HydraSocket logo

HydraSocket

A Chrome extension and standalone native host that turns your browser into a 39-tool network security console: raw sockets, port and network scanners, a full HTTP workbench, an intercepting proxy, database and cloud browsers, recon, and engagement reporting — all for authorized testing.

Download EXE Windows Installer Extension ZIP Read the Manual

39 tools in one console

A complete engagement toolkit organized into seven workspaces — from raw sockets to reporting. No extra tools required.

💼

Engagement & reporting

  • Dashboard — severity mix, trend, status and the hosts that need attention.
  • Engagement — scope, client, authorization and notes saved as one portable project file.
  • Auto Assess — one click chains a port scan, TLS audit, header grade, CVE lookup, checks and default-credential tests.
  • Templated Checks — vulnerability checks defined as data; matches become findings with evidence.
  • Automation Rules — triggers run actions: notify, call a webhook, auto-assess or update findings.
🌐

Network & protocols

  • TCP & UDP clients — raw sockets: connect, stream, send and receive datagrams.
  • Port & Network Scan — concurrent scans with banner grab, deep probing and nmap-style flags (-Pn, -O, -A).
  • Service Explorer — identify services, versions and shares behind open ports.
  • HTTP Workbench — raw requests, Hydra fuzzer, sequencer, comparer, WebSocket, JWT, encoder and smuggling tests.
  • MITM Proxy — intercept HTTPS, edit and replay, match-and-replace, breakpoints.
  • Listener, Pivot & Tunnel — bind ports, run a SOCKS5 proxy and port-forwards to reach segmented networks (authorized).
  • FTP, SSH, SMB, Mail, MQTT, Modbus — clients for files, an interactive shell, shares, mail and IoT/ICS.
🔎

Recon, TLS & DNS

  • Recon suite — subdomains (CT logs + brute), security-header grade, site spider, WHOIS/ASN, CVE lookup, WAF detect, subdomain takeover.
  • TLS / Certs — certificate chain, negotiated cipher and TLS-version enumeration, with weak-config flags.
  • DNS Toolkit — every record type, reverse sweeps, DNS-over-HTTPS, custom resolvers and AXFR zone transfers.
🗄

Data & directory

  • Databases — SQLite, PostgreSQL, MySQL, SQL Server, MongoDB, Redis and Elasticsearch: browse objects and run queries.
  • Cloud (S3) — AWS and S3-compatible stores (MinIO, Wasabi, R2); list buckets, browse and preview objects.
  • LDAP — bind and search directory and Active Directory trees.
  • SNMP — walk OID trees on network devices.
📋

Analysis

  • Findings — the central record; export to JSON, Markdown, SARIF, Jira CSV or GitHub Issues, with a kill-chain view.
  • Topology — a visual map of discovered hosts, exportable as SVG.
  • Diff Scanner — compare two scan runs to spot infrastructure changes.
  • PCAP Viewer — open or capture packets; protocol stats, stream reassembly, DNS/HTTP views and a geographic map.
🛠

Web & crypto tools

  • Encoder / Crypto — chained encode, decode, hash and encrypt transforms.
  • GraphQL Explorer — introspect schemas and run queries.
  • Injection Scanner — checks for SQLi, XSS, SSTI, command injection, LFI and open redirect.
  • Secrets Scanner — crawl a page and its JavaScript for exposed keys and tokens (redacted).
  • Credential Tester — check default and common credentials against discovered services.
🛡

Local & system

  • Attack Surface — local listening ports with the owning process, a secret-file scan, file hashing and network config.
  • Host Log — a live log stream from the native host process.
  • Config — file paths, webhooks, the shared auth vault, update checks and the audit log.

Read the operator manual

Every page, tab and feature documented — step-by-step guides, a reference for all 586 fields and buttons, and a screenshot of each tool.

Open the Manual

Architecture

The extension owns no network capability — it is a pure relay. All networking lives in the native host.

Chrome Extension ──── Native Messaging (stdio) ──── HydraSocket.exe
│ UI pages (HTML/CSS/JS)                                        │ Node.js runtime
│ externally_connectable:                                      │ Raw TCP/UDP sockets
│   localhost / 127.0.0.1 only                                 │ TLS / DNS / HTTP
│ No network permissions                                       │ DB drivers (bundled)
│ JSON relay only                                             │ Allow-list gated

Framing: [uint32 LE length][UTF-8 JSON] over stdio
Build:   esbuild bundle → Node SEA → postject inject → standalone EXE
Install: HydraSocket.exe --install → copies to %LOCALAPPDATA%, registers Chrome + Edge

Installation

One EXE, two minutes. Works on Windows with Chrome or Edge.

Download the EXE

Grab HydraSocket.exe from this page. It's a standalone Node.js binary with all dependencies bundled — no npm install needed.

Install the native host

Run HydraSocket.exe --install in a terminal. This copies the binary to %LOCALAPPDATA%\HydraSocket\ and registers native messaging for Chrome and Edge.

Load the extension

Extract the extension ZIP, open chrome://extensions, enable Developer mode, click "Load unpacked", and select the extracted folder.

Test the connection

Click the HydraSocket icon in Chrome's toolbar, then hit "Test". You should see a green checkmark confirming the native host is connected.

Live packet capture. The PCAP Viewer's Live Capture captures real traffic and runs with a one-time Windows admin/UAC prompt. It uses the best tool available: pktmon (built into Windows 10/11 — no install, captures all NICs) by default, or Npcap + Wireshark's dumpcap for per-interface / all-interface capture with BPF filters. (WinDump is legacy and won't load on modern Windows — use pktmon or dumpcap.) Everything else works without any of this, including opening .pcap/.pcapng files you already have.
For authorized testing only. HydraSocket is designed for security professionals to test systems they own or have explicit authorization to test. Unauthorized access to computer systems is illegal. The developers assume no liability for misuse.