Crossfyre Workbench

An intercepting proxy that keeps the work on your machine.

A Linux desktop app for testing a web application by hand. It runs a proxy on your own machine, writes what it captures to a project on your disk, and gives you the tools to read it, change it and send it again: Proxy, Target, Repeater, Decoder, Comparer, Replay and Findings.

Download 0.1.0

Download

Version 0.1.0, published 13 October 2026. Linux on x86-64.

Debian package crossfyre-workbench-v0.1.0-linux-x86_64.deb8.4 MB
Download

SHA-256 21fe72857cb89e73b92dae8092342a86cbb883e9876e01953370f48263a85e25
Tarball, for packagers crossfyre-workbench-v0.1.0-linux-x86_64.tar.gz8.2 MB
Download

SHA-256 18a7de0fc2990cacd158ef4ac9228ff764886fe47095cb4f5ce4f50f1df59d1b

Install the .deb with apt rather than dpkg, so the libraries it needs come with it:

curl -fsSLO https://bins.crossfyre.io/workbench/v0.1.0/crossfyre-workbench-v0.1.0-linux-x86_64.deb
curl -fsSLO https://bins.crossfyre.io/workbench/v0.1.0/SHA256SUMS
grep -F '  crossfyre-workbench-v0.1.0-linux-x86_64.deb' SHA256SUMS | sha256sum -c - && sudo apt install ./crossfyre-workbench-v0.1.0-linux-x86_64.deb

The tarball holds the binary, a .desktop file, an icon, LICENSE.txt and THIRD-PARTY-NOTICES, for packagers who place the files themselves. It needs the same libraries as the .deb.

Installing or running the Workbench means accepting its licence. Read it before you install: Crossfyre Workbench licence. Use it only against systems you own or are authorized to test (acceptable use policy).

This page shows these SHA-256 sums only after checking the release manifest's signature against the Crossfyre release key.

Check the signature yourself

curl -fsSLO https://bins.crossfyre.io/workbench/manifest.json
curl -fsSLO https://bins.crossfyre.io/workbench/manifest.json.sig
printf -- '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA%s\n-----END PUBLIC KEY-----\n' 'kbMTWSxOuXPz8Wu8MMf552R66V5GivbTChZeyyoT3Sk=' > crossfyre-release.pem
base64 -d manifest.json.sig > manifest.json.sig.raw
openssl pkeyutl -verify -pubin -inkey crossfyre-release.pem -rawin -in manifest.json -sigfile manifest.json.sig.raw

OpenSSL 3.0 or later prints Signature Verified Successfully. Each file's sha256 in manifest.json is the one SHA256SUMS lists and the one shown above.

Replay a request as somebody else

What an endpoint does for somebody else is the question a proxy cannot answer by watching. Write down the headers each of your test identities sends, pick a request, and the Workbench sends it once as each of them and once as nobody, the way the Repeater sends, and lays the answers side by side.

There is no score and no verdict: each row is a status, a length, a time and the bytes, with a mark where a response body is byte for byte the anonymous one's. A request that is not a read is refused once before it goes out as everyone, because one of the identities usually owns the thing it would change. Replay comes with a paid plan, with scope and findings.

Free, and what a paid plan adds

Free, with no account

A proxy with its own certificate authority, and a browser launched already set up for it
History, a viewer and search over a project on your disk
Intercept: hold, edit, forward or drop
Repeater, byte for byte, with the request as fields beside the bytes
Decoder and Comparer
Target: the site as a map of hosts, paths and methods
Render: a response drawn as a page, with no script run
A cross-site request forgery proof of concept, where one is possible
An upstream proxy, and a client certificate per project
Copy as curl

With a paid Crossfyre plan

Scope: refuse any destination you have not written down, before anything is dialled
Replay as another user: one request as each identity, and as nobody
Findings and a report: what is wrong, the requests that prove it, and how to fix it, in one document

Every paid Crossfyre plan includes them: Pro, Reaper, Syndicate and Enterprise. Sign in from the Workbench with your Crossfyre account, on as many machines as you use. A scope you wrote while paying is still enforced if the plan lapses; what goes is the ability to change it.

Plans and prices

The first start

On its first start the Workbench makes its own certificate authority and keeps it in ~/.local/share/io.crossfyre.workbench/ca, beside your projects, and reuses it on every start, so you trust it once.

The browser it opens for you runs in a throwaway profile: Firefox gets the certificate in that profile's own store, using certutil from libnss3-tools, which the .deb recommends, and a Chromium-based browser runs with certificate checking switched off in that profile instead, which the window tells you. Your own browser profile and your system's trust store are left alone. To point another client at the proxy, trust ca.pem there yourself; the window shows where it is.

What it sends

Projects, captured traffic and the certificate authority stay on your machine, and the Workbench does not upload them. It makes two checks of its own: when it starts, if you are signed in, it asks crossfyre.io what your plan includes, and at most once a day it reads the signed list of published versions from bins.crossfyre.io so that it can tell you when a newer one is out.

Both can be switched off in its Account panel, and then it connects only when you sign in or ask it to. Signed in, it keeps a signed statement of your plan on your machine for up to 30 days, or 60 for a perpetual licence, so the paid features keep working with no network.

Updates

When a newer version is published, the Workbench says so in its Account panel. It never downloads or installs anything itself. To update, download the new .deb here and install it with apt the same way; your projects and the certificate stay where they are.

Requirements

Linux on x86-64, with glibc 2.34 or later.
WebKitGTK 4.1 at 2.41.90 or later, GTK 3 and libsoup 3. apt installs them with the .deb.
Tested on Debian 12, Ubuntu 22.04 and Kali Linux. On Ubuntu 22.04, the jammy-updates pocket, which is on by default, has a recent enough WebKitGTK.

Not yet

HTTP/1.1 only: a target that would speak HTTP/2 to your browser speaks 1.1 through the proxy, and WebSockets are not carried.
No macOS or Windows build. macOS comes once it can be notarised.
No 64-bit ARM build.
No Intruder-style fuzzer, crawler or match and replace.