Probes

Probes are deterministic, single-purpose security testing tools. Unlike security hooks (which bundle many programs into one domain tool), each probe is its own tool focused on one testing dimension.

Probes operate on captured HTTP traffic — they take a request_id from HackBrowser or Chrome Extension captures and run targeted tests against it.

HackBrowser / Chrome Extension
        ↓
  Captures HTTP Traffic
        ↓
  Probes analyze captured requests
        ↓
  Agent verifies leads

Probe Tools

There are six probe tools, each covering a distinct testing dimension:

inject_probe

Fires a battery of injection probes at one parameter-bearing request and returns raw observations.

Vulnerability Types

Additional Tests

CRLF injection, HTTP parameter pollution (HPP), local file inclusion (LFI), mass assignment, file upload, host header injection, verb tampering, and time-blind injection.

Parameters

Example

{
  "tool": "inject_probe",
  "input": {
    "request_id": "req_abc123"
  }
}

Operates on query-string and form-urlencoded parameters. Uses canary-based detection — each payload embeds a unique marker to correlate reflections.

Coverage Output

The result includes a coverage.not_tested section listing injection classes the probe did not cover. The agent is expected to test those separately.

session_probe

Deterministic session-management probe covering JWT and cookie security.

JWT Tampering

Cookie Analysis

• Shannon entropy of session identifiers — low entropy means predictable sessions
• Cookie attributes — HttpOnly, Secure, SameSite flags
• Session identifier structure — pattern analysis

Confirmation Method

Replays forged tokens with a no-token control request. A session is only marked “accepted” when the same request without any token is denied — eliminating false positives from endpoints that don’t require authentication.

Parameters

access_probe

Cross-identity access-control probe for IDOR, BOLA, and BFLA detection.

Takes a captured request and replays it under every other session credential (and unauthenticated), then compares each response against the owner’s using a decision-differential.

How It Works

1. Sends the original request as the owning credential — baseline response
2. Replays the same request with each other registered credential
3. Replays with no credential (unauthenticated)
4. Compares response bodies using token-set Jaccard similarity
5. A swapped identity that gets a 2xx with high similarity (>0.9) to the owner’s response = Broken Access Control

Verdicts

Safety

Only GET/HEAD methods are auto-replayed. State-changing requests (POST, PUT, PATCH, DELETE) under another identity could mutate or destroy their data — these are refused with guidance to confirm manually via http_replay.

Parameters

crypto_probe

Cryptography analysis probe — fully read-only over captured traffic by default.

Detections

Optional: Live TLS Handshake

With tls_handshake: true, the probe opens a read-only TLS handshake (no HTTP request) to check:

• Negotiated protocol and cipher suite
• Accepted legacy protocols (TLSv1.0, TLSv1.1)
• Certificate issues (expiry, self-signed, hostname mismatch)

This is the only part of crypto_probe that opens a connection. Scope-gated.

Parameters

error_probe

Mutates requests to trigger error responses and analyzes error signatures to fingerprint server-side technology.

Useful for identifying the application framework, web server, and middleware stack from error page patterns — information that guides which injection techniques and hook programs to run.

Parameters

identity_probe

Tests authentication mechanism signatures to understand how the target handles identity.

Analyzes authentication headers, token formats, and login flows to classify the authentication scheme in use — information that feeds into session_probe and access_probe for deeper testing.

Parameters

Safety by Design

Related Documentation

• Security Hooks — Domain-specific testing suites with 400+ programs
• Hacker Browser — Autonomous crawler that captures the traffic probes analyze
• Chrome Extension — Manual browser-driven traffic capture