Hacks and Hops

Blocks malicious websites from port-scanning your computer/network and dynamically blocks all LexisNexis endpoints from running their invasive data collection scripts.

CSP Evaluator is a tool that allows developers to check if a Content Security Policy (CSP) serves as mitigation against XSS attacks. This is a Firefox port of the Chrome extension

Monitors postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon. All credit goes to Frans Rosén.

MailFail identifies and provides commands to exploit a large number of email-related misconfigurations for the current domain and subdomain. The extension's UI popup highlights any misconfigurations in red and links to supporting documentation.

Passively identify JSONP endpoints as you browse with the ability to send suspected endpoints to an exploit server for validation.

Identify OAuth flows and vulnerabilities

Send client-side framents to the original domain and a .local sinkhole domain captured by Caido or Burp