Frequently asked questions.

VirtuProbe Studio is a multi-protocol test automation workbench for engineers and security professionals. It covers sixteen protocols from one interface: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB, Kerberos, Redis, STOMP / ActiveMQ, FTP and Freestyle, plus the databases MySQL/MariaDB, PostgreSQL, SQL Server and MongoDB. You can chain probes on any of them into one test and group those tests into suites.

Two main audiences:

• Integration engineers, building or testing systems that talk SMTP, LDAP, DNS or similar. VirtuProbe replaces ad-hoc tooling and telnet sessions with a structured, repeatable interface.
• Security professionals, penetration testers and bug bounty hunters who need raw access to the protocols themselves, fuzzing with malformed packets and a MITM proxy that decodes more than HTTP.

Most request tools stop at HTTP. VirtuProbe covers sixteen protocols in one interface and adds:

• Custom protocol stacks: eleven of the sixteen are hand-written against the RFCs rather than wrapping a library, so you can send malformed packets, arbitrary commands and raw payloads that a standard library would silently sanitize.
• Cross-protocol chaining: a single chain can send an HTTP probe, extract a token, use it in an LDAP bind and assert on the result.
• Fuzzing: mark any field with §payload§ and run a payload list against it, on any protocol.
• MITM proxy: intercept and decode traffic in thirteen protocols, then turn a captured exchange into a probe.

No. VirtuProbe is a desktop application that runs on your machine. There is no VirtuProbe cloud service that handles your requests.

For probes that have to start inside a target network, an Enterprise license lets you deploy an execution server there as a Docker image and connect the desktop application to it. Either way, your probes and data stay on machines you run, apart from what you send to a target yourself.

Yes. Pre-built installers are available for:

• macOS: Apple Silicon (ARM) and Intel (x64), distributed as a .dmg
• Windows: x64, distributed as an .exe installer
• Linux: x64, distributed as an AppImage

The application bundles its own Java runtime, so there is nothing to install alongside it.

VirtuProbe currently supports sixteen protocols. Most have hand-written client stacks built directly against the RFCs; MySQL, MongoDB, PostgreSQL and SQL Server are library-backed; Freestyle is the one you write yourself, a raw TCP or UDP exchange sent exactly as you typed it. What each protocol covers, with its tier where it needs one:

• HTTP/HTTPS: arbitrary methods, raw headers, body, cookies, redirects, TLS; GraphQL request mode; MCP request mode on the Engineering tier
• SMTP: full command sequence, STARTTLS, AUTH, DATA, fuzzing per-command on the Security tier; Action Mode "send email"
• IMAP: login, list, select, fetch, search, STARTTLS; Action Mode "find message" (Engineering tier)
• LDAP: bind, search, compare, add, modify, delete; custom filters; Action Mode "check login / find entry" (Engineering tier)
• DNS: A, AAAA, MX, TXT, CNAME, SRV, PTR; UDP and TCP; custom resolvers
• SpamAssassin: SPAMC/SPAMD protocol for message scoring and analysis (Engineering tier)
• SMB: file operations, share enumeration, ACL reads and writes, with NTLM and pass-the-hash logins (Security tier)
• Kerberos: AS-REQ credential validation, AS-REP Roasting, Kerberoasting (Security tier)
• STOMP / ActiveMQ: connect, subscribe, send and read frames against a message broker (Engineering tier)
• MySQL / MariaDB: run SQL, extract column values, chain the result into assertions (Engineering tier)
• MongoDB: find/insert/update/aggregate and more, form or full shell query, extract document fields (Engineering tier)
• PostgreSQL: run SQL, extract column values, chain the result into assertions (Engineering tier)
• Redis: an ordered command sequence, read or write a key, INFO, SCAN; extract a reply or one INFO field (Engineering tier)
• SQL Server: run a T-SQL batch or call a stored procedure, extract result sets, server messages and OUT parameters (Engineering tier)
• FTP: list a directory and download or upload a file, or drive the control connection command by command (Engineering tier)
• Freestyle: your own raw exchange over TCP or UDP, written as text, hex or base64, with a read rule per exchange (Security tier)

A MITM proxy is included as well (Engineering tier): a SOCKS5 tunnel that can also rewrite and mock what passes through it.

Standard libraries "help" by fixing things. They normalize headers, reject invalid method names, refuse to send malformed packets. That is exactly what you don't want when you're testing protocol edge cases or fuzzing.

VirtuProbe's own stacks are written directly against the RFCs, so you can send whatever bytes you want, including things that should fail, which is the point when you're finding bugs or testing server resilience. Freestyle carries the same idea to its end: there is no stack in the way at all, you write the exchange and it goes out byte for byte.

