HuginCyber

One binary. Proxy, scanner, bug bounty toolkit. Built for hackers who hunt.

cargo install hugincyber
hugin

Hugin is a security intercepting proxy and active scanner in a single binary. It's built for penetration testers and bug bounty hunters who want to find real vulnerabilities — not wrestle with their tools.

What you get

• Intercepting proxy — HTTP, HTTPS, HTTP/2, WebSocket. Route traffic through Hugin, inspect and modify every request in flight.
• Active scanner — 55+ check classes: SQLi, XSS, SSTI, SSRF, request smuggling, HTTP/2 desync, BAC/IDOR, CSWSH, prototype pollution, file upload RCE, OAuth CSRF, SAML bypass, and more.
• Repeater — Send, modify, re-send any request. Browser-TLS mode gives you a real Chrome JA3/JA4 fingerprint.
• Intruder — Payload-fuzz any part of a request. Positions, payload lists, attack configurations.
• OOB collaborator — Built-in OAST server (HTTP, DNS, FTP, SMTP). Detect blind vulnerabilities without a third-party service.
• Crawler — Headless Chromium crawl with JavaScript analysis, sitemap parsing, and authenticated session support.
• MCP agent — Autonomous agent that can drive the scanner, browser, and repeater. Per-action Allow/Deny control. Bring your own LLM (OpenAI, Anthropic, OpenRouter, local).
• BAC matrix — Broken access control audit with identity rotation, function-level authz, verb tampering, and per-endpoint NxN matrix.
• Bug bounty integrations — YesWeHack. Submit findings directly from the scanner.

Why Hugin

• Single binary — no Docker, no Node, no Python. One file. Runs on Linux and macOS.
• No redaction — you're the operator. Secrets, tokens, cookies — all visible in cleartext, where you need them.
• Crash-proof — 32 MB worker stacks, finding flood caps, depth-bounded transform analysis. Built to survive the scans that break other tools.
• Self-updating — hugin update fetches the latest release from GitHub or the Forgejo mirror.
• Built in Rust — fast, memory-safe, no runtime dependencies.

Install

cargo install hugincyber

Then run:

hugin

The installer downloads the correct pre-built binary for your platform (Linux x86_64, macOS aarch64, or macOS x86_64) from the GitHub releases page, with a Forgejo fallback. Downloads are SHA256-verified when a sidecar checksum is available.

Update

hugin update

Platforms

Links

• Website: hugin.nu
• Docs: docs.hugin.nu
• Releases: github.com/HuginCyber/Hugin/releases
• Source: Private (this crate is the installer)

License

MIT — the installer crate is open source. The Hugin binary is free to download and use.