debugHunter

Discover Hidden Debug Endpoints & Development Environments

The essential Chrome extension for bug bounty hunters and penetration testers
Passively detect debug parameters, sensitive headers, and exposed paths while you browse.

Why debugHunter?

Finding debug endpoints and exposed configuration files is a common technique in bug bounty hunting. debugHunter automates this process by passively scanning every website you visit, alerting you when it discovers:

• 🔧 Debug Parameters — ?debug=1, ?env=dev, ?XDEBUG_SESSION_START=phpstorm
• 📨 Sensitive Headers — X-Forwarded-Host: localhost, X-Original-URL: /admin
• 📁 Exposed Paths — /.env, /.git/config, /actuator/env, /phpinfo.php

All findings are classified by severity so you can focus on critical issues first.

Features

Detection Coverage

?debug=1              ?_debug=true           ?debug_mode=1
?XDEBUG_SESSION_START ?XDEBUG_SESSION=1      ?debugbar=1
?profiler=1           ?trace=1               ?verbose=1
?show_errors=1        ?display_errors=1      ?dev_mode=1
?phpinfo=1            ?error_reporting=E_ALL ?env=dev
?env=staging          ?env=pre               ?env=sandbox
?environment=dev      ?staging=1             ?beta=1
?internal=1           ?test=1                ?admin=1

X-Debug: 1
X-Forwarded-Host: localhost
X-Forwarded-For: 127.0.0.1
X-Original-URL: /admin
X-Env: dev
Env: pre
Env: dev

/.env                 /.git/config          /config.json
/.env.local           /.env.production      /credentials.json
/auth.json            /secrets.json         /database.yml
/wp-config.php.bak    /.aws/credentials     /backup.sql
/dump.sql             /.htpasswd            /actuator/env
/actuator/heapdump

/.git/HEAD            /.git/logs/HEAD       /.svn/entries
/phpinfo.php          /info.php             /graphiql
/__debug__            /debug                /server-status
/elmah.axd            /trace.axd            /rails/info/properties
/package.json         /composer.json

/swagger-ui.html      /swagger.json         /api-docs
/openapi.json         /web.config           /.htaccess            
/Dockerfile           /docker-compose.yml

Installation

Option 1: Clone Repository

git clone https://github.com/devploit/debugHunter.git

1. Open chrome://extensions/
2. Enable Developer mode (top right)
3. Click Load unpacked
4. Select the debugHunter folder
5. Pin the extension to your toolbar

Option 2: Download Release

1. Download the latest .zip from Releases
2. Extract and load via chrome://extensions/ → Load unpacked

Usage

1. Browse normally — debugHunter scans passively in the background
2. Check the badge — Number indicates findings count (color = severity)
3. Click the icon — View findings by category: Paths, Headers, Parameters
4. Review & verify — Click any finding to open in new tab

Configuration

Access settings via the gear icon in the popup:

Testing

A dynamic test server is included to verify the extension works correctly:

cd test/
python3 server.py               # Recommended: Dynamic server

Alternative (static server, limited functionality):

./start-server-macos.command    # macOS
./start-server.sh               # Linux/other

The dynamic server (server.py) serves different content based on debug params/headers:

• Normal request: Clean production page (no sensitive data)
• With debug params: Debug page with exposed credentials, stack traces, etc.

This mimics real-world behavior where debug endpoints only expose sensitive data when triggered.

Test URLs:

• http://localhost:9000/ — Normal page
• http://localhost:9000/?debug=1 — Debug mode triggered
• http://localhost:9000/.env — Sensitive path

Technical Details

• Manifest V3 — Chrome MV3 compliant
• Permissions — storage, tabs, <all_urls>
• Background — Service Worker (event-driven)
• Privacy — All analysis happens locally, no external requests

Changelog

v2.0.6

• Reduced false positives on dynamic sites (login pages, news sites, etc.)
  • Redirect detection: Filters paths that redirect to catch-all destinations
  • Natural variance measurement: Detects highly dynamic sites
  • Smart mode now requires clear evidence (debug indicators or status changes)
  • Debug indicators must be NEW (not present in original response)
• Fixed path detection on non-standard ports (e.g., localhost:9000)
• New dynamic test server (test/server.py) that mimics real-world behavior
• Improved soft-404 detection (content length comparison)

v2.0.0

• Complete rewrite with Manifest V3
• Multi-factor detection engine
• Severity classification system
• Response diff viewer
• Search and filter functionality
• Smart rate limiting with exponential backoff
• Dynamic content filtering
• 4 configurable detection modes
• New dark UI
• 46 sensitive paths (up from 17)
• Optimized requests with HEAD checks and caching

v1.x

• Initial release with basic parameter detection

Contributing

• Report bugs — Open an issue with reproduction steps
• Add patterns — Submit PRs with new parameters, headers, or paths
• Improve docs — Help make the README clearer

License

MIT License. See LICENSE for details.

Disclaimer