🦅 Hx0 HawkEye: Full-stack lightweight capture & AI security auditing extension

【中文 / English】

1. What it is

Skip the proxy hassle—truly ready out of the box. Hx0 HawkEye is a native browser extension (Chrome / Firefox and mainstream Chromium) that gives you a full capture, intercept (HTTP + WebSocket frames), replay, micro-Fuzz, and AI-assisted auditing loop directly in the sidebar.

⚡ Core advantage: why not a classic proxy?

• Zero environment overhead: no Burp Suite required, no system proxy, no root trust or Java setup.
• Session fidelity: sees real page XHR / Fetch / WebSocket traffic with the same origin login state as the active tab—no more “proxy ate my cookies” or constant re-auth pain.
• Works immediately after install: ideal for day-to-day dev/debug, API triage, and authorized first-pass security review.

🤖 Differentiator: end-to-end AI (BYOK)

Bring your own model API (BYOK) and embed AI into the sidebar workflow:

• Smart cases & payload generation: structured test ideas in the replay workbench; context-aware mutated payloads in micro Fuzz—without bloated static wordlists.

• Deep single-request analysis: semantic AI read-through of full Request / Response for risk triage.

• Batch synthesis: select multiple packets in a dedicated workbench; AI extracts patterns across APIs and third-party calls to support supply-chain / dependency-surface first-pass review.

• Dual-engine static hunting: built-in dark-link rules + AI contextual interpretation for batch replay across pages and broad static coverage.

---

2. Why we built it

With SPAs, heavy XHR/Fetch, and WebSocket, engineers constantly switch between “real browser session” and “capture / tamper / replay.” Classic proxies (e.g. Burp) are powerful but need system proxy and trust, and cookies / login state can diverge from the tab; lightweight toolbar extensions often lack durable history, structured detail, and a closed-loop workbench.

Hx0 HawkEye aims to keep no mandatory system proxy while folding capture (HTTP / WebSocket) → filter → detail audit → intercept → replay → micro Fuzz → sensitive & dark-link checks → optional AI into one sidebar hub, cutting context-switch cost for dev triage and authorized API review.

---

3. Features

Core flow: Capture (optional WebSocket) → Filter → Detail → Replay (HTTP / WebSocket frames; optional AI test cases) → Micro Fuzz (HTTP / WS; optional AI payloads) → Dark-link / AI packet analysis (including batch AI / dark-link workbenches after multi-select) → AI Task Console (Pro, multi-stage automation).

Chrome vs Firefox differ in sidebar hosting, intranet/self-signed HTTPS helpers, and intercept prompts; core features align. See in-extension help after install for details.

---

4. Editions (Community / Pro)

Hx0 HawkEye currently uses a three-state model: Community, Pro, and a 30-minute first-install Pro trial.

• Community keeps the essential loop: capture (including WebSocket) → inspect → standard replay (including WebSocket frames) → basic encode/decode, plus intercept (HTTP and matching WebSocket frames).
• Pro unlocks in-page replay / fuzzing, HTTP/WS micro Fuzz, Tampermonkey scripts, AI, AI Task Console, Skills knowledge base, dark-link review, batch workbenches, and advanced encode/decode tools.
• First-install trial grants full Pro capability for 30 minutes. If no activation code is applied after the trial, the product automatically falls back to Community.

Feature Comparison Table

Version 1.0.1 mainly introduced two Professional Edition features: Intelligent Proxy Router and Intelligent Encryption Logic Analysis.
Version 1.0.2 adds WebSocket (capture / frame replay / WS micro Fuzz / frame intercept), the AI Task Console (including in-task hints and multi-stage orchestration improvements), and moves intercept capabilities to the Community Edition.
Version 1.0.3 adds Skills injection for AI tasks, capture/intercept UX improvements, and online activation.
Version 1.0.4 adds Tampermonkey script support, AI smart script dispatch, capture/intercept reliability, and Firefox cross-browser alignment.
Version 1.0.5 adds AI Task Console overhaul, thicker Skills + AI Generate Skill, codec enhancements, and UX improvements.

Understanding the Edition Boundaries in One Sentence

• Community Edition focuses on: packet inspection (HTTP / WebSocket), understanding, basic verification, essential encoding/decoding, and intercept/tamper.
• Professional Edition focuses on: page-context validation, mutation testing, AI analysis, AI tasks & Skills, hidden-link scanning, and large-scale batch workflows.
• If you simply want to evaluate the product’s core value first, the Community Edition is already sufficient for the most important primary workflow.

