Feature Request: Advanced Traffic Manipulation, Scripting, and Android Root Support

Is your feature request related to a problem? Please describe.

Reqable is already a very powerful tool for HTTP/HTTPS traffic inspection, but advanced users currently need to rely on multiple external tools to perform common traffic-testing and debugging tasks.

For example, when testing Android applications or APIs, it would be very useful to have built-in scripting, advanced request/response modification, one-time rules, duplicate filtering, JWT utilities, hashing tools, and other utilities directly inside Reqable.

Having these capabilities integrated into Reqable would significantly reduce the need to switch between different tools and would make traffic analysis and testing much more efficient.

Describe the solution you'd like

I would like to suggest an advanced rule engine and toolbox with the following features:

1. JavaScript Request/Response Scripting

Add JavaScript support for modifying requests and responses dynamically.

Scripts could:

• Modify headers, query parameters, and request/response bodies.
• Replace values.
• Redirect requests.
• Block requests.
• Return custom responses.
• Execute conditional logic based on URL, method, headers, body, or status code.
• Apply scripts only to specific hosts, URLs, paths, or applications.

For example:

if (request.url.includes("/api/user")) {
request.headers["X-Test"] = "123";
}

2. Global Value Replacement

Add rules to replace one or multiple values automatically in matching requests and/or responses.

Support:

• Headers
• Query parameters
• JSON
• Form data
• Request bodies
• Response bodies
• Regular expressions
• Multiple replacement rules
• Request-only / response-only / both

3. "Modify on Next Match"

Allow a rule to modify only the next request/response matching a specific URL + method + path.

Possible modes:

• Next matching request
• Next N matching requests
• Every matching request
• Until manually disabled

After executing a one-time rule, it could automatically disable itself.

4. Duplicate Request Filtering

Add detection and filtering of duplicate requests based on combinations of:

• HTTP method
• URL
• Query parameters
• Headers
• Request body

Possible actions:

• Group duplicates.
• Show the duplicate count.
• Hide duplicates from the traffic list.
• Drop duplicate requests.
• Keep only the first/latest request.

For example:

POST /api/data × 15

instead of displaying 15 identical requests individually.

5. JWT Toolbox

Add built-in JWT tools for:

• Decode header and payload.
• Display claims.
• Decode timestamps/expiration.
• Edit claims.
• Re-encode JWT.
• Verify signatures when a key is provided.
• Generate JWTs using common algorithms.

6. Hash Calculator

Add a tool that accepts either text or a file path and calculates hashes.

For example:

Input: Text / File Path
Algorithm: SHA-256
Output: ...

Support common algorithms such as MD5, SHA-1, SHA-2, SHA-3, and HMAC variants.

7. QR/Barcode Generator and Decoder

Add integrated tools for:

• Generating QR codes/barcodes from text.
• Decoding QR codes/barcodes from images.
• Copying decoded data directly into the traffic/request editor.

8. Cryptography Toolbox

Add a general-purpose cryptography utility for testing and debugging common algorithms.

For example, users could provide:

Input
Key
IV / Nonce
Algorithm
Mode
Padding
Operation: Encrypt / Decrypt

Support common algorithms and encodings such as AES, RSA, ChaCha20, HMAC, Base64, Hex, etc.

It would also be useful to allow custom parameters so developers can reproduce an application's cryptographic transformation during testing.

9. Advanced Android Root Capture

For rooted Android devices, provide an optional root-based traffic capture mode.

This could provide deeper traffic visibility and control than the standard VPN-based capture approach and potentially improve compatibility with applications using unusual networking implementations.

10. HTTP/2 and HTTP/3 Advanced Android Integration

An optional native Android helper could provide deeper integration with HTTP/2 and HTTP/3/QUIC traffic on rooted devices.

A possible architecture would be:

Reqable UI
↓
Rule / Script Engine
↓
Native Android Helper
↓
HTTP/1.1 / HTTP/2 / HTTP/3

The root/native component could remain optional so normal users would not need it.

Describe alternatives you've considered

Currently, many of these tasks require using several different tools together, such as:

• Proxy tools for traffic interception.
• Custom scripts for request/response modification.
• Separate JWT decoders.
• Separate hashing utilities.
• Separate QR/barcode tools.
• Custom Android instrumentation for deeper traffic interception.

Reqable already provides the traffic inspection foundation, so integrating these capabilities into one unified rule engine and toolbox would provide a much smoother workflow.

Additional context

I think these features could be implemented progressively rather than all at once.

The highest-priority features, in my opinion, would be:

1. JavaScript request/response scripting
2. Global value replacement
3. One-time/"Modify on Next Match" rules
4. Duplicate request filtering
5. JWT toolbox
6. Hash calculator
7. QR/barcode tools
8. Cryptography toolbox
9. Root-based Android capture
10. Advanced HTTP/2/HTTP/3 Android integration

A unified rule system would make these features especially powerful by allowing conditions such as:

IF
Host = example.com
AND
Path starts with /api/

THEN
Modify request
Replace value
Redirect
OR Block

Rules could also have priorities, enable/disable controls, execution counters, and one-time execution modes.

Thank you for considering these suggestions. Reqable is already an excellent traffic analysis tool, and I believe these additions could make it even more useful for API testing, Android development, debugging, and security research.