Hunt Proxy
Start free trial
Menu
FeaturesDocsPricing

Getting started

From download to your first confirmed finding in about ten minutes.

Requirements

  • Linux — Debian, Ubuntu, Kali or another Debian-based distribution.
  • Python 3.10 or newer (installed for you as a dependency).
  • An internet connection the first time, to download dependencies and check your license.

Install

Hunt is distributed as a .deb package. Install it with apt so its dependencies come along:

sudo apt install ./hunt-proxy_<version>_amd64.deb

Then start Hunt Proxy from your applications menu, or run hunt-proxy in a terminal. To remove it later: sudo apt remove hunt-proxy — your projects stay in ~/hunt_projects.

Create a project

The start window asks for a project. A project keeps one target's traffic, findings, attack surface and reports together. Give it a name and, optionally, the first domain — you can add domains and scope rules later in the Scope tab.

Point your browser at the proxy

Hunt's proxy listens on 127.0.0.1:8888 (change it under Proxy → Settings). Set your browser — or a proxy switcher extension — to use it for HTTP and HTTPS.

Trust Hunt's certificate (HTTPS)

To read HTTPS traffic, your browser must trust the proxy's certificate authority:

  1. With the proxy running and your browser using it, visit http://mitm.it.
  2. Download the certificate for your platform.
  3. Install it — on Debian/Ubuntu system-wide:
    sudo cp mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy.crt
sudo update-ca-certificates
    In Firefox: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, and tick “Trust this CA to identify websites”.
  4. Restart the browser and open any HTTPS site — no warning means it worked.

The same steps are in the app under Help → Proxy Certificate. Only trust this certificate in a browser profile you use for testing.

Your first finding

  1. Browse the target. Requests appear in HTTP History, mapped and passively analyzed.
  2. Right-click an interesting request → Send to Scanner, pick scan types and start.
  3. Open the result: severity, evidence and whether it was confirmed (re-tested, or executed in a real browser for XSS).
  4. Promote it with Send to Reports, add CVSS and steps, export.

Unlock Pro

Free mode limits some tabs. Get a free 14-day trial key from your account and activate it under Upgrade → License — see Licenses & free trial.