---

5. Product strengths

1. No proxy wall: extension form factor—no separate JVM, no dedicated proxy port; configure targets and capture.
2. Session match: same same-origin session as the active tab; fewer random logouts on replay.
3. One workbench: history, intercept, replay, encoders, micro Fuzz, WebSocket, sensitive, dark-link, AI—same sidebar.
4. Modern frontends: XHR/Fetch, WebSocket, FormData, multipart; Raw / Hex within extension limits.
5. Dynamic-page forensics: in-page replay / in-page Fuzz runs in real DOM—helps with some WAF / challenge pages.
6. Sensitive & dark-link built-in: list badges, detail rollups, exportable reports for dev self-check and authorized first pass.
7. AI in the loop: AI Task Console (multi-stage + Skills knowledge base + in-task hints), AI test cases, AI Fuzz payloads, single-packet AI, batch AI (multi-packet summary for supply-chain / dependency hints), dark-link rules + AI—same sidebar, fewer tools.
8. AI under your control (BYOK): you choose model and endpoint; data only goes to your API—cloud (DeepSeek, SiliconFlow, Qianfan, etc.) or on-prem.
9. Light footprint: runs with the browser vs heavy standalone proxy stacks.

---

6. Comparison with common tools

Compared across shape, session, workflow, and specialties: Hx0 HawkEye, Burp Suite, Yakit, HackBar / simple extensions. Enterprise deep scanning, complex Intruder, non-browser traffic still belong on dedicated platforms—use alongside this product.

Suggested combo: HawkEye as daily in-browser hub; add Burp / Yakit for full-site scanning, huge wordlists, or non-browser clients—“fast sidebar loop + deep platform.”

---

7. Offline install (release build)

This extension uses low-level network capture and security APIs and is not listed on the Chrome or Firefox add-on stores. Download the release package from this repo’s Releases page (or mirrors/attachments noted in the release notes), then follow your browser below for offline install.

Actual archive names follow each release. Examples: Hx0-HawkEye-Chrome-V1.0.5-Official.Release (folder / .zip) and Hx0-HawkEye-Firefox-V1.0.5-Official.Release (folder / .xpi / .zip). Version numbers update per release.

Browser compatibility & recommended methods

Step-by-step

1. ⭐⭐⭐⭐⭐ Recommended · Edge / 360 Speed / QQ / Sogou

These browsers are friendly to local extensions; .crx usually survives restart with fewer prompts.

1. Open extensions:
   • Edge: edge://extensions/
   • 360 Speed: chrome://extensions/
   • QQ Browser: qqbrowser://extensions/
   • Sogou: se://extensions/
2. Enable Developer mode (Edge: “Developer mode”; often bottom-left or top-right).
3. Drag the unpacked Hx0-HawkEye-Chrome-V1.0.5-Official.Release.zip (or a provided .crx) onto the page.
4. Confirm Add extension.

2. ⭐⭐⭐⭐ · Google Chrome

Chrome tightly restricts non-store .crx; prefer unpacked folder.

1. Unzip to a fixed path (e.g. D:\Tools\Hx0-Extension\); do not delete Hx0-HawkEye-Chrome-V1.0.5-Official.Release.
2. Open chrome://extensions/.
3. Enable Developer mode (top right).
4. Load unpacked → select that folder.
5. Pin the extension. If you see “Disable extensions in developer mode,” close the banner—capture usually still works.

3. ⭐⭐⭐ / ⭐⭐ · Mozilla Firefox

Unsigned extensions are restricted; for permanent install use Firefox Developer Edition or ESR.

Option A: ⭐⭐⭐ Permanent (Developer / ESR)

1. Open about:config, accept risk.
2. Find xpinstall.signatures.required, set to false.

3. Open about:addons → Extensions.
4. Gear ⚙ → Install Add-on From File…
5. Choose Hx0-HawkEye-Firefox-V1.0.5-Official.Release.xpi.

Option B: ⭐⭐ Temporary (any Firefox; lost on quit)

1. After each Firefox start, open about:debugging.
2. This Firefox → Load Temporary Add-on…
3. In the unpacked Hx0-HawkEye-Firefox-V1.0.5-Official.Release folder, select manifest.json.
4. Repeat after every browser restart.

After install

• Toolbar popup: capture/intercept toggles, targets & types, open capture UI (sidebar)
• Sidebar: history, intercept, replay workbench
• Options: language, AI, Skills, payload encoding, sensitive rules, dark-link, etc. (Chrome: chrome://extensions → Details → Extension options)

---

8. User manual

After install, open the in-product User Manual for full tutorials, Chrome / Firefox differences, FAQ, and licensing (exact entry depends on build).

---

9. Security & compliance

• Use capture, intercept, replay, and Fuzz only on systems you are authorized to test.
• AI analysis may send traffic to third-party or internal model endpoints—redact and assess cross-border / compliance rules.
• Use Render and similar features in trusted environments; sandboxing reduces but does not remove risk from malicious responses.
• Commercial use: follow license terms in the product.

