Hacking Console Capture v1.1.0 — browser extension for recon, taint tracking & secrets detection

[discosecurity]

Console Capture — silently record everything a page does, for later analysis Open-source (MIT) browser extension for Chrome and Firefox — built for bug bounty hunting and web security research.

---

What it does Attach it, browse like normal, and open the viewer when you're done. Nothing leaves your browser — all data is kept in IndexedDB on the extension's own origin.

• Console logs — log / info / warn / error / debug / trace / assert / table / dir, each with file:line of where it fired.
• Uncaught errors — exceptions + unhandled promise rejections with full stack.
• Network errors — 4xx/5xx, CORS failures, DNS issues, blocked requests (via webRequest).
• JS surface recon — walks window., lists every exposed function with signature, source location and snippet. Flags interesting ones: URL/redirect-looking params, bodies containing fetch / XHR / innerHTML / eval / location — candidate SSRF / open-redirect / DOM XSS entry points. Re-sweeps on every SPA route change. [*]Runtime recon — localStorage, sessionStorage, cookies, NEXT_DATA, NUXT, Redux/Apollo state, window.env/config; postMessage sent + received with origin; every fetch / XHR / WebSocket / EventSource call (method, URL, body). [*]Taint tracking — hooks ~30 dangerous JS sinks. Type any value into a page input; the extension alerts when that exact value reaches innerHTML, eval, fetch, location.href, etc. Survives full page navigations. [*]Secrets detector — auto-detects JWT, AWS AKIA, GCP AIza, Stripe sk_live_, GitHub tokens, Slack xox, Bearer tokens, PEM keys, and keyword-based patterns (token=, apikey=, secret=). Regex is editable in the UI.

---

Why not just use DevTools? DevTools loses everything when the tab closes or crashes. Console Capture survives browser close/reopen and keeps logs across pages, so you can audit a 20-minute recon session in one view. It also maps the whole JS surface automatically, which DevTools does not.

---

Install

• Chrome / Edge / Brave: chrome://extensions → Developer mode → Load unpacked → pick the folder.
• Firefox 128+: about:debugging#/runtime/this-firefox → Load Temporary Add-on → pick manifest.json.

---

Download

MIT licensed. No telemetry. Nothing phones home. Built by discosecurity.