HackBar v3.0

A modern and powerful browser extension for web security testing. Designed for penetration testers and security professionals.

Requires: (Old Version Only)

1. Firefox version : firefox-47.0.linux-x86_64.sdk.tar.bz2 https://ftp.mozilla.org/pub/firefox/releases/47.0/
2. xpi file : advanced-hackbar.xpi

(New version)

1. load manifest.json on about:debugging in firefox as a temporary extension

Features

URL Manipulation

• Load the current browser URL
• Split URLs into individual parameters
• Execute requests with POST data and a custom Referer
• Request history

Encoding / Decoding

• URL Encoding: encode, decode, encode all characters
• Base64: encode / decode
• Hex: string to hex, hex to string
• HTML: entity encoding / decoding
• Unicode: encode / decode
• SQL Character Conversion: MySQL CHAR(), MSSQL CHAR(), Oracle CHR()

Hashing

• MD5
• SHA1
• SHA256
• SHA512

SQL Injection Payloads

Union-Based

• Basic UNION with numeric values
• UNION with NULL values
• ORDER BY to identify column count

Error-Based

• Basic errors using FLOOR / RAND
• Database name extraction
• Database version extraction

Boolean-Based

• True / false conditions
• Substring-based data extraction

Time-Based

• MySQL SLEEP()
• MSSQL WAITFOR DELAY
• PostgreSQL pg_sleep()

Information Schema

• Database version
• List databases
• List tables
• List columns

WAF Bypass

• MySQL comments
• Version-specific comments
• Case manipulation
• Double URL encoding

XSS Payloads

Basic

• Alert box
• IMG tag with onerror
• SVG tag with onload

Advanced

• DOM-based XSS
• Stored XSS
• Reflected XSS

Bypass Techniques

• Scriptless payloads
• Encoded payloads
• Universal polyglot payloads

Other Payloads

File Inclusion

• Basic LFI (../../../../etc/passwd)
• LFI with null byte
• PHP wrappers
• Basic RFI

Command Injection

• Semicolon (;)
• Pipe (|)
• AND (&&)
• OR (||)

Installation

Firefox

1. Open Firefox
2. Go to about:debugging#/runtime/this-firefox
3. Click Load Temporary Add-on
4. Select the manifest.json file

Chrome / Edge

1. Open chrome://extensions/ or edge://extensions/
2. Enable Developer mode
3. Click Load unpacked
4. Select the extension folder

Usage

Quick Access

• Click the HackBar icon in the browser toolbar
• Keyboard shortcut:
  • Windows / Linux: Ctrl + Shift + H
  • macOS: Cmd + Shift + H

Basic Workflow

1. Load URL: Click Load URL to import the current page URL
2. Manipulate: Select text in the textarea and apply encodings or payloads
3. Execute: Click Execute to navigate to the modified URL

Text Selection Behavior

• If text is selected, operations apply only to the selection
• If no text is selected, operations apply to the entire content

POST Requests

1. Enable the POST Data section
2. Enter parameters using the format:
   param1=value1&param2=value2
3. Click Execute

Custom Referer

1. Enable the Referer section
2. Enter the desired referer URL
3. Click Execute

Architecture

hackbar-extension/
├── manifest.json           # Extension configuration
├── background.js           # Main service worker
├── config/
│   └── payloads.js        # Centralized payload configuration
├── utils/
│   └── encoding.js        # Encoding and hashing utilities
├── popup/
│   ├── popup.html         # Popup UI
│   ├── popup.css          # Modern styling
│   └── popup.js           # Popup logic
└── icons/                 # Extension icons

Core Components

config/payloads.js

Centralized configuration for all payloads with a modular structure:

PayloadConfig = {
  sql: {
    union: { ... },
    errorBased: { ... }
  },
  xss: { ... },
  fileInclusion: { ... }
}

utils/encoding.js

Encoding, decoding, and hashing utilities:

• EncodingUtils.urlEncode()
• EncodingUtils.base64Encode()
• EncodingUtils.md5()
• etc.

background.js

Service worker responsible for:

• Popup communication
• Payload generation
• URL manipulation
• Application state management

popup/popup.js

User interface logic:

• Tab system
• Event listeners
• Textarea updates
• Notifications

Adding New Payloads

Method 1: Edit config/payloads.js

PayloadConfig.sql.myNewCategory = {
  myPayload: {
    name: 'My Custom Payload',
    description: 'Description of what it does',
    generate: (param1, param2) => {
      return `PAYLOAD WITH ${param1} AND ${param2}`;
    }
  }
};

Method 2: Add a Button to the Popup

<button class="btn btn-payload"
        data-action="sql"
        data-payload="myNewCategory.myPayload">
  My Payload
</button>

Method 3: Runtime Dynamic Payload

// In popup.js, handlePayloadClick()
case 'myCustomAction':
  const customPayload = generateMyCustomPayload();
  updateTextArea(textarea, customPayload);
  break;

Customization

Change Colors

Edit CSS variables in popup/popup.css:

:root {
  --primary-color: #667eea;
  --secondary-color: #764ba2;
  --success-color: #48bb78;
}

Add New Tab Categories

1. Add the tab button in popup.html:

<button class="tab-btn" data-tab="mytab">My Tab</button>

2. Add the tab content:

<div class="tab-pane" id="tab-mytab">
  <!-- Content -->
</div>

Contributing

Commit Structure

• feat: New features
• fix: Bug fixes
• docs: Documentation changes
• style: Styling changes
• refactor: Code refactoring

Workflow

1. Fork the project
2. Create a feature branch
3. Commit your changes
4. Push to your branch
5. Open a Pull Request

Usage Examples

Example 1: Basic SQL Injection

URL: http://example.com/page?id=1
1. Load URL
2. Select the "1" after id=
3. Click "Union Basic"
4. Click "Execute"

Example 2: XSS Testing

1. Enter payload: <script>alert(1)</script>
2. Click "URL Encode"
3. Copy the result
4. Paste into a URL parameter

Example 3: WAF Bypass

1. Input: SELECT * FROM users WHERE id=1
2. Select all text
3. Click "MySQL Comments"
4. Result: /*!SELECT/**/FROM/**/users/**/WHERE/**/id=1*/

Disclaimer

This tool is intended for authorized security testing and educational purposes only. Unauthorized use against systems without explicit permission is illegal. The authors are not responsible for misuse.

License

MIT License — see the LICENSE file for details.

Bug Reports

When reporting a bug, please include:

• Issue description
• Steps to reproduce
• Expected vs actual behavior
• Screenshots (if applicable)
• Browser and version information

Roadmap

• Payload history
• Export / import configuration
• Custom payload templates
• Burp Suite integration
• Dark / light mode
• API payloads (JSON, XML)
• Wordlist generator
• Basic fuzzing