NetScopeDetector

NetScope is a browser research toolkit for security, privacy, network, and fingerprint analysis.

It helps technical users understand what a website can actually observe about their browser by inspecting network activity, security signals, HTTP headers, local network behavior, and browser fingerprint surfaces. NetScope is an HTTP inspector and security-signal panel for researching how websites probe your browser and local network. It observes requests and fingerprint-related APIs, then helps you judge what happened from evidence — without assuming intent.

Built around the principle:

Measure, don't assume.

NetScope is designed for security researchers, privacy researchers, developers, QA engineers, browser fingerprinting specialists, and other technical users who need detailed browser-level information rather than simplified privacy scores.

Inspect browser network activity in real time, including:

• Request URLs
• HTTP methods
• Response status codes
• HTTP headers
• Request context
• Cookies and other request-related information

View network requests, security signals, and browser errors in a chronological activity timeline.

This makes it easier to correlate events and understand what happened during a browsing session.

Investigate security-related signals and browser fingerprint surfaces with additional forensic context.

NetScope is designed to provide technical observations rather than simply labeling a browser as "safe" or "unsafe."

Add or modify outgoing HTTP request headers to research how different headers affect browser and server-side observations.

This can be useful for testing HTTP Client Hints, request metadata, privacy configurations, and browser identification behavior.

Investigate local ports and browser-to-network interactions to better understand the local network surface exposed to websites.

• Canvas — drawing/read chains (fillText, drawImage, getImageData, toDataURL / toBlob, and related calls), grouped as Canvas activity with evidence-based classification (possible / likely / ordinary usage, and similar)
• WebGL — context access, parameters, extensions, unmasked vendor/renderer and related returns; stages such as capability detection, GPU identification, collection, and transmission confidence (including when transmission is not observed)
• User-Agent Client Hints — low- and high-entropy UA-CH values in Chromium environments
• HTTP Client Hints — relevant Sec-CH-* request/response hint patterns
• Navigator plugins & MIME types — navigator.plugins, navigator.mimeTypes, and related harvest patterns
• WebGPU — adapter info fields such as vendor, architecture, device, and description
• SpeechSynthesis — voice-list access via speechSynthesis.getVoices()
• MediaDevices — enumerateDevices() and related media-device probing
• Additional probes — audio, WebRTC, fonts, display/hardware, permissions, geolocation, storage estimates, and other catalog detectors where enabled

Also included:

• Live HTTP request inspection in the side panel
• Local-network / localhost probe alerts
• Triggering-script capture for JS-hook signals (caller URL, stack, optional source preview)
• Investigation reports with observed facts, supporting evidence, missing evidence, and network correlation notes (request bodies are not collected)

NetScope reports observations and confidence. A single API call is not treated as proven fingerprinting; transmission is stated only when evidence supports it.

NetScope distinguishes between different implementation states instead of treating every fingerprint surface as simply "supported":

• Implemented
• Partially supported
• Native fallback
• Unsupported

This helps researchers determine whether a browser property is actually controlled, partially modified, or still provided by the browser's native implementation.

A browser fingerprint is not a single value.

Websites can observe information through multiple APIs and communication layers. Changing one property does not necessarily make the rest of the browser environment consistent.

For example, a browser may expose modified WebGL information while another API continues to reveal native hardware characteristics.

NetScope helps researchers examine these surfaces individually and investigate cross-surface consistency.

NetScope can be useful for:

• Browser security research
• Privacy and anti-fingerprinting research
• Web application testing
• Network debugging
• QA and browser compatibility testing
• Browser automation research
• Digital forensics
• Investigation of local network exposure

NetScope is not an antivirus, EDR, SIEM, or complete anonymity solution.

It does not claim to eliminate browser fingerprinting or guarantee online anonymity.

Its purpose is to provide technical visibility into browser behavior so users can measure, investigate, and understand what their browser exposes.

NetScope is available for Mozilla Firefox and is designed for technical users who want deeper visibility into browser network activity, security signals, and fingerprint surfaces.

Measure, don't assume.