VirtuProbe Studio is a multi-protocol test automation platform for engineers and security professionals. It covers sixteen protocols from one interface: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB, Kerberos, STOMP, FTP and Freestyle, plus the databases MySQL/MariaDB, PostgreSQL, SQL Server, MongoDB and Redis, chain them into one test, group those tests into suites, and script them with JavaScript.

The idea behind it is that your integrations do not stop at HTTP, so the tool you test them with should not either.

Two main audiences:

• Integration engineers, building or testing systems that talk SMTP, LDAP, DNS, or similar. VirtuProbe replaces ad-hoc tooling and telnet sessions with a structured, repeatable interface.
• Security professionals, penetration testers and bug bounty hunters who need raw access to the protocols themselves, the ability to send malformed packets (fuzzing), and a MITM proxy that gives you full protocol visibility.

If a single-purpose HTTP proxy is your daily driver and you keep reaching for other tools the moment something isn't HTTP, VirtuProbe is the side door you were missing.

Most request tools stop at HTTP. VirtuProbe covers sixteen protocols in a single interface. The other key differences:

• Custom protocol stacks, hand-written against the RFCs rather than wrapping a library. This means you can send malformed packets, arbitrary commands, and raw payloads that a standard library would silently sanitise.
• Cross-protocol chaining: a single chain can send an HTTP probe, extract a token, use it in an LDAP bind, then check the result with a DNS lookup.
• Fuzzing: mark any field with §payload§ and run a wordlist against it. Works across all protocols.
• MITM proxy: intercept and replay raw traffic, well beyond HTTP.

No. VirtuProbe is a desktop application that runs entirely on your machine. The execution server can also be deployed inside a target network (or a Docker container) for probes that need to fire from within the perimeter, but there is no VirtuProbe cloud service that handles your requests.

Your probes and data never leave your machine unless you point a probe at an external target yourself.

Yes. Pre-built installers are available for:

• macOS: Apple Silicon (ARM) and Intel (x64), distributed as a .dmg
• Windows: x64, distributed as an .exe installer
• Linux: x64, distributed as an AppImage

The application bundles its own Java runtime, so there is nothing to install alongside it.

VirtuProbe currently supports sixteen protocols. Most have hand-written client stacks built directly against the RFCs; MySQL, MongoDB, PostgreSQL and SQL Server are library-backed (a database wants a driver, not raw packet control); and Freestyle is the one you write yourself, a raw TCP or UDP exchange sent exactly as you typed it:

• HTTP/HTTPS: arbitrary methods, raw headers, body, cookies, redirects, TLS; GraphQL and MCP request modes
• SMTP: full command sequence, STARTTLS, AUTH, DATA, fuzzing per-command; Action Mode "send email"
• IMAP: login, list, select, fetch, search, STARTTLS; Action Mode "find message"
• LDAP: bind, search, compare, add, modify, delete; custom filters; Action Mode "check login / find entry"
• DNS: A, AAAA, MX, TXT, CNAME, SRV, PTR; UDP and TCP; custom resolvers
• SpamAssassin: SPAMC/SPAMD protocol for message scoring and analysis
• SMB: file operations, share enumeration, ACL reads; NTLM auth and pass-the-hash (Security tier)
• Kerberos: AS-REQ credential validation, AS-REP Roasting, Kerberoasting (Security tier)
• STOMP: connect, subscribe, send and read frames against a message broker (Engineering tier)
• MySQL / MariaDB: run SQL, extract column values, chain the result into assertions (Engineering tier)
• MongoDB: find/insert/update/aggregate and more, form or full shell query, extract document fields (Engineering tier)
• PostgreSQL: run SQL, extract column values, chain the result into assertions (Engineering tier)
• Redis: an ordered command sequence, read or write a key, INFO, SCAN; extract a reply or one INFO field (Engineering tier)
• SQL Server: run a T-SQL batch or call a stored procedure, extract result sets, server messages and OUT parameters (Engineering tier)
• FTP: list a directory, download or upload a file, or drive the control connection command by command (Engineering tier)
• Freestyle: your own raw exchange over TCP or UDP, written as text, hex or base64, with a read rule per step (Security tier)

A MITM proxy is included as well, a SOCKS5 tunnel that can also rewrite and mock what passes through it.

Standard libraries "help" by fixing things. They normalise headers, reject invalid method names, refuse to send malformed packets. That is exactly what you don't want when you're testing protocol edge cases or fuzzing.

