The web-pentest workbench that thinks like a bug hunter.
Hunt Proxy is a desktop intercepting proxy and testing suite for web application security — capture, replay, scan, chain and report from one workspace, alone or as a team.
Sign in with Google · trial key in seconds · no card
IDOR — order belongs to another user
GET /v2/orders/1042 · param: id
as alice → 200 2,148 B
as bob → 200 2,148 B
as anon → 401 64 B
Features
Everything between “interesting request” and “accepted report”.
One workspace for manual depth and automated breadth — every tool is wired to every other, so a request you capture is one click away from the test you need.
Intercept, history, replay
A fast mitmproxy-based proxy with live HTTP and WebSocket history, inline intercept and a Requester built for race and mutation testing.
12 scan engines, one queue
XSS, SQLi, LFI, command injection, IDOR, upload, SSRF, XXE, NoSQLi, CORS, open redirect and SSTI — with XSS confirmed in a real headless browser, not just reflected.
Mapping & attack surface
Endpoints grouped and risk-ranked as you browse, plus an attack-surface workspace with priorities, tags and business-flow tracking.
Bypass engine
Phase-driven WAF evasion and access-control bypass probing with live telemetry, confidence scores and evidence for every hit.
Access control across identities
Replay captured requests as several users — cookies, headers, tokens — and compare status, length and similarity to spot broken boundaries.
JWT & API key labs
alg:none and key-confusion paths, weak-secret checks, claim tampering; plus API key discovery and live validation across providers.
Param & JS miners
Find hidden parameters and the endpoints, secrets and risky sinks buried in JavaScript — straight from captured traffic.
PoCs & reports
Generate CORS, CSRF and clickjacking PoCs, then track findings in a per-project report manager with CVSS, status and export.
AI where it helps
Chat in traffic context, payload ideas tuned to the filters a target shows, and first drafts of write-ups — always optional.
Workflow
Capture once. Pivot everywhere.
- 01
Capture once
Browse through the proxy on port 8888. Every request lands in History, mapped and analyzed passively.
- 02
Pivot anywhere
Send any request to Requester, Fuzzer, Scanner, Bypass, JWT, PoC or Access Control in one click.
- 03
Verify, don't guess
Findings are re-tested: differential checks, browser execution, cross-identity comparison.
- 04
Report
Promote evidence to a report, add CVSS and steps, and export — or hand it to your team.
Teams
Split the target. Share what you find.
One person on www, one on the API, one on admin — each in their own project and scope. A workspace links them, so everyone sees each other's findings, attack surface and reports, and can chain what they learn.
- End-to-end encrypted with your team passphrase — our server only ever stores ciphertext.
- See what each teammate is testing and import their attack surface and reports in one click.
- HTTP history never leaves your machine. Only results are shared, every 2 minutes.
👥 Acme Corp — Q4
Last synced 1 min ago · 2.4 / 200 MBSara is testing: api.acme.io (+ subdomains) · excludes: api.acme.io/health
12
Scanner results
40
Attack surface
2
Reports
Local-first
Projects, traffic and findings live on your disk. Nothing is uploaded unless you share a workspace.
Works offline
A valid license keeps working for up to 30 days without reaching our servers.
Fair licensing
Pro runs on 2 of your computers, with a self-service swap when you replace one.
Try every Pro feature free for 14 days.
Sign in with Google, copy your trial key, paste it into Hunt. Pro is $10/month after that.