Yes, with a chain: a sequence of steps that can mix protocols freely. A typical example: place an order over HTTP, extract the order number from the JSON response, then search the mailbox over IMAP for the confirmation email carrying that number. Each step's output feeds the next via variable extraction.

Every protocol is a chain step: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB, Kerberos, MySQL, MongoDB, PostgreSQL, SQL Server, Redis, FTP, STOMP / ActiveMQ and Freestyle, alongside the control flow steps (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF, SCRIPT, PRINT and WAIT_FOR_CALLBACK).

SMB is a full protocol here: a probe, a chain step and entries in the library. It covers file read/write/delete/rename, directory listing and creation, share enumeration, ACL reads and writes, plus a recon slice over MSRPC named pipes (LSA policy, SAMR user and group enumeration, RID cycling, NetServer/NetShare/NetSession, workstation sessions).

Authentication is NTLM, pass-the-hash or a null session, with SMB3 signing and encryption available. In a chain, SMB_SUCCESS, SMB_LAST_STATUS, SMB_SHARE_LIST, SMB_FILE_CONTENT, SMB_FILE_MATCHES, SMB_RPC_LINES and LSA_DOMAIN_SID pass values to the next step. A share list feeds an ITERATE step directly.

SMB needs the Security tier.

A chain is a named sequence of steps. Each step can be a protocol probe or a control-flow instruction. Steps share a variable context: an earlier step can extract a value (e.g. HTTP_JSON_PATH $.token) and later steps reference it with {{token}}.

Control-flow step types:

• ITERATE: runs child steps once per item in a list; last iteration's variables bubble up
• CONDITION: evaluates a JavaScript expression; skips children if false
• PARALLEL: forks child steps into concurrent workers, merges results
• ASSERT: fails the chain if a variable doesn't match an expected value or pattern
• CHAIN_REF: calls another chain as a sub-routine, passing and receiving variables
• SCRIPT: runs a saved script; its checks count toward the chain's verdict
• PRINT: writes a line to the execution log, with {{variable}} references resolved
• WAIT_FOR_CALLBACK: waits until an out-of-band callback arrives, or fails on timeout

Extractors pull values from step responses and store them as chain variables. Every protocol brings its own set. Here are some of the HTTP, LDAP and DNS ones, with the two general-purpose extractors at the end:

• HTTP_STATUS: HTTP response status code
• HTTP_JSON_PATH: JSONPath expression against the response body
• HTTP_BODY_RAW: entire response body as a string
• HTTP_HEADER: a specific response header value (case-insensitive)
• LDAP_SUCCESS: whether the LDAP operation succeeded
• LDAP_EXCHANGE_RESULT_CODE: result code for a specific LDAP operation
• DNS_SUCCESS: whether the DNS query resolved
• DNS_ANSWER_VALUE: the first answer record's value
• REGEX: arbitrary regular expression against any text
• CONSTANT: a literal value (useful for seeding variables)

Scripts are written in JavaScript and run sandboxed: a script reaches only the API we hand it, with no filesystem access. That API is the vp binding, which sends probes programmatically and lets you process their responses:

const result = vp.send("My Bundle", "Login probe", { username: "alice" });
console.log(result.extract("HTTP_JSON_PATH", "$.token"));

Print with console.log or println. Both write to the Output panel below the editor.

A script lives in a bundle like everything else you author. It runs against the active environment.

Fuzzing lets you run a probe repeatedly, substituting different payloads into marked fields on each run. Mark a field with §payload§ (section-sign markers) and supply a payload list. VirtuProbe substitutes each payload in turn and collects the results.

The markers work in any probe field on any protocol. Each fuzz run is saved with the probe (the most recent 20) and exports as JSON. Fuzz sends do not go into the probe's own history. Fuzzing needs the Security tier.

Each Project can have multiple named environments (e.g. "Dev", "Staging", "Prod"). Each environment is a key-value map. Switching the active environment changes which values are injected into probe fields and chains that reference {{varName}}.

Variable priority: values set during chain execution override environment variables (chain wins on collision). Probe inline variables override environment variables too.

The free Workbench tier has no time limit and includes a lot that other tools charge for:

• HTTP, DNS and SMTP probes + chaining (ITERATE, CONDITION, PARALLEL, ASSERT, CHAIN_REF)
• Agent access over MCP: your coding agent authors and runs chains
• Unlimited probes, bundles & chains
• AI assistant: bring your own key; we never charge for tokens
• API auth: OAuth2 (every flow), Basic, Bearer, API key, Digest
• GraphQL requests
• Import OpenAPI / Postman / Bruno / HAR / Insomnia / cURL
• Directory-backed Git workspaces
• Run history, diff & JSON evidence export
• Community library access (71 probes across protocols)

It needs no account and no cloud.

