SecuriScan - Web Security Analyzer

OWASP Penetration Testing Kit

The OWASP Penetration Testing Kit (PTK) browser extension is your all-in-one solution for streamlining your daily AppSec tasks. Whether you’re a penetration tester, a Red Team member, or an AppSec practitioner, OWASP PTK enhances your efficiency and provides deep insights into your target application. Runtime Scanning (DAST & IAST & SAST & SCA): Perform Dynamic Application Security Testing, Static Analysis, In-Browser IAST and Software Composition Analysis on the fly. Identify SQL injection, command injection, reflected/stored XSS, SQL auth bypass, XPath injections, JWT attacks, and other complex threats. Static Analysis (SAST): PTK automatically parses loaded JavaScript, HTML, and CSS right in your browser—before any code ever runs. It flags unsafe patterns like `eval()`, `innerHTML`/`outerHTML` injection, insecure cryptographic calls, missing input sanitization, and common anti-patterns. In-Browser IAST (Interactive Application Security Testing): PTK’s built-in IAST engine instruments your app at runtime—right in the browser—tracking taint flows and code execution to flag vulnerabilities as they occur. Catch issues like DOM-based XSS, unsafe `eval`/`innerHTML` usage, open-redirects, and more without leaving your dev tools. JWT Inspector: Analyze, craft, and tamper with JSON Web Tokens. Generate keys, test null signatures, brute-force HMAC secrets, and inject malicious `jwk`, `jku`, or `kid` parameters. Insightful Application Info: One-click visibility into tech stacks, WAFs, security headers, crawled links, and authentication flows. Built-in Proxy & Traffic Log: Capture all HTTP(S) traffic, replay requests in R-Builder, and automate XSS, SQLi, and OS command injection. R-Builder for Request Tampering & Smuggling: Craft and manipulate HTTP requests, including complex request-smuggling techniques. Now with cURL import/export. Cookie Management: Add, edit, remove, block, protect, export, and import cookies from a powerful in-browser editor. Decoder/Encoder Utility: Instantly convert between UTF-8, Base64, MD5, URL-encode/decode, and more formats. Swagger.IO Integration: Browse and interact with API endpoints directly from your Swagger documentation. Selenium Integration: Shift left security by running automated Selenium tests with built-in vulnerability checks. Enhance your AppSec practice with PTK—the extension that makes your browser smarter and your testing faster. Install today and start uncovering vulnerabilities in real time!

NavSec Vulnerability Scanner

Comprehensive security scanner with advanced XSS detection, API security analysis, and authentication testing NavSec Security Scanner v2.0 - Executive Summary 🚀 Overview NavSec is the world's most comprehensive passive web vulnerability scanner, now with international regional compliance capabilities. It performs real-time security analysis directly in your browser, detecting 80+ types of vulnerabilities across 15+ countries with 140+ automated tests. Market Innovation • First and only scanner with multi-regional identity detection • 15 countries covered with proper validation algorithms • 10 major privacy laws compliance (LGPD, GDPR, CCPA, PIPEDA, etc.) • Automatic locale detection for region-specific scanning ________________________________________ Comprehensive Security Analysis • Transport Security - HTTPS, WebSocket, Mixed Content • Headers & CSP - X-Frame-Options, HSTS, SRI • SQL Injection - 10 detection methods • XSS Protection - Reflected, Stored, DOM-based • Authentication - JWT, CSRF, Session Management • Data Privacy - Credit Cards, API Keys, Passwords • Form Security - File Upload, CAPTCHA, Autocomplete • Comments & Metadata - TODOs, Dev URLs, Credentials • Iframe Security - Sandbox, External Sources Unique Advantages • ✅ 100% Passive - No data modification • ✅ 100% Local - Complete privacy • ✅ Zero Configuration - Works instantly • ✅ Professional Reports - Export detailed dashboards • ✅ Free Forever - No premium tiers ________________________________________ Technical Specifications • Technology: Chrome Extension (Manifest V3) • Language: JavaScript ES6+ • Performance:

DOM XSS Highlighter — Pro

Highlights user-controlled reflections in DOM to help detect risky contexts. Run only on sites you own or may test. DOM XSS Highlighter helps developers and security testers quickly spot user-controlled reflections inside a webpage’s DOM. By highlighting URL parameters, hash fragments, and other inputs that appear in risky contexts, it makes it easier to catch potential security issues during development and QA. ✨ Features • On-demand scanning (runs only when you click the extension) • Highlights user input in text, HTML, attributes, and scripts • Quick “rescan” and “clear” controls for fast testing • Click highlighted text to copy a structured JSON report • Local-only: no data ever leaves your browser Simple interface with professional security look ⚠️ Note: For educational and authorized testing only. Use on websites you own or have explicit permission to test.

CyberPad

CyberPad: Your Ultimate Security, Development & Pen-testing Notepad A secure, distraction-free notepad for your security assessments, coding, or penetration testing. Perfect for quickly documenting findings, writing and formatting code, and keeping all your notes organized—right in your browser. 🆕 What's New in v2.2.1 - Live Markdown Preview: Instantly see your formatted notes as professional HTML documents - Settings Dashboard: Customize your exports with company logos, custom footers, and confidentiality levels - Document Branding: Upload your logo and add custom footers for client-ready reports - Confidentiality Markings: Label documents as Public, Private, or Confidential with color-coded headers - Enhanced Export Options: Choose which elements (logo, footer, classification) to include in each preview - Fixed path issues for Linux systems ✨ What CyberPad Does - Keeps Your Notes Private: Everything stays local in your browser—no cloud sync, no external connections. - Preview Your Work: Instantly preview Markdown as formatted HTML with custom branding. - Professional Export Ready: Add company logos, footers, and confidentiality markings for polished reports. - Simplifies Security Work: Effortlessly capture vulnerabilities, bugs, or configuration changes during assessments and bug hunts. - Supports Multiple Languages: Highlight syntax for HTML, JavaScript, Python, PHP, CSS, and many more. - Dark & Minimalist Theme: Less strain on your eyes, more focus on your work. - Easy Saving & Organization: Save multiple findings with timestamps, quickly download notes as Markdown, and stay on top of your work. - Emoji Integration: Add 🛠️, ✅, or ⚠️ as quick status indicators. ⚡ Why You Should Install It - Local-Only Storage: No one sees your notes. Perfect for pen-testing or handling sensitive info. - Live Preview: See your formatted notes instantly before exporting. - Custom Branding: Upload your company logo and add custom footers for professional documentation. - Confidentiality Controls: Mark documents as Public, Private, or Confidential with visual indicators. - Effortless Reporting: Export Markdown files in one click for easy integration into your final reports. - Developer-Friendly: Write code, format it with built-in tools, and reference it later without leaving the browser. - Bug Bounty & Research: Keep track of new vulnerabilities or findings in real time. - Minimal Permissions: Only needs storage, contextMenus, and activeTab—ensuring your system stays secure. 🚀 Built For - Security Assessments: Document each step and vulnerability with professional formatting - Penetration Testing: Quick note-taking during engagements with instant preview - Bug Bounty Hunting: Organized approach to discoveries with branded exports - Development: Syntax highlighting and code snippets - System Administration: Document configurations and updates - Security Research: Compile and structure research data with custom templates ⚙️ Key Features - Live Markdown Preview: See formatted HTML output instantly - Custom Document Branding: Upload logos and add custom footers - Confidentiality Markings: Label documents as Public, Private, or Confidential - Multiple Language Support: HTML, JavaScript, Python, PHP, CSS, and more - Markdown Capabilities: Format your notes for professional reporting - Instant Export: One-click download of notes - Timestamped Entries: Keep track of when you made each discovery - Easy Copy/Paste: Works smoothly for code or text snippets - Bug Reporting System: Quickly log and manage software bugs - Settings Dashboard: Customize your export templates and preferences - Clean Interface: Avoid distractions and focus on your work 🔒 Privacy & Security - Stores notes only in your browser - No external servers or cloud databases - Minimal permissions, strict content security policy - Manifest V3 compliance Install CyberPad and get a lightweight, secure space for all your security findings and development notes—with professional export capabilities right at your fingertips.