Neo Hackbar

Neo Hackbar is a pentesting toolbar for Pale Moon and Basilisk. From the browser toolbar you can build and run requests (GET/POST, referrer, cookies), encode and decode payloads, and use curated SQL injection, XSS and LFI/RFI cheat sheets.

The interface is English-only.

Tested on:

• Pale Moon 29.4.4
• Basilisk 2021.12.13

Features

• URL bar with POST data, referrer and cookie support.
• Codecs: Base64, URL, hex, binary, MD5 / SHA-1 / SHA-256, ROT13 and case helpers.
• SQL injection helpers: basics, UNION, error/double query, out-file and WAF bypass.
• XSS and LFI/RFI cheat sheets, plus HTML tag payloads.
• Admin bypass and dork lists.
• Hack Search: Google dork presets for the current site (within site, subdomains, admin/login, username/password, documents, config and backup files).
• Dark theme aware.

Bundled tools

Neo Hackbar bundles a few classic pentesting extensions:

• Live HTTP Headers v0.17.1 — by Daniel Savard and Nikolas Co (official site dead). View HTTP headers of a page while browsing.
• NoRedirect v1.1.1 — by Kai Liu. Take control of HTTP redirects: preview/screen shortened URLs, avoid DNS search redirection hijacks, etc.
• Tamper Data v11.0.1 — by Adam Judson (official site dead). View and modify HTTP/HTTPS headers and POST parameters.
• View Source — view source helpers.
• Hacksearch v1.1.1 — by QBurst, Rejah Rehim A A and Sreenath Sasikumar. Gather Google-indexed data about a site so you can secure it yourself.

Building

The extension is packaged into neo-hackbar-<version>.xpi:

• Windows: release.cmd
• Linux: ./release.sh

release.sh reads the version from install.rdf; you can also force one, e.g. ./release.sh 1.2.0. Both scripts pack the chrome/*.jar bundles, sync the version in install.rdf/README.md and produce the .xpi.

Development notes

• REPORT.md — refactor analysis and the changes applied per phase.
• TODO.md — pending work (e.g. trimming the bundled tools' locales).

Credits

This Hackbar benefits from the modifications made by t.pro and Renegade18.

Original Hackbar developers: Johan Adriaans and Pedro Laguna.

Icons courtesy of Fatcow.

Extension logo from http://www.fasticon.com/