一个轻量级浏览器抓包与安全分析扩展，在浏览器侧边栏中即可完成抓包、拦截、修改、重放、规则检测与AI辅助分析的完整工作流。（A lightweight browser extension for traffic capture and security analysis, enabling capture, interception, modification, replay, rule-based detection, and AI-assisted analysis—all from the browser sidebar.）
# 🦅 Hx0 HawkEye: Full-stack lightweight capture & AI security auditing extension
【[中文](https://github.com/asaotomo/hx0-hawkeye/blob/main/README-git.md) / English】
        
## 1. What it is
**Skip the proxy hassle—truly ready out of the box.** Hx0 HawkEye is a native browser extension (Chrome / Firefox and mainstream Chromium) that gives you a full **capture, intercept (HTTP + WebSocket frames), replay, micro-Fuzz, and AI-assisted auditing** loop directly in the sidebar.
<!-- 这是一张图片，ocr 内容为： -->
#### ⚡ Core advantage: why not a classic proxy?
+ **Zero environment overhead**: no Burp Suite required, no system proxy, no root trust or Java setup.
+ **Session fidelity**: sees real page **XHR / Fetch / WebSocket** traffic with the **same origin login state** as the active tab—no more “proxy ate my cookies” or constant re-auth pain.
+ **Works immediately after install**: ideal for day-to-day dev/debug, API triage, and **authorized** first-pass security review.
<!-- 这是一张图片，ocr 内容为： -->
#### 🤖 Differentiator: end-to-end AI (BYOK)
Bring your own model API (BYOK) and embed AI into the sidebar workflow:
+ **Smart cases & payload generation**: structured test ideas in the replay workbench; context-aware mutated payloads in micro Fuzz—without bloated static wordlists.
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
+ **Deep single-request analysis**: semantic AI read-through of full Request / Response for risk triage.
<!-- 这是一张图片，ocr 内容为： -->
+ **Batch synthesis**: select multiple packets in a dedicated workbench; AI extracts patterns across APIs and third-party calls to support supply-chain / dependency-surface **first-pass** review.
<!-- 这是一张图片，ocr 内容为： -->
+ **Dual-engine static hunting**: **built-in dark-link rules + AI contextual interpretation** for batch replay across pages and broad static coverage.
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
---
## 2. Why we built it
With **SPAs, heavy XHR/Fetch, and WebSocket**, engineers constantly switch between “real browser session” and “capture / tamper / replay.” Classic proxies (e.g. Burp) are powerful but need system proxy and trust, and **cookies / login state** can diverge from the tab; lightweight toolbar extensions often lack **durable history, structured detail, and a closed-loop workbench**.
**Hx0 HawkEye** aims to keep **no mandatory system proxy** while folding **capture (HTTP / WebSocket) → filter → detail audit → intercept → replay → micro Fuzz → sensitive & dark-link checks → optional AI** into **one sidebar hub**, cutting context-switch cost for dev triage and **authorized** API review.
---
## 3. Features
Core flow: **Capture** (optional **WebSocket**) → **Filter** → **Detail** → **Replay** (HTTP / **WebSocket frames**; optional **AI test cases**) → **Micro Fuzz** (HTTP / **WS**; optional **AI payloads**) → **Dark-link / AI packet analysis** (including **batch AI / dark-link workbenches** after multi-select) → **AI Task Console** (Pro, multi-stage automation).
