Web Explode EN

Name: Web Explode
Rating: 5.0 (2 reviews)
Author: macallan

macallan · Firefox

Ultimate Pentest Suite — Payload injection, encoding, recon, session manipulation, and JS scraping.

5.0/5 2 人评分 24用户 v3.0.0当前版本

前往 Firefox 商店

权限提示 该扩展申请访问所有网站（<all_urls>），意味着它可以读取你在任意站点的页面内容，包括已登录的页面。这是许多扩展正常工作的必要条件，但也值得你确认来源可信。

截图

简介

WebExplode is an advanced, all-in-one browser extension designed for pentesters, bug bounty hunters, and security researchers. Completely rebuilt on a modern Manifest V3 ES Module architecture, it combines 7 powerful modules into a single suite, turning your browser into a standalone security testing laboratory.

Complete Privacy & Security: The extension has zero external dependencies, strictly avoids unsafe DOM manipulations (zero innerHTML), and never transmits user data to an external server. All scanning, fuzzing, and cryptography operations are executed 100% locally in your browser.

The Arsenal (Included Modules):

🐍 Venom (Payload Injector): Injects XSS, SQLi, LFI, and SSRF payloads directly into input fields. Uses smart injection techniques (native prototype setters) to bypass synthetic event traps in frameworks like React and Vue. Easily accessible via a right-click context menu.


🧩 Decode (Cryptography): An offline, real-time encoder/decoder for URL, Base64, Hex, and HTML Entities. It features a built-in JWT payload debugger and asynchronous SHA-256/512 hash calculation.
🕵️‍♂️ Spy (Reconnaissance): Identifies the technology stack (Frameworks, CMS) of the active tab. Intercepts and analyzes HTTP response headers to highlight security misconfigurations (CSP, HSTS). Includes a default password database search.
🪓 Forge (Session & CSRF): Hunts for sensitive Tokens/JWTs in Local/Session Storage. Generates precision CSRF Proof-of-Concept forms from the DOM and attempts to bypass WAF configurations by injecting dynamic IP spoofing headers (X-Forwarded-For).
🐺 Hound (Secret Scanner): Fetches and analyzes client-side JavaScript files. Powered by a Service Worker backend to bypass strict CORS policies, it discovers forgotten secrets such as AWS keys, Stripe APIs, and JWTs using advanced regex patterns.
🧬 ProtoPulse (Prototype Pollution): [NEW] Automatically fuzzes active URL parameters and hashes with targeted canaries. Injects a DOM observer to detect and verify DOM-based Prototype Pollution vulnerabilities in real-time.

🔭 WebGraph (GraphQL Inspector): [NEW] Passively discovers hidden GraphQL API endpoints (/graphql, /api/graphql). Executes Introspection queries to extract and map the complete schema, breaking down exposed Queries, Mutations, and Subscriptions.

Web Explode 是做什么的

Web Explode 是一款面向 Firefox 的开发者工具类扩展，主要用来调试页面、查看样式与请求、测试接口、辅助前端开发。官方对它的介绍是：Ultimate Pentest Suite — Payload injection, encoding, recon, session manipulation, and JS scraping.在Firefox 附加组件商店（AMO）上，它当前版本 3.0.0，评分 5（2 人评价），约 24 名用户。

适合什么人用

从功能定位看，Web Explode 更适合前端工程师、测试与需要经常查看页面结构的用户。如果你平时只是偶尔遇到相关需求，用浏览器自带功能也能凑合；但如果这件事每天都发生，装一个专门处理它的扩展通常比手动操作省事得多。需要注意的是它作用于所有网站，装上后建议先观察一两天，确认不影响常用站点的正常使用。

怎么安装 Web Explode

打开Firefox 附加组件商店（AMO）上的官方页面；
点「添加到浏览器」并确认权限提示；
装好后在扩展列表里固定图标，方便随时开关。

本站只做索引与介绍，安装包来自官方商店。如果商店页面提示当前地区不可用，说明该扩展未在你所在区域上架。

常见问题

Web Explode 是免费的吗？

Web Explode 在Firefox 附加组件商店（AMO）免费提供下载。它是浏览器扩展，装上就能直接用，不需要注册账号。

Web Explode 安全吗？

它只申请了 0 项权限，范围比较克制，没有申请「读取所有网站数据」这种大权限。

Web Explode 支持哪些浏览器？

当前收录的版本来自Firefox 附加组件商店（AMO），适用于 Firefox。同一个扩展在其他商店可能有对应版本，但功能与版本号不一定相同。

怎么卸载 Web Explode？

在扩展管理页找到 Web Explode，点移除即可。它在本地保存的设置会一起清掉，不会残留数据。

权限清单来自 manifest.json 原文

站点访问 1

<all_urls>

接口权限 9

activeTab
contextMenus
declarativeNetRequest
declarativeNetRequestWithHostAccess
devtools
scripting
storage
tabs
webRequest

标签点标签看同类扩展

搜索增强用户脚本网页存档