4100 is a native Rust desktop proxy rotator for authorized bug bounty work. You load a proxy list, keep the live exits, lock in-scope hosts, then point Albatoul (or nuclei, ffuf, sqlmap, a browser) at 127.0.0.1:4100. Scanners still target the real site. 4100 owns the IP.
When an exit times out, 4100 switches to the next live one. If the fleet dies, it kill-switches — it will not fall back to your home IP.
Albatoul / nuclei / ffuf / browser
│
│ target = https://in-scope.tld
│ proxy = http://127.0.0.1:4100
▼
┌──────┐
│ 4100 │ scope gate · sticky host · rotate on timeout
└──┬───┘
│
live proxy IPs from your list
│
▼
in-scope target
| You put this in the scanner | Meaning |
|---|---|
| Target | The bounty site — https://target.com |
| Proxy | 4100 on your machine — http://127.0.0.1:4100 |
Do not scan the proxy IP. 4100 is the route, not the target.
| Proxy loader | Drop a list (host:port, user:pass@host:port, http://, socks5://, socks4://) |
| Live scan | Concurrent health check — latency, exit IP, keep only working exits |
| Local listener | HTTP/CONNECT on 4100, SOCKS5 on 4105 |
| Smart rotate | Timeout, 429, WAF signatures (HTTP), failover / round-robin / least-latency / random / sticky-per-host |
| Scope gate | Only listed hosts leave 4100 — wildcards, URLs, CIDR |
| Kill switch | No live proxies → 503. Your real IP stays off the wire |
| Bridge | Copy-paste hooks for Albatoul, nuclei, ffuf, sqlmap, curl, PAC |
| Stealth | Global / per-host RPS, jitter, cooldown, dead-proxy resurrection |
- Download
4100.exefrom Releases. - Double-click it. 4100 creates:
%USERPROFILE%\Desktop\4100\
exports\ live-proxies.txt, 4100.pac
logs\ latest journal
store.json settings + last fleet
- Proxies → load your list → Scan all.
- Scope → load in-scope hosts (same program as Albatoul).
- Start listener.
- In Albatoul → New Engagement → Use 4100.
Target stayshttps://target.com. Proxy ishttp://127.0.0.1:4100.
Other tools (Bridge page inside 4100):
nuclei -proxy http://127.0.0.1:4100 -u https://target.tld
ffuf -x http://127.0.0.1:4100 -u https://target.tld/FUZZ
sqlmap --proxy=http://127.0.0.1:4100 -u "https://target.tld/?id=1"
curl -x http://127.0.0.1:4100 https://target.tld
Albatoul is the scanner. 4100 is the rotator.
- Start 4100 — live fleet + scope + listener.
- Start Albatoul v1.0.1+ — click Use 4100.
- Launch the engagement.
HTTPS scans still go through 4100 as CONNECT tunnels. 4100 rotates on timeouts and dead connections; it cannot read TLS page bodies.
4100 is proprietary. You may use the official software. You may not sell it and you may not modify the code.
| Allowed | Not allowed |
|---|---|
| Run the official exe | Sell copies, paid forks, or paid hosting |
| Authorized testing only | Change, patch, or redistribute modified source |
| Share the GitHub link | Remove Karim Fayad’s credit or rebrand |
Full terms: LICENSE
Use 4100 only on bug bounty programs, pentest contracts, and systems you own. Unauthorized proxying or scanning is illegal. Bind stays on 127.0.0.1 by default. Confirm written authorization before you put a scanner on the listener.