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
<!-- 这是一张图片，ocr 内容为： -->
| Module | Description |
| --- | --- |
| **Capture** | Hooks `fetch` / XHR in the page world; records requests and responses (including bodies, with size guards). Noise control via **host/IP wildcards**, **resource types** (XHR/Fetch, **WebSocket**, JSON, HTML, JS, binary, etc.), and **custom suffixes**. With **WebSocket** enabled, records handshakes (e.g. `GET 101`) and frames (`WS`, `OUT` / `IN`). |
| **History** | **IndexedDB** persistence; filters by type, host, method, status, **sensitive hits**, search; default scope **current page** or **all packets**. |
| **Intercept** | Queued hold for **HTTP**; **WebSocket** outbound/inbound **frames** can enter a **frame** queue when rules match; **edit, forward, drop** in the sidebar; bulk actions; shares target rules with capture. |
| **Detail audit** | **Pretty / Raw / Hex**; response **Render** (sandbox); **sensitive** aggregation & highlights; copy full URL from title; download split raw **.txt**; **Burp-style** export. |
| **Replay** | Edit raw traffic and replay; **WebSocket frame replay** shares the same workbench and sends via a still-**OPEN** page socket (not a fresh handshake); **in-page replay** (some WAF challenge pages); undo/redo; host switch; **AI test cases** from current request/options (requires AI config). |
| **Encode / hash** | MD5, SM3, SHA, ROT13, Base64, URL, Hex, etc.; scope: **selection / param values only / full URL line**. |
| **Micro Fuzz** | `§...§` injection points; **Start Fuzz** and **in-page Fuzz** (HTTP/DOM); **WebSocket micro Fuzz** sends serially and uses the **next inbound frame** as the response (needs an active page socket); baseline diff; **AI payloads** from model context; pair with Render, sensitive, and **AI result** views. |
| **Dark link & static threats** | Rule scan on static HTML, etc.; **high-trust TLD** allowlist; downloadable reports; **AI packet/semantic** interpretation; **batch dark-link** workbench for **horizontal compare** and **third-party script clues** (supply-chain first pass). |
| **AI (optional)** | **Single packet**: interpret **request + response**, anomalies and risk notes. **Batch**: multi-select history, dedicated tab with **per-row highlights + summary** for multi-endpoint evidence. **AI Task Console**: multi-stage automation (penetration / CTF) in the sidebar, with **Skills knowledge-base injection** (built-in penetration/CTF modules, import external `SKILL.md`, per-task submodule selection), **in-task supplementary hints** queued into later turns. Models: OpenAI, DeepSeek, local LM Studio, **custom base URL**; **OpenAI-compatible** and paths such as **Baidu Qianfan coding plans**; traffic goes **only to your configured endpoint** (BYOK). |
| **Sensitive matching** | Built-in rules (IDs, phones, cards, email, Shiro/JWT/Swagger/UEditor/Druid fingerprints, IP, domain, CTF flags, etc.) plus **custom regex** and **keyword lists**; import/export, clear-all. |
| **Batch** | Bulk export/delete, **batch AI**, **batch dark-link** (separate tab), batch replay, etc. |
| **i18n** | UI **中文 / English**. |
**Chrome vs Firefox** differ in sidebar hosting, intranet/self-signed HTTPS helpers, and intercept prompts; **core features align**. See in-extension help after install for details.
---
## 4. Editions (Community / Pro)
Hx0 HawkEye currently uses a three-state model: **Community**, **Pro**, and a **30-minute first-install Pro trial**.
- **Community** keeps the essential loop: **capture (including WebSocket) → inspect → standard replay (including WebSocket frames) → basic encode/decode**, plus **intercept** (**HTTP** and matching **WebSocket frames**).
- **Pro** unlocks **in-page replay / fuzzing, HTTP/WS micro Fuzz, Tampermonkey scripts, AI, AI Task Console, Skills knowledge base, dark-link review, batch workbenches, and advanced encode/decode tools**.
- **First-install trial** grants **full Pro capability for 30 minutes**. If no activation code is applied after the trial, the product **automatically falls back to Community**.
### Feature Comparison Table
| Feature | Community Edition | Professional Edition | Description |
| ----------------------------------------------------------------------------------------------------------------- | ----------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Packet Capture Toggle, Target Domain / IP, Capture Type / Suffix Filters | ✅ | ✅ | The Community Edition is sufficient for basic traffic capture and noise reduction |
| History List, Current Page / All Packets Switch, Host / Method / Status Code Filters | ✅ | ✅ | Quickly locate and filter requests |
| Pretty / Raw / Hex / Render Views, Copy / Single Export / Copy URL by Title | ✅ | ✅ | Full packet detail auditing is available in the Community Edition |
| Built-in Sensitive Information Detection & Aggregated Display | ✅ | ✅ | Supports built-in rule-based detection |
