AI-Native Intercept Proxy · v0.4.43

Hugin, a free vulnerability scanner and intercepting proxy — a Burp Suite alternative. FUZZ THE
FLOWS.

An AI engine that lives inside your proxy. It reads every packet, reasons over the application's attack surface, and writes its own exploits — autonomously, at line rate.

Scan2ms/flow
Tools174+
Checks112
EngineRust1,843,167 LoC
// How the engine works

Watch. Think. Hit.

01
Watch
Sniffs every request, every header, every cookie. Nothing hides.
Live capture
POST /api/v2/account/transfer HTTP/2
host: bank.target.com
authorization: Bearer eyJhbGc...
content-type: application/json
{ "from": 7821, "to": 9902, "amount": 5000 }
02
Think
Reads every parameter on every endpoint. Spots every weak spot — all at once.
AI found these seams
parameterweakness
fromid-corpus (known user id)
toidor — can transfer to anyone
amountrace condition — double-spend
BearerJWT — claim escalation
03
Hit
Fires real exploits at confirmed weak spots. Files a PoC for every one.
Auto attack result
POST /api/v2/account/transfer HTTP/2
authorization: Bearer <attacker_jwt>
{ "from": 7821, "to": 7821, "amount": -5000 }
→ 200 OK · balance flipped · filedcritical
// HTTP History

Every request,
laid bare.

Every request, every response, every header and cookie — captured and indexed. Filter by status, method, host. Replay anything, anywhere.

Hugin HTTP History — captured traffic with status filters and flow table
// The toolkit

One binary,
every tool.

Proxy, scanner, repeater, intruder, race engine and an AI agent — the same file, on your machine, no account.

Intercepting proxy

HTTP/1.1, HTTP/2, HTTP/3 and WebSocket through one MITM engine.

Vulnerability scanner

Active and passive checks for SQLi, XSS, SSRF, smuggling and more.

Repeater

Hand-edit and replay any captured request, byte for byte.

Intruder

Sniper, pitchfork, cluster-bomb and battering-ram attack modes.

Race conditions

Single-packet attacks that beat check-then-act windows.

WAF bypass & antibot

Coherent browser fingerprints and anti-bot challenge execution.

AI agent & MCP

Drive the whole toolkit from any MCP client.

Synaps modules

Sandboxed WASM scanner modules compiled from community code.

// Coverage

Every packet,
on command.

112active + passive checks
Active
64checks
Passive
48checks
OOB
8protocols
Concurrent
256connections
Scan cost
2ms/flow
OOB push
real-timeSSE
Protocols
5HTTP/1·2·3·WS·gRPC
// Pricing

One flat rate.
No tiers.

Prepaid by the month — no auto-renewal, no enterprise upsell. Community is free forever.

€10/ month, flat

the offensive bundle · every platform

  • —everything free in Community, forever
  • —174 MCP tools incl. 36 vurl-offensive
  • —blind-bug detection — OOB over 8 protocols
  • —race conditions · Synaps WASM · Lua extensions
  • —native browser automation · BAC & intelligence pipelines
  • —collaboration & multi-project
  • —cancel anytime — binary keeps working offline
create your account →

Community €0 — free forever, no account needed

no auto-renewal · 7-day trial, no card

// Access

Find what
others miss.

Community is free forever. No account, no email, no card.

free forever · pro from €10/mo · no account needed