Hashlight

Hashlight is a extension designed for malware analysts, threat hunters, and researchers who need fast, accurate IOC extraction and analysis directly in the browser.

It scans web pages locally for Indicators of Compromise, detecting:

URLs and domains (including defanged forms like hxxp:// and example[.]com)

IPv4 addresses

File hashes: MD5, SHA-1, SHA-256

CVE identifiers

MITRE ATT&CK technique codes (T-codes)

Tools & Features:

Highlight & Copy — IOCs are highlighted in-page and can be copied individually or all at once from the popup.

Popup IOC Overview — A clean interface to browse, copy, share, or rescan detected IOCs.

External Integrations — With one click, open IOCs in VirusTotal or Censys for enrichment and deeper investigation.

Options Page — Manage disabled sites, toggle toolbar badge counts, enable/disable defanged IOC detection, and store preferences locally.

Local & Private — All detection is done locally in the browser. Data only leaves your machine if you choose to send an IOC to VirusTotal or Censys.

Site Controls — Disable scanning on selected sites or add exclusions directly from the options menu.

Database Support — Save and manage IOCs for future reference.

Hashlight reduces copy-paste effort, normalizes defanged indicators, and connects seamlessly with analysis tools — all without leaving Firefox.