| Standard Replay | ✅ | ✅ | Full basic replay workflow; includes **WebSocket frame replay** via the shared workbench (requires an `OPEN` socket in the page) |
| **Interception Toggle, Modify / Forward / Forward All / Drop All (Community since v1.0.2)** | ✅ | ✅ | Queue-based intercept for **HTTP** and **WebSocket frames** when host rules match |
| Floating Action Button, Open as New Tab, Language Switching | ✅ | ✅ | Daily productivity features remain available in the Community Edition |
| **Basic Encoding & Decoding**: MD5, SM3, SHA-1, SHA-256, ROT13, Base32 / Base64 / URL / Hex | ✅ | ✅ | Directly available in the Community Edition |
| **Advanced Encoding & Decoding**: SHA-512, HMAC-SHA256, Base64URL, Unicode, HTML, JSON, JWT, Timestamp Conversion | ❌ | ✅ | Designed for advanced verification, signing, and analysis workflows |
| **Intelligent Encryption Logic Analysis (Added in v1.0.1)** | ❌ | ✅ | Combines request context with related JS / HTML clues to help identify encoding, hashing, signatures, or hybrid encryption workflows |
| In-Page Replay, In-Page Fuzzing, **HTTP / WebSocket Micro Fuzz**, Injection Point Marking | ❌ | ✅ | Suitable for dynamic pages, WAF testing, real-time channels, and high-frequency parameter probing |
| Switch HTTP Method, Switch Target Domain | ❌ | ✅ | Useful for multi-environment debugging and verification |
| **Intelligent Proxy Router (Added in v1.0.1)** | ❌ | ✅ | Located below “Capture Type / Suffix” in Settings. Requests matching site rules can be automatically forwarded to upstream proxies such as Burp Suite or Yakit, while unmatched traffic continues using the original network path. The Firefox version additionally supports “Compatibility Mode” and “Takeover Mode”. |
| AI Analysis Settings, AI Result Analysis, AI Analysis, AI Test Case Generation | ❌ | ✅ | All AI-related capabilities are included in the Professional Edition |
| **AI Task Console (since v1.0.2)** | ❌ | ✅ | Multi-stage automation: Intelligent Penetration and CTF modes; **Skills knowledge-base injection** (v1.0.3: smarter defaults and manual-selection priority), **in-task supplementary hints**; **timeline log with draggable split** (v1.0.5); tighter orchestration and tool chains; ties history, replay, and evidence into reports |
| **AI Skills Knowledge Base (v1.0.3)** | ❌ | ✅ | Built-in penetration/CTF libraries with reference submodules (v1.0.5: 19 pentest + 28 CTF); editable markdown; **import external SKILL.md / skill folders**; **AI Generate Skill** (v1.0.5); layered selection in Advanced Settings and AI Task panel; injected into AI tasks and single/batch AI analysis |
| **Tampermonkey / Page Script Workspace (v1.0.4)** | ❌ | ✅ | Import `.user.js`, script library management, one-click inject; AI create/optimize scripts; **Smart Decode Assistant** (v1.0.5); integrates with capture, replay, and scanning tools |
| **AI Task Smart Script Dispatch (v1.0.4)** | ❌ | ✅ | During tasks, AI can list, run, and create page scripts—combines with Skills, replay, and Fuzz orchestration |
| **Advanced codec / smart nested decode (enhanced in v1.0.5)** | ❌ | ✅ | Replay workbench adds AES/DES/RSA/SM; AI tasks include `codec.transform`; inline packet codec aligned with replay |
| Hidden Link & Static Threat Detection, Report Export, High-Reputation Top-Level Domains | ❌ | ✅ | Rule scanning, reporting, and advanced noise-reduction capabilities |
| Full Deep Search, Custom Regex / Keyword Libraries | ❌ | ✅ | Advanced search and rule extension capabilities |
| Batch Export, Batch Delete, Batch Replay, Batch AI Analysis, Batch Hidden-Link Detection | ❌ | ✅ | Unified batch-processing workflow exclusive to the Professional Edition |
> Version `1.0.1` mainly introduced two Professional Edition features: `Intelligent Proxy Router` and `Intelligent Encryption Logic Analysis`.
> Version `1.0.2` adds **WebSocket** (capture / frame replay / **WS micro Fuzz** / frame intercept), the **AI Task Console** (including **in-task hints** and multi-stage orchestration improvements), and moves **intercept** capabilities to the Community Edition.
> Version `1.0.3` adds **Skills injection for AI tasks**, **capture/intercept UX improvements**, and **online activation**.
> Version `1.0.4` adds **Tampermonkey script support**, **AI smart script dispatch**, **capture/intercept reliability**, and **Firefox cross-browser alignment**.
> Version `1.0.5` adds **AI Task Console overhaul**, **thicker Skills + AI Generate Skill**, **codec enhancements**, and **UX improvements**.
### Understanding the Edition Boundaries in One Sentence
- **Community Edition focuses on:** packet inspection (**HTTP / WebSocket**), understanding, basic verification, essential encoding/decoding, and **intercept/tamper**.
- **Professional Edition focuses on:** page-context validation, mutation testing, AI analysis, AI tasks & Skills, hidden-link scanning, and large-scale batch workflows.
