The definitive Chromium Manifest V3 platform for deep client-side reconnaissance, real-time CVSS v3.1 risk scoring, MITRE ATT&CK mapping, attack surface topology visualization, schema boundary fuzzing, and compliance auditing with zero false positives.
Test the v10.0 zero false-positive parsing engine, WebSocket interceptor, Parameter Miner, TruffleHog secrets harvester, and interactive Mini-Repeater in real-time
Everything an ethical hacker, bug bounty hunter, or security auditor needs inside Chromium
Automated multi-layer mission coordinator executing non-blocking posture checks across CORS, headers, environment files, CRLF, and CSP bypasses with consolidated pass/fail timelines.
Real-time vulnerability impact calculation computing exact CVSS v3.1 vector strings and numeric scores (0.0 to 10.0) with an attack surface posture grade gauge (A+ to F).
Automatically correlates discovered routes, credentials, and network behaviors to official MITRE techniques (T1592, T1595, T1552, T1190, T1530) across Reconnaissance and Access tactics.
Real-time HTML5 Canvas network graph rendering target origin, major cluster hubs (/api, /auth, /admin, /static), and leaf status nodes with live interactive redrawing.
Generates typed boundary test vectors for integer, string, boolean, array, and object parameters (32/64-bit int limits, IEEE-754 precision limits, null bytes, unicode normalization).
Simulates safe OPTIONS requests with custom origins and headers, evaluating Access-Control-Allow-Origin, Allow-Credentials, and flagging wildcard CSRF risks.
Computes Shannon entropy (0.0 to 8.0) on responses and tokens to distinguish high-randomness cryptographic secrets from plain text and static HTML templates.
Multi-layer signature detection identifying backend engines (Express, Django, Rails, Spring, PHP) and modern frontend frameworks (Next.js, Nuxt, React, Angular).
Native exports for Burp Suite Target Site Map XML (burp_sitemap.xml) and Postman Environment JSON (postman_environment.json) with auto-populated baseUrl and bearer tokens.
Generates compliance_report.json mapping findings directly to OWASP Top 10 (2021/2025), SOC 2 Type II Common Criteria, and ISO/IEC 27001:2022 controls.
Generates recon_pipeline.sh orchestrating ffuf, httpx, and nuclei with discovered parameters, wordlists, and status codes for terminal automation.
Targeted probers for SSTI ({{7*7}}), SQLi syntax error detection, XXE canary entities, client prototype pollution, and CRLF response splitting.
Burp-style HTTP dispatcher supporting GET, POST, PUT, DELETE, PATCH with custom headers, multi-role session switching, latency measurement, and JSON formatter.
Introspects GraphQL schemas, maps Queries and Mutations, and automatically synthesizes executable query operations with mock variables.
Reconstructs original TypeScript/JS source file trees from webpack and vite .map files, unearthing internal routes stripped from production bundles.
High-entropy regex scans client-side assets for leaked AWS credentials, Google API keys, GitHub PATs, Stripe tokens, Slack/Discord webhooks, and JWTs.
Real-time frame capture of window.WebSocket (send/message) and window.EventSource streams with direction markers and payload mutator.
Strictly enforces a zero auto-start policy. Never scans without your explicit button click, zero telemetry, and zero remote communication.
Dispatches real-time Telegram alerts formatted in rich HTML alongside an attached target domain-named ZIP (recon_<domain>_full_audit.zip) bundling all 15 recon artifacts, secrets, and reports.
Live 1-click active testing of uncovered keys (Google API Keys, Stripe Secrets, Firebase DBs, AWS IAM, JWT) assessing live exploitation posture and reporting clear actionable verdicts.
Zero-Interruption passive recon engine that operates silently in the background without stealing focus or lagging web browsing. Extracts endpoints on idle callbacks and updates live action badge counts.
Flexible interface supporting native Chrome Side Panel, dedicated Full Browser Tab (sidepanel.html?view=tab), and detached Popout Window with native OS maximize/minimize controls and live target tab resolution.
Postman and VS Code-inspired vertical sidebar organizing all 28 modules into structured categories, equipped with real-time fuzzy tab search, collapsible 58px icon rail, and 1-click horizontal/vertical toggle.
Feature-by-feature evaluation against common security recon tooling
| Recon Capability | Endpoint Hunter v10.0 | Burp Suite JS Miner | Postman | Katana / LinkFinder |
|---|---|---|---|---|
| In-Browser Native Execution | ✔ Native Chromium Extension (MV3) | ✖ Heavyweight Java Desktop App | ✖ Separate Desktop App | ✖ CLI Tooling Only |
| Zero Auto-Scan Privacy Policy | ✔ 100% Manual Trigger Buttons Only | ✖ Passive background proxy sniffing | ✖ Cloud workspace sync | ✔ Manual invocation |
| CVSS v3.1 & Posture Scorecard | ✔ Built-in Automated Scoring (A+ to F) | ✖ Manual severity tagging | ✖ None | ✖ None |
| MITRE ATT&CK Enterprise Matrix | ✔ Auto TTP Mapping (T1592, T1595, T1552) | ✖ None | ✖ None | ✖ None |
| Attack Surface Topology Canvas | ✔ Real-Time Node-Link Network Graph | ✖ Tree view only | ✖ List view only | ✖ Terminal output |
| API Schema Boundary Fuzzer | ✔ Type-aware boundary edge-cases | ✖ Requires manual wordlists | ✖ None | ✖ None |
| Burp Site Map XML & Postman Env | ✔ 1-Click Burp XML & Postman Env | ✔ Proprietary XML only | ✔ Native Env format | ✖ None |
| Compliance Reports (OWASP/SOC2/ISO) | ✔ Automated Framework JSON export | ✖ Paid Enterprise feature | ✖ None | ✖ None |
| Automated CLI Pipeline Bridge | ✔ Generates recon_pipeline.sh (ffuf/httpx/nuclei) | ✖ None | ✖ Newman runner only | ✖ None |
Load directly into Chrome, Brave, Edge, or any Chromium browser
Download the release ZIP directly or clone from GitHub:
git clone ...
Navigate to chrome://extensions and toggle the Developer mode switch in the top right corner.
Click Load unpacked and select the directory. The radar icon will appear in your toolbar and Developer Tools (F12)!