Why I built Hugin
Every engine in Hugin is mine, written from scratch in Rust. The honest version of why it exists, before it ships.
I spend most of my working hours doing one of two things: breaking web applications, or building the tools to break them faster. Hugin is what happens when those two habits collide.
This is the honest version of why it exists — no launch hype. If it’s not for you, this should tell you that quickly.
The gap
The tooling most of us reach for is excellent and showing its age. It bundles a JVM or an Electron engine you wait on, the UI fights you, and the bug classes that win bounties now — request smuggling, race conditions, the modern-protocol stuff — feel bolted onto an architecture from another decade. I didn’t want a proxy with plugins stapled to it. I wanted the offensive tooling to be the product.
I wrote the engines myself
I’ll say the part that matters plainly: every engine in Hugin is mine, written from scratch in Rust. The scanner, the request-smuggling kit, the race-condition engine, the intruder, the out-of-band detection, the 169-tool MCP layer — I didn’t wrap someone else’s library and slap a UI on it. I built them.
Rust handed me the obvious wins: one native binary, sub-second start, low memory, no JVM warm-up, memory safety. But that’s the least interesting part. Writing the engines myself is what let me push them past the incumbents instead of just matching them on speed — more coverage, and attacks the older tools can’t reach without rebuilding their core. A few concrete places it shows:
- A real race-condition engine. Burp bolted the single-packet attack onto Repeater; Caido does a partial version. Hugin is built around a dedicated engine — single-packet attacks, last-byte synchronisation, and barrier coordination across requests. Timing attacks deserve more than a checkbox.
- Smuggling that keeps up with the protocols. CL.TE, TE.CL, TE.TE, H2.TE — plus gRPC and gRPC-gateway differential smuggling, which neither Burp nor Caido does at all. Modern desync lives at the protocol seams, so that’s where the engine sits.
- A scanner that’s free and honest. 46 active and 42 passive checks, with blind out-of-band detection across six protocols (DNS, HTTP, SMTP, LDAP, FTP, SMB) — in the free tier. Burp keeps its active scanner behind a $499-a-year licence and throttles Intruder in Community; Hugin runs both at full speed.
- Agent-native, not agent-bolted-on. Burp’s MCP is an add-on extension; Caido’s AI is plugin-scoped and paid-tier. Hugin is built to expose 169 MCP tools, driving the proxy, scanner, intruder and smuggler directly — so I can hand an agent the boring half and stay on the bug.
- Real sandboxing for community code. Extensions hook live traffic in Lua across 14 permission-gated hook points; heavier scanner modules — Synaps — compile to WASM and run in Wasmtime under a one-billion-instruction fuel cap and a 16 MB memory ceiling. Caido’s plugins run in a JavaScript runtime; mine can’t escape.
None of that is “Rust is fast” marketing. It’s coverage and design decisions the older tools can’t follow without tearing out their foundations — which is exactly why I wrote my own.
Where it doesn’t fit
It’s not a SAST tool and it won’t replace your CI gates. Community will be free with no time limit and useful on its own; the heavier kit — the full scanner, the smuggling and race engines, Synaps, Lua extensions, the 35 vurl offensive tools — will be Pro, a flat €7 a month against an anonymous numbered account. No email, no identity. The proxy gets you working; Pro is for when this is how you make a living.
If you live in a proxy all day, it’s built for you. If you want a security checkbox in your pipeline, it isn’t.
When it ships
Community will be the honest place to start — one binary, macOS or Linux, no account, nothing to configure. If it earns a place in your workflow, Pro will be there.