# Tracy

> A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.

Canonical page: [https://chrome-stats.com/d/tracyplugin](https://chrome-stats.com/d/tracyplugin)

## Overview

- **ID:** `tracyplugin`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** Jake Heath
- **Category:** web-development,privacy-security
- **Daily users:** 6
- **Weekly downloads:** 1
- **Rating:** 5.00 / 5 (4 ratings)
- **Version:** 0.9.2
- **Last updated:** 2021-05-21
- **First published:** 2018-04-06
- **Size:** 911 KB
- **Data as of:** 2026-09-05
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/tracyplugin/)
- **Website:** [https://github.com/nccgroup/tracy](https://github.com/nccgroup/tracy)

## Description

Tracy is a Firefox add-on designed to assist with finding all sinks and sources of a web application, providing insights into potential XSS vulnerabilities. It helps penetration testers identify input sources, follow input to sinks, and document risky input locations.

## Rankings

- #39,948 — Overall

## Permissions and access

### Permissions

- `<all_urls>`
- `storage`
- `webRequest`

### Content script matches

- `<all_urls>`

## Safety

- **Risk impact:** High risk impact
- **Risk likelihood:** Low risk likelihood

### Analysis details

- Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [DOM XSS Highlighter — Pro](https://chrome-stats.com/d/dom-xss-highlighter-pro) — 4 users
- [XSSpect](https://chrome-stats.com/d/xsspect) — 48 users
- [XSS Finder](https://chrome-stats.com/d/xss-finder) — 8 users
- [KNOXSS Community Edition](https://chrome-stats.com/d/knoxss-community-edition) — 258 users, 4.00 / 5
- [Sink Hooker](https://chrome-stats.com/d/sink-hooker) — 1 users
- [XSnare](https://chrome-stats.com/d/xsnare)
- [XSS Detector](https://chrome-stats.com/d/xss-detector) — 2 users
- [XSS Finder ext](https://chrome-stats.com/d/xss-finder-ext) — 3 users
- [HackTools](https://chrome-stats.com/d/hacktools) — 1,623 users, 4.70 / 5
- [JS Recon Buddy](https://chrome-stats.com/d/js-recon-buddy) — 167 users, 5.00 / 5
- [XSSRush](https://chrome-stats.com/d/xssrush) — 27 users, 4.00 / 5
- [Web Explode](https://chrome-stats.com/d/web-explode) — 17 users, 5.00 / 5

---

Source: [Chrome-Stats](https://chrome-stats.com/d/tracyplugin)