VirtuProbe's stacks are written directly against the RFCs. This means you can send whatever bytes you want, including things that should fail, which is the point when you're finding bugs or testing server resilience. Freestyle carries the same idea to its end: there is no stack in the way at all, you write the exchange and it goes out byte for byte.

Yes, and it's the core value of chains. A chain is a sequence of steps that can mix protocols freely. A typical example: send an HTTP login request, extract the session token from the JSON response, then use it in an LDAP search. Each step's output feeds the next via variable extraction.

Every protocol is a chain step: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB, Kerberos, MySQL, MongoDB, PostgreSQL, SQL Server, Redis, FTP and Freestyle, alongside the control flow steps (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF).

SMB is a full protocol here: a probe, a chain step, and entries in the library. It covers file read/write/delete/rename, directory listing and creation, share enumeration, ACL reads and writes, and a recon slice over MSRPC named pipes (LSA policy, SAMR user and group enumeration, RID cycling, NetServer/NetShare/NetSession, workstation sessions).

Authentication is NTLM, pass-the-hash, or a null session, with SMB3 signing and encryption available. In a chain, SMB_SUCCESS, SMB_LAST_STATUS, SMB_SHARE_LIST, SMB_FILE_CONTENT, SMB_FILE_MATCHES, SMB_RPC_LINES and LSA_DOMAIN_SID pass values to the next step, and a share list feeds an ITERATE step directly.

SMB needs the Security tier.

A chain is a named sequence of steps. Each step can be a protocol probe or a control-flow instruction. Steps share a variable context: an earlier step can extract a value (e.g. HTTP_JSON_PATH $.token) and later steps reference it with {{token}}.

Control-flow step types:

• ITERATE: runs child steps once per item in a list; last iteration's variables bubble up
• CONDITION: evaluates a JavaScript expression; skips children if false
• PARALLEL: forks child steps into concurrent workers, merges results
• ASSERT: fails the chain if a variable doesn't match an expected value or pattern
• CHAIN_REF: calls another chain as a sub-routine, passing and receiving variables

Extractors pull values from step responses and store them as chain variables. Every protocol brings its own set; these are the ones you will reach for most:

• HTTP_STATUS: HTTP response status code
• HTTP_JSON_PATH: JSONPath expression against the response body
• HTTP_BODY_RAW: entire response body as a string
• HTTP_HEADER: a specific response header value (case-insensitive)
• LDAP_SUCCESS: whether the LDAP operation succeeded
• LDAP_EXCHANGE_RESULT_CODE: result code for a specific LDAP operation
• DNS_SUCCESS: whether the DNS query resolved
• DNS_ANSWER_VALUE: the first answer record's value
• REGEX: arbitrary regular expression against any text
• CONSTANT: a literal value (useful for seeding variables)

A script runs in JavaScript on GraalJS. The JavaScript engine is sandboxed: it reaches only the API we hand it, with no filesystem access. They have access to a vp binding that exposes the VirtuProbe API. You can send probes programmatically and process their responses:

def result = vp.send("My Bundle", "Login probe", [username: "alice"])
println result.extract("HTTP_JSON_PATH", "$.token")

Use println. Output captured through the out binding appears in the UI. System.out.println is not captured.

A script lives in a bundle, like everything else you author, and runs against the environment of the project you are working in.

Fuzzing lets you run a probe repeatedly, substituting different payloads into marked fields on each run. Mark a field with §payload§ (section-sign markers) and supply a payload list, and VirtuProbe substitutes the payload and collects the results.

Works in any probe field across any protocol. Results are not saved to history; they appear in the fuzz results panel only. Fuzzing needs the Security tier.

Each Project can have multiple named environments (e.g. "Dev", "Staging", "Prod"). Each environment is a key-value map. Switching the active environment instantly changes which values are injected into probe fields and chains that reference {{varName}}.

Variable priority: values set during chain execution override environment variables (chain wins on collision). Probe inline variables override environment variables too.

The free tier gives you a fully working workbench with no time limit, and a lot of things other tools charge for:

• HTTP, DNS, and SMTP probes + chaining (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF)
• Unlimited probes, bundles & chains
• AI assistant: bring your own key, and we never charge for tokens
• API auth: OAuth2 (every flow), Basic, Bearer, API key, Digest
• GraphQL requests
• Import OpenAPI / Postman / Bruno / HAR / Insomnia / cURL
• Directory-backed GIT workspaces
• Run history, diff & JSON evidence export
• Community library access (71 probes across protocols)

It needs no account and no cloud, and it is permanently free.

