BugEyeBrowser Security Toolkit

spot what others miss

A browser extension for bug bounty, VAPT and pentest triage: passive recon, OSINT and web security testing. 82 tools across nine pillars, built to observe and report, not to attack on your behalf.

Edge, Firefox & OperaReference only, nothing auto-sentZero telemetry

Case brief

FIELD
USE
ONLY

BugEye watches the page you're already looking at and the domain you're already testing, then hands you what it finds: headers, cookies, tokens, forms, exposed paths, outdated libraries, cloud buckets, and more, all from public and client-visible signals.

It does not brute force logins, spray payloads, or send an exploit for you. Every payload, shell one-liner, and exploit link BugEye surfaces is copy-paste: you decide when and where it gets used, and you stay inside the scope you were authorized for.

The nine pillars

TI

Tab Inspector

Headers, cookies, JWTs, CSP, clickjacking, CORS and storage, read straight from the tab you're on.

PR

Page Recon

Pulls links, scripts, forms, hidden fields and embedded resources out of the rendered page.

LT

List Triage

Paste, normalize, alive-check and bulk-open large lists of endpoints in one pass.

TR

Traffic

Rewrites headers, spoofs the user agent, strips referrers and logs requests on the active tab.

EP

Encode / Payload

An encode, decode and hash toolkit, plus a searchable library of XSS, SQLi and other reference payloads.

CB

CLI Bridge

Builds copy-paste commands for nuclei, ffuf, wordlists and more. Nothing runs inside the extension.

OS

OSINT

Subdomains, WHOIS, DNS, certificates, breach and leak checks, plus deep links into 30+ recon search engines, all from public sources.

VH

Vuln Hunting

Manual checks and payload references: access-control diffing (IDOR/BOLA), outdated JS, WordPress, GraphQL introspection and blind XSS/SQLi.

UT

Utility

AutoFinder's one-pass domain scan, the Bug Bounty Playbook's methodology reference and the rest of the toolbox.

The full toolset

82 tools, all live, grouped by pillar. Open the full guide, with a description of every tool →

TI

Tab Inspector

13
PR

Page Recon

9
LT

List Triage

1
TR

Traffic

4
EP

Encode / Payload

3
CB

CLI Bridge

7
OS

OSINT

30
VH

Vuln Hunting

8
UT

Utility

7

Field notes

One pass, full picture

AutoFinder runs every domain-based check at once, DNS through exposed secrets, diffs the result against your last scan of that target, and exports as Markdown, JSON or a formatted Word report with color-coded findings.

Reference, never automated

Every payload, reverse-shell one-liner, and exploit-tool link BugEye surfaces is copy-paste. It does not send payloads, brute force logins, or run anything against a target on its own.

One prompt, not fifty

Grant host access once, up front, and every tool works on every site afterward with no repeated per-domain permission nags.

Method, not just tools

The Bug Bounty Playbook explains what a finding actually means, how to verify it safely, and how to report it, not just how to trigger it, with links out to HackTricks.

Nothing phones home

No telemetry, no BugEye-run servers. Cross-origin lookups go straight from your own background worker to the source you're querying.

One codebase, every browser

The same source builds a Chromium package for Edge and Opera, and a separate Firefox package, with identical features and permission scope across all three.

Deployment

Field kit A

Edge

Microsoft Edge Add-ons listing.

Get it for Edge

Not yet published, link is a placeholder.

Field kit B

Firefox

Firefox Browser Add-ons listing.

Get it for Firefox

Live on Firefox Add-ons.

Field kit C

Opera

Opera Add-ons listing.

Get it for Opera

Not yet published, link is a placeholder.

Load it yourself, right now

BugEye is live on Firefox Add-ons; Edge and Opera are still in review. In the meantime you can download the build for your browser and load it manually, developer mode only takes a minute.

Edge / Opera

  1. Download and unzip the Chromium build.
  2. Open edge://extensions (or opera://extensions).
  3. Turn on Developer mode, top right.
  4. Click Load unpacked and select the unzipped folder.

Firefox

  1. Download and unzip the Firefox build.
  2. Open about:debugging#/runtime/this-firefox.
  3. Click Load Temporary Add-on and select manifest.json inside the folder.
  4. Temporary add-ons unload on restart, reload it the same way until BugEye is listed on addons.mozilla.org.

BugEye is built for authorized security testing only: your own assets, an authorized VAPT engagement, or an in-scope bug bounty program. Recon and OSINT triage, no auto-sent exploits, no denial-of-service, no login brute-forcing.

You are responsible for staying inside the scope and authorization you actually have. When in doubt, don't run it.