- If you simply want to evaluate the product’s core value first, the Community Edition is already sufficient for the most important primary workflow.
---
## 5. Product strengths
1. **No proxy wall**: extension form factor—**no separate JVM, no dedicated proxy port**; configure targets and capture.
2. **Session match**: same **same-origin session** as the active tab; fewer **random logouts** on replay.
3. **One workbench**: history, intercept, replay, encoders, micro Fuzz, **WebSocket**, sensitive, dark-link, AI—**same sidebar**.
4. **Modern frontends**: **XHR/Fetch, WebSocket, FormData, multipart**; **Raw / Hex** within extension limits.
5. **Dynamic-page forensics**: **in-page replay / in-page Fuzz** runs in real DOM—helps with some **WAF / challenge** pages.
6. **Sensitive & dark-link built-in**: list badges, detail rollups, exportable reports for **dev self-check and authorized first pass**.
7. **AI in the loop**: **AI Task Console** (multi-stage + **Skills knowledge base** + **in-task hints**), **AI test cases**, **AI Fuzz payloads**, **single-packet AI**, **batch AI** (multi-packet summary for **supply-chain / dependency** hints), **dark-link rules + AI**—same sidebar, fewer tools.
8. **AI under your control (BYOK)**: you choose model and endpoint; **data only goes to your API**—cloud (DeepSeek, SiliconFlow, Qianfan, etc.) or **on-prem**.
9. **Light footprint**: runs with the browser vs heavy standalone proxy stacks.
---
## 6. Comparison with common tools
Compared across shape, session, workflow, and specialties: **Hx0 HawkEye**, **Burp Suite**, **Yakit**, **HackBar / simple extensions**. **Enterprise deep scanning, complex Intruder, non-browser traffic** still belong on dedicated platforms—use **alongside** this product.
| Dimension | **Hx0 HawkEye** | **Burp Suite** | **Yakit** | **HackBar / simple extensions** |
| --- | --- | --- | --- | --- |
| **Shape & deploy** | Browser extension; **sidebar = main hub**; optional floating ball; **no JVM, no proxy port** | Java proxy + browser trust; suite, heavy | Desktop + engine/plugin ecosystem; security platform | Often toolbar mini-panel or single-request helpers |
| **Day-to-day cost** | **Install and go**; no forced system proxy; EN/ZH UI, flow in sidebar | Proxy, root trust, Proxy/Repeater learning curve | Install + pipeline/workflow learning | Fast start, scattered features, weak “project” workspace |
| **Browser session** | **Same tab origin**; fewer login gaps on replay | Via proxy; cookie juggling into Repeater common | Via proxy/engine; different from pure extension | Manual headers/cookies |
| **Modern APIs (XHR/Fetch/SPA + WS)** | Page-world fetch/XHR hooks; optional **WebSocket** capture / frame replay / frame tamper; **multipart Raw/Hex** (within limits) | Full proxy visibility, very capable | Plugins cover complex cases | Often no history, no Hex/sensitive rollups |
| **History & workbench** | **IndexedDB**; rich filters (including **WebSocket** type); detail/replay/fuzz/AI **in sidebar** | Proxy History very strong; more app switching | Platform records & collaboration | Usually **no or weak history** |
| **System proxy / non-browser** | **In-browser** HTTP(S) and **page WebSocket** | Strong | Strong | Weak |
| **Intercept** | **HTTP + WebSocket frames**; queued; per-item or bulk in sidebar | Proxy intercept, industry standard | MITM / workflows | Rare or URL-only |
| **Replay / fuzz** | Replay + **HTTP/WS micro Fuzz** + **in-page replay/fuzz** (e.g. form POST) | Repeater / Intruder mature | Web Fuzzer, etc. | Rarely concurrent fuzz or structured diff |
| **Sensitive / dark-link / reports** | **Built-in rules + badges + rollups**; export | Scanner, BApps; licensing/config | Rich PoC/plugins | Rarely built-in |
| **AI assist** | **BYO API**, **you control data path**; **Skills knowledge base** and **AI Task Console** multi-stage orchestration | Often third-party or DIY | Growing | Uncommon |
| **Active scan / heavy automation** | Not the focus; **manual tight loop** | Scanner, macros, plugins | PoC, batch, collaboration | Minimal |
| **Resource use** | With browser, **light** | Proxy + JVM, usually higher | Varies | Tiny but narrow |
**Suggested combo**: HawkEye as daily **in-browser hub**; add **Burp / Yakit** for full-site scanning, huge wordlists, or non-browser clients—“fast sidebar loop + deep platform.”