Engineering tier is for shipping and debugging integrations:

• Stateful protocols: IMAP, LDAP
• Database probes: MySQL / MariaDB, MongoDB, PostgreSQL, SQL Server and Redis, run a query or command and assert on what comes back
• FTP: list and transfer files, or drive the control connection command by command
• SpamAssassin message scoring
• JavaScript scripting (with a real code editor, autocomplete and linting)
• MITM proxy & interception (TLS termination), and MCP interception of an agent's tool traffic
• Service virtualization: mock rules in the proxy, so you can answer for a dependency that is down or does not exist yet
• MCP server testing, test suites with a JUnit report, and skills an agent can call
• Out-of-band callback detection over HTTP, DNS and SMTP
• Enterprise & Windows auth: NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4
• Library: generic APIs, integrations, cloud SDKs, and the infrastructure collection (Kubernetes, Docker, Vault, Prometheus, Elasticsearch)

Security tier is aimed at penetration testers and security researchers. It inherits everything in Engineering, including the MITM proxy and the service-virtualization mocks, and adds the offensive kit:

• Fuzzing: §payload§ markers in any probe field, plus raw byte-for-byte requests and request-smuggling detection
• SMB probe: file ops, share enum, ACL, NTLM, pass-the-hash
• Kerberos probe: AS-REP Roasting, Kerberoasting
• Freestyle: your own raw TCP or UDP exchange, sent byte for byte
• Full pentest library (HTTP, SMTP, IMAP, DNS, Active Directory, Kerberos, SMB, WordPress, MongoDB and API security, around 700 probes)

Yes. The Academic License gives verified students and academics full Security tier access at no cost. It's available to:

• Students currently enrolled in a degree programme (any field)
• Researchers and faculty: PhD candidates, postdocs, lecturers, professors
• Instructors licensing for a course, and university security/CS societies or CTF teams

Apply for the Academic License →

When you subscribe via Paddle, you receive an access key (UUID). Enter your email and that key in the License panel inside VirtuProbe Studio. The app validates against the license server and caches your tier locally, then re-validates every 12 hours in the background.

Your license is tied to the email you used at checkout, and it activates on up to three of your own devices. The app re-checks every 12 hours and the cached licence is good for 48, and a check that cannot reach the server keeps your tier rather than dropping it, so losing the connection does not interrupt your work.

Yes. One license covers one person on up to three devices: laptop, desktop, a VM, whatever you work on. To cover more people, each person needs their own license; for teams and organisations, reach out, because team and Enterprise arrangements are handled on request.

No. The installer bundles a complete JVM (Temurin 21). You do not need to install Java, and the bundled JVM does not conflict with any existing Java installation on your system.

macOS builds are signed with an Apple Developer ID and notarized by Apple, so they open with no Gatekeeper warning. For other platforms, every download carries a published SHA-256 checksum.

Verify that checksum before opening. If anything looks off, write to [email protected].

To proceed on Windows: click More info, then Run anyway. You will not see the warning again after installing.

VirtuProbe stores probes, bundles, chains, scripts, and settings in a platform-appropriate directory:

• Windows: %APPDATA%\VirtuProbe
• macOS: ~/Library/Application Support/VirtuProbe Studio
• Linux: ~/.local/share/virtuprobe

Everything is stored locally in an embedded database, with no cloud sync. To back up your data, copy that directory.

By default VirtuProbe installs as one desktop application with everything it needs, and your data stays on your machine.

For systems your own machine cannot reach, the part that sends the traffic can run apart from the application. The execution server is deployed as a container image inside the environment under test, and the desktop application connects to it, so the requests originate from inside that network. You work in the same application either way.

Two external calls happen automatically:

• License validation, against license.virtuprobe.studio, only when a license key is configured. It checks your subscription status and never transmits probe content.
• Version check, against dl.virtuprobe.studio/latest-version.json, a single JSON file fetched at startup. Used to show the "new version available" notice. No telemetry.

All other network activity is initiated by you when you send a probe to a target you configure.

Write to [email protected]. Please include a description of the issue, steps to reproduce, and any proof-of-concept you have. We aim to respond within one business day and to ship a fix within 14 days for confirmed vulnerabilities.

We'd rather hear it from you than read about it elsewhere.

The SOCKS5 proxy binds to localhost by default and is not exposed on the network. It generates a self-signed CA certificate on first use, and you install that CA in your browser or system trust store to intercept TLS traffic. The CA private key stays on your machine and is stored in the VirtuProbe data directory.

Only route traffic through the proxy that you own or have explicit permission to intercept.