Engineering tier is for shipping and debugging integrations:

• IMAP and LDAP probes
• Database probes: MySQL / MariaDB, MongoDB, PostgreSQL and SQL Server, run a query and assert on what comes back
• Redis: drive a command sequence and assert on the reply
• FTP: list and transfer files, or drive the control connection command by command
• STOMP / ActiveMQ: connect, subscribe, send and read frames against a message broker
• SpamAssassin message scoring
• JavaScript scripting (with a code editor, autocomplete and linting)
• MITM proxy & interception (TLS termination), including MCP interception of an agent's tool traffic
• Service virtualization: mock rules in the proxy stand in for a dependency that is down or does not exist yet
• MCP server testing; test suites with a JUnit report; skills an agent can call
• Out-of-band callback detection over HTTP, DNS and SMTP
• Enterprise & Windows auth: NTLM, pass-the-hash, SPNEGO/Kerberos, AWS SigV4
• Library: generic APIs, integrations, cloud SDKs, the infrastructure collection (Kubernetes, Docker, Vault, Prometheus, Elasticsearch) and email deliverability

Security tier is aimed at penetration testers and security researchers. It includes everything in Engineering (the MITM proxy and the service-virtualization mocks among it) and adds the offensive kit:

• Fuzzing: §payload§ markers in any probe field, plus raw byte-for-byte requests and request-smuggling detection
• SMB probe: file ops, share enum, ACL reads and writes, with NTLM and pass-the-hash logins
• Kerberos probe: AS-REP Roasting, Kerberoasting
• Freestyle: your own raw TCP or UDP exchange, sent byte for byte
• Full pentest library (HTTP, SMTP, IMAP, DNS, Active Directory, Kerberos, SMB, WordPress, MongoDB and API security, over 700 probes and chains)

Yes. The Academic License gives verified students and academics full Security tier access at no cost. It's available to:

• Students currently enrolled in a degree program (any field)
• Researchers and faculty: PhD candidates, postdocs, lecturers, professors
• Instructors licensing for a course; university security/CS societies or CTF teams

Apply for the Academic License →

When you subscribe via Paddle, you receive an access key (UUID). Enter your email and that key in the License panel inside VirtuProbe Studio. The app validates against the license server and caches your tier locally, then re-validates every 12 hours in the background.

Your license is tied to the email you used at checkout and activates on up to three of your own devices. The cached license is good for 48 hours. A check that cannot reach the server keeps your tier rather than dropping it, so losing the connection does not interrupt your work.

Yes. One license covers one person on up to three devices: laptop, desktop, a VM, whatever you work on. To cover more people, buy one license per person. For an organization-wide Enterprise agreement, reach out.

No. The installer bundles a complete JVM (Temurin 21). The bundled JVM does not conflict with any existing Java installation on your system.

Every download carries a published SHA-256 checksum. Verify it before opening the installer. If anything looks off, write to [email protected].

To proceed on Windows: click More info, then Run anyway. You will not see the warning again after installing.

macOS builds are signed with an Apple Developer ID and notarized by Apple, so they open with no Gatekeeper warning.

VirtuProbe stores probes, bundles, chains, scripts and settings in a platform-appropriate directory:

• Windows: %APPDATA%\VirtuProbe
• macOS: ~/Library/Application Support/VirtuProbe Studio
• Linux: ~/.local/share/virtuprobe

Everything is stored locally with no cloud sync: in an embedded database by default, or as plain JSON files in a folder if you switch the workspace to one. To back up your data, copy the data directory for your platform along with any workspace folder.

Yes, on an Enterprise license. For systems your own machine cannot reach, the execution server runs on its own as a Docker image inside the environment under test, so the requests originate from inside that network.

You keep working in the desktop application, which connects to that execution server. Without one, everything runs inside the desktop application.

Two external calls happen automatically:

• License validation, against license.virtuprobe.studio, only when a license key is configured. It checks your subscription status and never transmits probe content.
• Version check, against dl.virtuprobe.studio/latest-version.json, a single JSON file fetched at startup. Used to show the "new version available" notice. No telemetry.

Everything else happens when you act: a probe you send, the Library you browse (fetched from GitHub) or the AI model endpoint you configured.

Write to [email protected]. Please include a description of the issue, steps to reproduce and any proof-of-concept you have. We aim to respond within one business day and to ship a fix within 14 days for confirmed vulnerabilities.

The SOCKS5 proxy binds to localhost by default and is not exposed on the network. It generates a self-signed CA certificate on first use. You install that CA in your browser or system trust store to intercept TLS traffic. The CA private key stays on your machine and is stored in the VirtuProbe data directory.

Only route your own traffic through the proxy, or traffic you have explicit permission to intercept.