ojkchikaholjmcnefhjlbohackpeeknd
The OWASP Penetration Testing Kit (PTK) browser extension is your all-in-one solution for streamlining your daily AppSec tasks. Whether you’re a penetration tester, a Red Team member, or an AppSec practitioner, OWASP PTK enhances your efficiency and provides deep insights into your target application. Runtime Scanning (DAST & IAST & SAST & SCA): Perform Dynamic Application Security Testing, Static Analysis, In-Browser IAST and Software Composition Analysis on the fly. Identify SQL injection, command injection, reflected/stored XSS, SQL auth bypass, XPath injections, JWT attacks, and other complex threats. Static Analysis (SAST): PTK automatically parses loaded JavaScript, HTML, and CSS right in your browser—before any code ever runs. It flags unsafe patterns like `eval()`, `innerHTML`/`outerHTML` injection, insecure cryptographic calls, missing input sanitization, and common anti-patterns. In-Browser IAST (Interactive Application Security Testing): PTK’s built-in IAST engine instruments your app at runtime—right in the browser—tracking taint flows and code execution to flag vulnerabilities as they occur. Catch issues like DOM-based XSS, unsafe `eval`/`innerHTML` usage, open-redirects, and more without leaving your dev tools. JWT Inspector: Analyze, craft, and tamper with JSON Web Tokens. Generate keys, test null signatures, brute-force HMAC secrets, and inject malicious `jwk`, `jku`, or `kid` parameters. Insightful Application Info: One-click visibility into tech stacks, WAFs, security headers, crawled links, and authentication flows. Built-in Proxy & Traffic Log: Capture all HTTP(S) traffic, replay requests in R-Builder, and automate XSS, SQLi, and OS command injection. R-Builder for Request Tampering & Smuggling: Craft and manipulate HTTP requests, including complex request-smuggling techniques. Now with cURL import/export. Cookie Management: Add, edit, remove, block, protect, export, and import cookies from a powerful in-browser editor. Decoder/Encoder Utility: Instantly convert between UTF-8, Base64, MD5, URL-encode/decode, and more formats. Swagger.IO Integration: Browse and interact with API endpoints directly from your Swagger documentation. Selenium Integration: Shift left security by running automated Selenium tests with built-in vulnerability checks. Enhance your AppSec practice with PTK—the extension that makes your browser smarter and your testing faster. Install today and start uncovering vulnerabilities in real time!
FindSomething
Find interesting things in the webpage's source code or JavaScript This tool is used to quickly extract some interesting information from the HTML source code or JS code of the web page, including possible requested resources, interface URLs, possible requested IPs and domain names, leaked ID numbers, mobile phone numbers, email addresses, etc. Welcome to communicate with us, WeChat canxiao_xiao
d3coder
Encoding/Decoding Plugin for various types of encoding like base64, rot13 or unix timestamp conversion This extension enables you to encode and decode selected text via the context menu. This reduces the time you spend on looking up values and gives you more time to concentrate on the important things of development. The context menu this extension enables is customizable through the options page. To get there either click on the item or go to Wrench -> Tools -> Extensions -> d3coder options. Via the popup you are able to choose between four message types: alert the result, adding a DIV-element to the bottom of the page, via console.log() or replacing the selected text on the page. You can also deactivate functions(e.g. if you don't need them and want to free the space they use). The current version has implemented the following en-/decoding functions:
Sputnik
OSINT web extension Sputnik is an extension to quickly and easily search IPs, Domains, File Hashes, and URLs using free Open Source Intelligence (OSINT) resources. • Text - Select the artifact you wish to search and right click • Links - Right click on links, audio, images, videos • Select an OSINT tool • In most cases, you will be redirected straight to results • For tools that require user interaction such as captchas: • The highlighted artifact will be saved to your clipboard • You will be directed to the submission page
Rapid7 AppSec Plugin
The Rapid7 AppSec plugin works with Rapid7 Application Security and AppSpider dynamic application security testing solutions to improve application scanning coverage and assist in validating vulnerabilities with these capabilities: Macro Recording - Use the plugin to record macros required by Application Security and AppSpider Enterprise when selecting the Macro Authentication scan configuration. Macro Authentication enables the crawling engine of Application Security and AppSpider to authenticate with complex login workflows. Vulnerability Validator - Use the vulnerability validator in conjunction with the Attack Replay feature in Application Security and AppSpider. This feature of the Chrome plugin enables users to replay and edit recorded traffic generated during an Application Security or AppSpider scan. Bootstrap Authentication - The Chrome plugin is required to use AppSpider Enterprise's Bootstrap Authentication feature, which gives the user the ability to interactively login to the target application during an active scan. Used for login workflows that require human interaction for example 2FA (Two-factor authentication). Traffic Recorder - Record the interactions (like HTTP GET and POST requests) between the front end application and the back end server in a Traffic File. Application Security can replay these interactions to authenticate into your application. For support related to this plugin, please contact chrome_plugin@rapid7.com
