A Firefox sidebar for manual web security testing: SQL payloads, encoders, request control (POST, Referer, cookies) and reconnaissance searches, all available while you browse.
Current version: 2.0.0 (Manifest V2, Firefox).
- Mozilla Add-ons
- Press F1 to open or close the sidebar.
- SQL injection sheets: basic, UNION-based, error-based, DIOS and database-specific payloads for MySQL, PostgreSQL, MSSQL and Oracle.
- Encoders and hashes: URL, hex, Base64, binary, ROT13, MD5, SHA-1, SHA-256 and SHA-512 encode/decode, applied to the focused field.
- Request control: custom POST bodies (form, JSON, XML, multipart), raw POST with response preview, custom Referer and cookie injection.
- Text utilities: add/strip slashes, strip spaces, reverse, random case, upper/lower case and buffer-overflow strings.
- Reconnaissance dorks: Google queries for subdomains, admin panels, backups, configuration files, documents and credentials, plus current domain/DNS/WHOIS/reputation lookups.
- Per-tab state: URL, POST, Referer and cookie fields are restored when you switch tabs.
| Action | Shortcut |
|---|---|
| Open/close sidebar | F1 |
| Execute current payload | Ctrl+Shift+E |
| Load active tab URL | Ctrl+Shift+L |
- Load URL fills the sidebar from the active tab and restores that tab's POST, Referer and cookie data.
- Split URL puts each
?and¶meter on its own line. - Execute runs a GET, a form POST or a raw POST depending on the POST toggle and the body content.
POST and Referer bodies are captured only from the active tab while their toggle is enabled. Cookie values are applied only when COOKIE DATA is enabled and you press Execute.
Use this extension only on systems you own or have explicit permission to test.
Requirements: Node.js 20+, npm and Firefox.
npm install
npm test # headless jsdom tests
npx web-ext lint # manifest and source validation
npm run build # packaged XPI in web-ext-artifacts/
npm run sign # publish to AMO (maintainers only)Load the unpacked extension from about:debugging → This Firefox →
Load Temporary Add-on and select manifest.json.
The test suite boots panel.html in jsdom with a stubbed WebExtension API,
then checks codecs, POST classification, request execution, cookies, Referer
rewriting, per-tab storage, the prompt and panel integrity.
| Permission | Why it is needed |
|---|---|
storage |
Keep field state per tab and UI preferences locally. |
tabs |
Read the active tab URL and open recon results. |
cookies |
Populate and apply cookie values when you request it. |
webRequest, webRequestBlocking |
Rewrite the Referer header and capture the current tab's POST body. |
<all_urls> |
The sidebar can test any site you are authorized to test. |
There is no telemetry, analytics or remote configuration. Field data stays in
browser.storage.local on your machine. Network requests happen only when you
press Execute or open a reconnaissance link; raw POST responses are rendered
in a local blob page, not injected into the target page.
manifest.json extension manifest
panel.html sidebar markup
js/Main.js request execution, per-tab state, cookies, Referer
js/Functions.js codecs, hashes and text utilities
js/HackSearch.js reconnaissance URL builders
js/Sql.js SQL payload data
js/Union.js UNION/DIOS payload builders
js/Strings.js text action map
js/EncDec.js encoder action map
js/Other.js buffer overflow actions
test/ headless tests
Hackbar Future builds on the original Hackbar by Johan Adriaans and Pedro Laguna, and on work by T-Pro, Renegade18, Th1k404, rushic24, Khoiasd, Mr. silent coder, notdls, Black Dragon and mxcx. Hacksearch was originally developed by Rejah Rehim. The logo comes from the Circle Icons set by xenatt.
Maintained by Jalkhov.
Mozilla Public License 2.0. See LICENSE.