hugincyber 0.2.6

Installer for Hugin — an intercepting proxy, web scanner, and bug bounty toolkit in a single binary (GUI + CLI).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

# HuginCyber

### One binary. Proxy, scanner, bug bounty toolkit. Built for hackers who hunt.

```
cargo install hugincyber
hugin
```

---

Hugin is a security intercepting proxy and active scanner in a single binary.
It's built for penetration testers and bug bounty hunters who want to find
real vulnerabilities — not wrestle with their tools.

## What you get

- **Intercepting proxy** — HTTP, HTTPS, HTTP/2, WebSocket. Route traffic
  through Hugin, inspect and modify every request in flight.
- **Active scanner** — 55+ check classes: SQLi, XSS, SSTI, SSRF, request
  smuggling, HTTP/2 desync, BAC/IDOR, CSWSH, prototype pollution, file
  upload RCE, OAuth CSRF, SAML bypass, and more.
- **Repeater** — Send, modify, re-send any request. Browser-TLS mode gives
  you a real Chrome JA3/JA4 fingerprint.
- **Intruder** — Payload-fuzz any part of a request. Positions, payload
  lists, attack configurations.
- **OOB collaborator** — Built-in OAST server (HTTP, DNS, FTP, SMTP).
  Detect blind vulnerabilities without a third-party service.
- **Crawler** — Headless Chromium crawl with JavaScript analysis, sitemap
  parsing, and authenticated session support.
- **MCP agent** — Autonomous agent that can drive the scanner, browser,
  and repeater. Per-action Allow/Deny control. Bring your own LLM
  (OpenAI, Anthropic, OpenRouter, local).
- **BAC matrix** — Broken access control audit with identity rotation,
  function-level authz, verb tampering, and per-endpoint NxN matrix.
- **Bug bounty integrations** — YesWeHack. Submit
  findings directly from the scanner.

## Why Hugin

- **Single binary** — no Docker, no Node, no Python. One file. Runs on
  Linux and macOS.
- **No redaction** — you're the operator. Secrets, tokens, cookies — all
  visible in cleartext, where you need them.
- **Crash-proof** — 32 MB worker stacks, finding flood caps, depth-bounded
  transform analysis. Built to survive the scans that break other tools.
- **Self-updating** — `hugin update` fetches the latest release from
  GitHub or the Forgejo mirror.
- **Built in Rust** — fast, memory-safe, no runtime dependencies.

## Install

```
cargo install hugincyber
```

Then run:

```
hugin
```

The installer downloads the correct pre-built binary for your platform
(Linux x86_64, macOS aarch64, or macOS x86_64) from the [GitHub
releases](https://github.com/HuginCyber/Hugin/releases) page, with a
Forgejo fallback. Downloads are SHA256-verified when a sidecar checksum
is available.

## Update

```
hugin update
```

## Platforms

| Platform | Status |
|----------|--------|
| Linux x86_64 | ✅ |
| macOS aarch64 (Apple Silicon) | ✅ |
| macOS x86_64 (Intel) | ✅ |
| Windows | ❌ (not planned) |
| Linux aarch64 | ❌ (vote via GitHub star) |

## Links

- **Website:** [hugin.nu](https://hugin.nu)
- **Docs:** [docs.hugin.nu](https://docs.hugin.nu)
- **Releases:** [github.com/HuginCyber/Hugin/releases](https://github.com/HuginCyber/Hugin/releases)
- **Source:** Private (this crate is the installer)

## License

MIT — the installer crate is open source. The Hugin binary is free to
download and use.