Stepper

Stepper chains multi-step HTTP request sequences with automatic variable extraction, session management, and conditional logic. Define a login or token-refresh flow once, extract values from responses with regular expressions, and have the sequence replay transparently whenever Repeater, Intruder, or Scanner needs a fresh session. It can replace the combination of session handling rules and macros for many workflows.

Features

• Build ordered sequences of requests, extract values from each response, and reuse them in later steps with the $VAR:name$ syntax.
• Reference a published variable from Repeater, Intruder, or Scanner with $VAR:Sequence:name$ and have its sequence run automatically, keeping sessions valid during scans without manual intervention.
• Keep published variables current as tokens refresh through normal browsing, so the latest value is reused without re-running the sequence.
• Drive each step with conditions based on the status line or response body, including match and not-match modes, retry, and actions to continue, skip remaining steps, or jump to a named step.
• Validate sessions before running a full login flow, and confirm session recovery afterwards, with an alert and pause when recovery repeatedly fails.
• Define static global variables ($GVAR:name$) for credentials and constants, and dynamic global variables ($DVAR:name$) that update automatically from responses across all tools.
• Run sequences reliably during concurrent scans, with the option to make other requests wait for an in-progress sequence so they receive freshly updated values.
• Protect against data loss with scheduled backups of all sequences, variables, and settings, restorable through import and export.
• Generate regex from highlighted response text, preview all variable replacements before sending, and review every step at a glance in the sequence overview.

Usage

1. Create a sequence from the tree toolbar, then add steps directly or by sending a request from another tool to the Stepper sequence.
2. For each step, define a post-execution variable with a regex (for example "token":"(.*?)" with the identifier jwt), or highlight text in a response and use Auto Regex.
3. Reference extracted values in later steps with $VAR:jwt$; they are substituted at execution time.
4. Run the whole sequence, or run only through a chosen step for a partial execution.
5. To replace session handling, publish a variable and reference it as $VAR:Sequence:jwt$ from Repeater, Intruder, or Scanner; optionally mark a step as the pre-validation step so a valid session skips the rest of the flow.
6. When a session handling rule injects a reference and its scope includes Extensions, add the "Variable Replacement for Extensions" session handling action after the injecting action so the reference resolves correctly.