---
## 7. Offline install (release build)
This extension uses low-level network capture and security APIs and is **not listed on the Chrome or Firefox add-on stores**. Download the **release** package from this repo’s **Releases** page (or mirrors/attachments noted in the release notes), then follow your browser below for **offline install**.
> Actual archive names follow each release. Examples: `Hx0-HawkEye-Chrome-V1.0.5-Official.Release` (folder / `.zip`) and `Hx0-HawkEye-Firefox-V1.0.5-Official.Release` (folder / `.xpi` / `.zip`). Version numbers update per release.
>
### Browser compatibility & recommended methods
| **Browser** | **Recommended method** | **Pros** | **Cons / notes** |
| --- | --- | --- | --- |
| **⭐⭐⭐⭐⭐** **Microsoft Edge** | **Drag-drop** `.crx` | Simplest, persists, few security nag dialogs | Turn on **Developer mode** on the extensions page first |
| **⭐⭐⭐⭐⭐** **360 Speed / QQ / Sogou** | **Drag-drop** `.crx` | Easiest in China desktop browsers; few blocks | Generally smooth for third-party extensions |
| **⭐⭐⭐⭐** **Google Chrome** | Load **unpacked folder** | Persists across restarts | **Do not delete** the unpacked folder; some builds show “disable dev-mode extensions” at startup—dismiss to continue |
| **⭐⭐⭐** **Firefox Developer / ESR** | Install `.xpi` | Persistent, store-like experience | Specific Firefox builds + `about:config` tweak |
| **⭐⭐** **Firefox (release)** | **Temporary load** (folder) | Any Firefox version, no advanced prefs | **Extension disappears after browser quit**—reload each session; good for one-off testing |
### Step-by-step
#### 1. ⭐⭐⭐⭐⭐ Recommended · Edge / 360 Speed / QQ / Sogou
These browsers are friendly to local extensions; `.crx` usually **survives restart** with fewer prompts.
1. Open extensions:
- **Edge**: `edge://extensions/`
- **360 Speed**: `chrome://extensions/`
- **QQ Browser**: `qqbrowser://extensions/`
- **Sogou**: `se://extensions/`
2. Enable **Developer mode** (Edge: “Developer mode”; often bottom-left or top-right).
3. **Drag** the unpacked `Hx0-HawkEye-Chrome-V1.0.5-Official.Release.zip` (or a provided `.crx`) onto the page.
4. Confirm **Add extension**.
<!-- 这是一张图片，ocr 内容为： -->
#### 2. ⭐⭐⭐⭐ · Google Chrome
Chrome tightly restricts non-store `.crx`; prefer **unpacked folder**.
1. Unzip to a **fixed path** (e.g. `D:\Tools\Hx0-Extension\`); **do not delete** `Hx0-HawkEye-Chrome-V1.0.5-Official.Release`.
2. Open `chrome://extensions/`.
3. Enable **Developer mode** (top right).
4. **Load unpacked** → select that folder.
5. Pin the extension. If you see “Disable extensions in developer mode,” **close the banner**—capture usually still works.
<!-- 这是一张图片，ocr 内容为： -->
#### 3. ⭐⭐⭐ / ⭐⭐ · Mozilla Firefox
Unsigned extensions are restricted; for **permanent** install use **Firefox Developer Edition** or **ESR**.
**Option A: ****⭐⭐⭐**** Permanent (Developer / ESR)**
1. Open `about:config`, accept risk.
2. Find `xpinstall.signatures.required`, set to `false`.
<!-- 这是一张图片，ocr 内容为： -->
3. Open `about:addons` → Extensions.
4. Gear **⚙** → **Install Add-on From File…**
5. Choose `Hx0-HawkEye-Firefox-V1.0.5-Official.Release.xpi`.
<!-- 这是一张图片，ocr 内容为： -->
**Option B: ****⭐⭐**** Temporary (any Firefox; lost on quit)**
1. After each Firefox start, open `about:debugging`.
2. **This Firefox** → **Load Temporary Add-on…**
3. In the unpacked `Hx0-HawkEye-Firefox-V1.0.5-Official.Release` folder, select `manifest.json`.
4. Repeat after **every** browser restart.
<!-- 这是一张图片，ocr 内容为： -->
### After install
+ **Toolbar popup**: capture/intercept toggles, targets & types, open capture UI (sidebar)
+ **Sidebar**: history, intercept, replay workbench
---
[Read more](https://github.com/asaotomo/hx0-hawkeye)