---

10. How to Obtain the Activation Code

New users can first use the full Pro trial for 30 minutes. When the trial ends without activation, the product automatically falls back to Community. If the experience fits your workflow, you can obtain a Pro activation code through the following methods:

Visit the activation code tutorial to get your activation code for free for a limited time.

---

11. Contact & feedback

Hx0 Team (Hx0战队)

• Hx0 HawkEye website: https://www.hx0.store/products/hawkeye (product overview, downloads, and docs)
• WeChat official account / knowledge planet: Hx0战队
• Email: [email protected]

Please include browser + version, extension version, repro steps, and screenshots when reporting issues.

---

12. Disclaimer

This project and extension are for security research, development debugging, and authorized testing only. Obey applicable laws and scope of authorization.
The authors and contributors assume no liability for unauthorized testing or its consequences.

---

13. 1.0.1 Changelog

This 1.0.1 update primarily focuses on the enhancement of two professional edition capabilities:

• Smart Proxy Dispatcher (Professional Edition): Added a proxy dispatch entry below the Capture Type / Suffixon the basic settings page. It can forward browser requests matching site rules to Burp, Yakit, or other upstream proxies, while unmatched requests continue on their original network path. This is suitable for integrating "native browser session capture" and "in-depth proxy debugging" into a single workflow, reducing the overhead of frequently switching system proxies.

• Encryption Logic Intelligent Analysis (Professional Edition): Located to the right of the AI Analysis button. The model combines clues from the current request's URL, parameters, headers, body, and response, along with function names, field names, and submission flows from JS/HTML on the same page, to help determine if encoding, hashing, signing, or hybrid encryption is implemented on the front-end. It is suitable for reviewing changes in signature chains before and after packet modification.（In a nutshell: Let AI help you guess encryption, encoding, or signature logic, saving you the time of manual reverse engineering.）

  

• Stability Improvements: Concurrently strengthened details related to request header completion and proxy release in the standard capture mode, reducing display discrepancies and the probability of conflicts when switching between standard mode, intercept mode, and proxy settings.

• Sidebar and Batch Page Optimization: Sidebar message display and interaction optimization (consistent across both ends), overall layout optimization of batch pages.

• Enhanced In-Page Replay and In-Page Fuzz Functions: Updated to support form POST (Request Header Content-Type: application/x-www-form-urlencoded).

• Replay Workspace Optimized: Encoding/decoding functions now support response body processing, added scope differentiation, and unified undo/redo records for both requests and responses.

• “All domains” filter: Fixed incorrect list or filter behavior when the host filter is set to “All domains” and it interacts with the workbench scope (current tab vs all traffic).

• Capture / intercept list: Column widths can be adjusted by dragging the vertical handles on the right side of each header cell; widths are saved locally and restored the next time you open the panel.

• 302 / redirect capture: Improved how redirects (e.g. 302) are recorded and deduplicated across webRequest and passive CDP paths, reducing duplicate entries and missed captures caused by inconsistent typing.

• Three-state header sorting: The capture / intercept table headers cycle default → ascending → descending → default. The Fuzz results table uses the same pattern; clearing sort restores the original row order by sequence; clicking a column-width handle does not trigger sorting.

14. 1.0.2 Changelog

This v1.0.2 release strengthens HTTP replay headers, adds a WebSocket workbench, expands the AI Task Console (in-task hints + orchestration improvements), and brings intercept to the Community Edition—boosting Web assessments, CTF workflows, and daily capture analysis.

Main Updates

1. Replay Requests Now Support Critical Header Overrides

The Replay Workbench has been enhanced to better handle special request headers. You can now edit and apply the following fields directly inside Raw requests:

• Referer: https://xxx.com
• User-Agent: xxx
• Origin: https://xxx.com
• X-Forwarded-For: x.x.x.x

This feature is useful for common scenarios such as referer validation bypass, User-Agent verification, forged origins, and CTF Referer bypass techniques. Users can directly modify request headers in Raw mode and replay them, with behavior designed to closely resemble the replay experience of Burp Suite.

2. Added AI Task Module

A brand-new standalone AI Task Module has been introduced to automate the workflow of traffic capture, request analysis, vulnerability testing, and report generation.

The AI Task Module currently supports two modes:

• Intelligent Penetration Mode Designed for standard Web security testing scenarios. Based on the target site, historical traffic, and page context, the AI can automatically perform information gathering, entry-point analysis, attack modeling, vulnerability probing, and result evaluation.

• CTF Capture-the-Flag Mode Designed for Web-based CTF challenges. The AI automatically plans solving strategies around challenge entry points, hints, response behaviors, and suspicious parameters. It attempts to construct exploitation requests and generates a post-analysis report after successfully capturing the Flag.

