Brave Pentest Toolkit
An ambient, one-click pentesting toolkit built into the browser: a Brave/Chrome extension with a 31-tool catalog, live passive security scoring on every page, and a native-messaging host bridging to his own CLI security toolkit.
31
Tools in the catalog
2
Real bugs caught by testing
- 31-tool catalog across recon, web vulnerability, directory discovery, and network testing
- Passive A-F security score badge on every page, computed from real response headers
- Scope-gate enforcement lives in the native host, not the extension: verified adversarially, survives a full process restart
- Toolbar icon renders procedurally via OffscreenCanvas instead of shipping a static asset for every state combination
- Two real bugs caught by actually clicking through a live test harness, not just reading the code
Problem
Ambient, one-click pentesting needs to live in the browser without new tabs or lost scan state. Trust has to be enforceable, not just described in the UI.
Approach
The toolbar popup is front and center with live scan progress, backed by a side panel for scans worth keeping visible while working the page, both sharing one UI module kept in sync through storage events. Trust runs through a native-messaging host: a random token plus an ephemeral loopback WebSocket bootstrap the connection, and scope enforcement checks against a file on disk the extension can't override.
Outcome
A 31-tool catalog, a passive A-F security score computed from real response headers, and two real bugs (a scanner timeout race and a silently-broken disabled state) caught by actually clicking through a live test harness, not just reading the code.