Web Explode

🧩 Decode (Cryptography): An offline, real-time encoder/decoder for URL, Base64, Hex, and HTML Entities. It features a built-in JWT payload debugger and asynchronous SHA-256/512 hash calculation.

🕵️‍♂️ Spy (Reconnaissance): Identifies the technology stack (Frameworks, CMS) of the active tab. Intercepts and analyzes HTTP response headers to highlight security misconfigurations (CSP, HSTS). Includes a default password database search.

🪓 Forge (Session & CSRF): Hunts for sensitive Tokens/JWTs in Local/Session Storage. Generates precision CSRF Proof-of-Concept forms from the DOM and attempts to bypass WAF configurations by injecting dynamic IP spoofing headers (X-Forwarded-For).

🐺 Hound (Secret Scanner): Fetches and analyzes client-side JavaScript files. Powered by a Service Worker backend to bypass strict CORS policies, it discovers forgotten secrets such as AWS keys, Stripe APIs, and JWTs using advanced regex patterns.

🧬 ProtoPulse (Prototype Pollution): [NEW] Automatically fuzzes active URL parameters and hashes with targeted canaries. Injects a DOM observer to detect and verify DOM-based Prototype Pollution vulnerabilities in real-time.