Exodus - a Web Application Review tool for Java

Exodus is no longer under development

Exodus is deprecated! Please use WebScarab rather than Exodus. Thanks! ;-)

For those of you who have been using Exodus because of its (inferior) fuzzing support, PLEASE try the new releases of WebScarab. Fuzzing support has been added to WebScarab, and it is a LOT more powerful and flexible than Exodus


Exodus is derived from a number of sources. The original inspiration came from httpush, by Lluis Mora Hidalgo, which offered the ability to intercept HTTP and HTTPS connections, display the requests, and modify them on the fly.

I felt that the HTML interface to the proxy was a bad choice, since the site I was testing used forms in non-resizable frames, and I couldn't get to the Submit button to tell httpush to continue!

As a result of my frustration, I changed httpush quite radically, creating "mangle.pl" so that it would save the conversations, and implemented a Perl/Gtk interface to review the information seen. I ended up writing a number of tools, that followed the Unix philosophy of "one tool to do a simple thing well". Unfortunately, none of them really did their jobs well, and they didn't integrate well, either.

Mangle was also not very portable, using the Perl Crypt::SSLeay and Net::SSLeay bindings to OpenSSL, which I had difficulty compiling on Win32, and needing a bunch of modules from CPAN, and other places. It was a real disaster trying to install it on another machine, even for me as the creator. I eventually decided to re-implement it in Java.

Exodus is the Java version of mangle.


Exodus has been successfully tested on : using Sun's 1.4.x series of JRE


Exodus is merging with the OWASP project's WebScarab to produce a best-of-breed web application security audit tool. As a result, development on Exodus itself has halted while WebScarab is designed, and brought up to the level of Exodus (in terms of features, not code quality! :-) All development is happening in WebScarab now.


Exodus has the following features:


Take a look at the following screenshots to get an idea of how Exodus works:


Exodus is © 2003 by Rogan Dawes <rogan@dawes.za.net>