  

The AI Task module records execution, evidence, key payloads, Flag hits, and final reports; while running, use toolbar Supplementary hints to queue context for later turns without replacing the pre-launch brief. The underlying multi-stage adaptive orchestration is continuously hardened (tool chain, budgets, readability). See in-product User Manual §10.

3. Interception Mode Is Now Available in the Community Edition

Interception Mode is now officially available for Community Edition users (HTTP and WebSocket frames when rules match).

Community Edition users can now pause, inspect, modify, and forward requests through Interception Mode, making manual testing, parameter debugging, and request verification much more convenient.

4. WebSocket Capture, Replay, Micro Fuzz, and Intercept

Enable WebSocket under capture types, then filter by type in the sidebar; handshakes often show as GET 101, frames as WS (OUT / IN). Frame replay shares the HTTP workbench and needs an OPEN page socket; §...§ + Micro Fuzz uses the next inbound frame as the response. Intercept supports per-frame edit/forward/drop. Scope is page-created WebSockets inside the browser—not a system MITM. Details: User Manual §5.

5. AI Tasks: In-Task Supplementary Hints

While a task runs, expand Supplementary hints, enter newly noticed parameters, reflections, paths, or CTF hints, and Submit; entries are queued with timestamps and appended as runtime user supplementary hints for later model turns, with per-turn and queue size caps. Do not paste real secrets; redaction and authorization rules match the full AI workflow.

6. AI Tasks: Orchestration and Execution Improvements

The AI Task Console multi-stage adaptive pipeline is tightened: multi-turn agent loops with real HTTP evidence, structured runtime memory (including failure memory aligned with sidebar metrics), and protocol checks / replanning for steadier stages and CTF early-finalize paths.

---

15. 1.0.3 Changelog

This v1.0.3 release brings three main updates:

1. AI Tasks Support Skills Loading (Pro)

The AI Task Console can inject built-in penetration / CTF knowledge bases, or import external SKILL.md files and skill folders from Advanced Settings. Pick libraries and submodules in the task panel—they are injected as context to support multi-stage automated testing and triage.

2. Capture & Intercept Experience Improvements

Smoother capture / intercept workflows in the sidebar: cleaner filtering and scope switching, easier list browsing, and more fluid edit/forward actions for day-to-day debugging and manual testing.

3. Online Activation Added

Single-click the popup status badge to open Software activation with a new Online tab for subscription or lifetime membership. Benefits sync online and are cached locally, so Pro features continue offline while the cache/subscription remains valid—alongside the existing offline activation code path for easier checkout and renewal.

---

16. 1.0.4 Changelog

This v1.0.4 release brings four main updates:

1. Tampermonkey Scripts + Page Script Workspace (Pro)

Import .user.js userscripts and manage them in the sidebar with one-click inject. AI can create or optimize scripts from traffic and tie them into capture, replay, and sensitive scanning. Human-written scripts, AI-written scripts, and AI-orchestrated scripts share one workflow.

2. AI Task Smart Script Dispatch (Pro)

Enable Smart Script Dispatch so AI tasks can list, run, or create page scripts during pentest / CTF—pull page-side intelligence back, then continue replay verification and reporting.

3. Capture / Intercept Reliability

More stable intercept for local labs and self-signed HTTPS; fixes regressions such as empty intercept queues; packet editor now accepts Chinese input correctly.

4. Firefox Stability and Cross-Browser Alignment

Fixes Firefox capture, sidebar, intercept, replay, and script injection; daily experience is further aligned across Chrome and Firefox.

See 1.0.4更新说明 in the repo for the full release notes.

---

17. 1.0.5 Changelog

This v1.0.5 release brings four main updates:

1. AI Task Console Overhaul (Core Release)

Execution log redesigned as a timeline card stream (color-coded stage / AI / test / tool-call cards; expandable tool JSON); draggable split between log and report; task background AI understanding before launch; reports include vulnerability inventory + request/response evidence; built-in crypto.logic.analyze and codec.transform for advanced crypto workflows.

2. Thicker Skills Library + AI Generate Skill

Built-in sub-modules expanded to 19 pentest + 28 CTF; Smart Enable toggle per main Skill; AI Generate Skill in Advanced Settings—create a single skill or collection and save as standalone Skill, built-in sub-module, or append to an imported skill.

3. Codec Capabilities Completed

Replay workbench adds AES / DES / RSA / SM and smart nested decode; built-in Smart Decode Assistant (enabled by default): select text on any page for common decode and hash hints; advanced AES / nested chains still go through replay or inline packet codec.

4. UX Improvements and Bug Fixes

Fixed various Chrome / Firefox system issues; better coordination among intercept / debug mode / passive listening toggles; improved sidebar and settings copy; user manual updated to v1.0.5.