One native Rust binary that covers the whole hunt: intercept, scan, fuzz, smuggle, race, and prove — with a
self-hosted out-of-band server and an AI agent that drives every engine. Community is free forever; Pro is a
flat €10/month.
Intercept, inspect, and rewrite traffic over HTTP/1, HTTP/2, HTTP/3 and WebSocket.
The proxy is the core of Hugin, not a bolt-on. Every request and response is captured into a searchable history you can filter, replay, and tamper with. It runs over HTTP/1.1, HTTP/2, HTTP/3 and WebSocket, and terminates TLS with your own CA so you see plaintext.
HTTP/1.1, HTTP/2, HTTP/3 and WebSocket interception
Built-in CA management and per-host TLS settings
Match/replace rules for scoped tampering
Full request/response history with filters and scope
Vulnerability scanner
64+ active and 48 passive checks, in the box, in every tier.
Hugin ships an active and passive scanner. The checks cover the classes that matter on real targets — injection, access control, SSRF, and the protocol-level bugs most scanners miss — and it runs against the scope you define. It is in the free Community tier, not behind a paywall.
64+ active and 48 passive checks
Injection, access control, SSRF, and desync classes
Scope-aware: only scans what you authorise
Findings with request/response evidence
Out-of-band (OAST) server
Your own OOB server on eight protocols, self-hosted, for blind bugs.
Blind SSRF, blind RCE, blind SQLi, and log4shell-class bugs only show up via out-of-band interaction. Hugin runs its own OAST server on your machine across DNS, HTTP, HTTPS, SMTP, LDAP, FTP, SMB, and raw TCP. Callbacks land on infrastructure you control, not a vendor cloud you pay credits to.
Blind SSRF, RCE, SQLi, and deserialization detection
Interaction log with full callback detail
Request smuggling engine
CL.TE, TE.CL, TE.TE, H2.TE plus gRPC-gateway differential smuggling.
Modern desync lives at the protocol seams. Hugin has a first-class request-smuggling engine that probes CL.TE, TE.CL, TE.TE, and H2.TE variants, plus server-side differential checks including gRPC-gateway desync — a seam most tools do not test at all.
CL.TE, TE.CL, TE.TE, H2.TE
HTTP/2 downgrade and H2C smuggling
gRPC-gateway differential smuggling
Detects front-end/back-end parser disagreements
Race-condition engine
A dedicated single-packet race engine, not a Repeater bolt-on.
Race conditions need requests to land together, not sequentially. Hugin has a dedicated race engine that fires a single-packet attack to defeat the timing window — the technique that turns "unexploitable" check-then-act logic into a proven finding.
Single-packet attack for last-byte synchronisation
Parallel request fan-out for multi-endpoint races
Timing analysis and response diffing
Check-then-act and rate-limit bypass testing
Intruder & fuzzer
Sniper, pitchfork, cluster-bomb and battering-ram at full speed in every tier.
Hugin ships a full Intruder with the attack types you expect — Sniper, pitchfork, cluster-bomb, battering-ram — plus payload processing and grep-match on responses. It runs at full speed in the free tier, with no artificial throttling.
Sniper, pitchfork, cluster-bomb, battering-ram
Payload processing and encoding rules
Grep-match and response diffing
No throttling in Community
Repeater
Tamper and replay a single request with full control.
The Repeater is built for manual exploitation: edit any part of a request, resend, and compare responses side by side. It integrates with the smuggling and race engines so the interesting cases go straight from manual poking to a proven attack.
Full request/response editing
Side-by-side response comparison
One-click hand-off to smuggling / race engines
Tabbed sessions per target
AI agent & MCP
174+ MCP tools; an agent that reads every flow and drives the engines.
Hugin exposes 174+ MCP tools, so an agent can drive the proxy, scanner, Intruder, smuggler and race engine directly — read flows, form a hypothesis, and run the attack. The agent layer runs over the same local data, with no account and no telemetry.
174+ MCP tools across every engine
Agent reads captured flows and proposes attacks
Drives proxy, scanner, Intruder, smuggler, race
Local-first — no account, no telemetry
Extensions (sandboxed)
Lua hooks and WASM modules under a fuel cap — extensions that cannot escape.
Extensions hook live traffic in Lua across permission-gated hook points. Heavier scanner modules compile to WASM and run inside Wasmtime under a one-billion-instruction fuel cap and a 16 MB memory ceiling. Third-party code runs, but it does not get the run of your machine.
Lua hooks across permission-gated hook points
WASM modules in Wasmtime with a fuel cap
16 MB memory ceiling per module
Safer than full-JVM or unsandboxed-JS plugin runtimes
Testing guides
How to test the bug classes Hugin is built for — the method, not the marketing.