Reflect4 Web Proxy File

Fetch via proxy:

fetch('/r/news.example.com/api/latest', 
  headers:  'X-API-Key': '<API_KEY_1>' 
).then(r => r.text()).then(console.log)

Reflect4 is not a traditional web proxy like Squid or Charles Proxy. It is a reflection validation proxy built as part of ProjectDiscovery’s Nuclei toolset. Its primary purpose is to listen for HTTP requests, modify them based on predefined rules, and then intelligently analyze the responses to determine if specific input (often payloads) is reflected back in an exploitable context.

Unlike a standard proxy that merely forwards traffic, Reflect4 actively checks for how and where user input is echoed in the server’s response. This makes it a critical component for automating the detection of Cross-Site Scripting (XSS), Server-Side Template Injection (SSTI), Log Injection, and other reflection-based vulnerabilities. reflect4 web proxy

Before dissecting Reflect4, we must understand its parent category. A web proxy acts as an intermediary between your browser and the destination server. When you request a website (e.g., google.com), you ask the proxy to fetch it for you. The destination server sees the proxy’s IP address, not yours.

Traditional limitations include:

Reflect4 was built to solve these specific problems.

Reflect4 can compress images and minify CSS/JS on the fly. This is slow for large pages, so enable it selectively: Fetch via proxy: fetch('/r/news

$config['compress_output'] = true; // Gzip compression
$config['max_download_size'] = 10485760; // 10MB limit

Reflect4 is a lightweight, privacy-focused web proxy designed to let users fetch, view, and transform web content while minimizing tracking and exposure of identifying information. It’s useful for developers, privacy-conscious users, and organizations that need a simple intermediary to sanitize requests, rewrite responses, or cache content. This post explains what Reflect4 is, how it works, common use cases, deployment options, configuration examples, security and privacy considerations, performance tips, and a brief roadmap.