What's inside Hugin
A proxy, scanner, fuzzer, race tooling, out-of-band detection, recon, and AI in one memory-safe Rust binary that speaks HTTP/1.1 through HTTP/3 and post-quantum TLS.
Hugin packs the whole toolkit into a single memory-safe Rust binary. The intercepting Proxy, the Scanner, Intruder, Repeater, RatRace, Decoder, Sequencer, Comparer, a built-in browser, out-of-band detection, recon, and the AI surface are all the same program. The Scanner's 55 active and 48 passive checks are free in Community, not a paid scan engine.
The same binary runs three ways: a desktop GUI when you launch it with no arguments, headless on a box with no screen, or a command-line tool you can script into a pipeline.
Modern and emerging protocols
Hugin reads the traffic targets actually send, including the parts most proxies skip.
Intercepted by default. h2 pseudo-headers are kept, so smuggling and desync tests work on HTTP/2 the same as HTTP/1.
Compiled in — switch it on in the config and captured flows are tagged HTTP/3.
Every frame captured in both directions, including over HTTP/2.
Upstream presents a real Chrome handshake with the X25519MLKEM768 group, so a target running post-quantum key exchange still sees a believable client.
As targets adopt HTTP/3 and post-quantum crypto, the interception you rely on keeps working. See protocols and TLS.
Reaches defended targets
Much of the surface worth testing sits behind something that drops anything not shaped like a real browser — a WAF, a bot manager, a JavaScript challenge. Getting through is built into the binary, not bolted on after.
Hugin connects with a genuine Chrome TLS handshake — JA3/JA4, the HTTP/2 SETTINGS, GREASE, the post-quantum key share — under a device profile that holds together, so a target scoring how you connect reads Chrome, not a script. See fingerprint evasion.
When a defence only clears once its script runs, drive Hugin's built-in browser through the page, then carry the session it earns back to Repeater and the Scanner at HTTP speed.
Driven by an AI agent
Every tool is callable by an AI agent. Hugin speaks MCP over stdio, so opencode, Cursor, or Codex can read flows, run the Scanner, and send requests through Repeater and Intruder — the same tools you drive by hand. It also has a built-in Copilot and Autopilot — a context-aware chat, plus autonomous Explore and Auto runs that work a goal step by step and send nothing without your approval.
Proof, not guesses
A finding should arrive with the evidence. The Scanner traces a value from where you inject it to where it lands, and confirms blind bugs with an out-of-band callback. A reflected parameter is reported when it reaches a sink, not because it matched a pattern — fewer false positives to triage.
Yours to extend
You don't wait for a release to add a check. Write a Lua extension to hook the proxy and rewrite traffic in flight, or install a Synaps WASM module to add a scanner check. Both run sandboxed, so someone else's module never runs native code on your box.
The web keeps moving — new transports, new crypto, agents in the loop. Hugin tracks it: it speaks the protocols as targets adopt them, an agent can drive every tool, and you add your own checks without a new build.