Browser extension

Chrome Bridge Extension

The IDOR Hunter Bridge extension captures API traffic from your Chrome browser and streams it to Vulnara for access-control testing. It only records traffic for the target you are scanning.

Download

Two ways to get the extension:

From the scan page: Start a new scan at /scans/new. If the extension is not detected, a download link appears automatically.
Direct download: Click the button below to download the extension zip file.

Download extension (.zip)

Install

Download and unzip idor-hunter-bridge-extension.zip.

Open chrome://extensions in Chrome.

Turn on Developer Mode (toggle in the top-right corner).

Click Load unpacked and select the unzipped idor-hunter-bridge-extension/ folder.

The extension appears in your extensions list. Make sure it is toggled on.

You only need to install once. The extension stays installed across Chrome restarts.

How it works

1.Start a new scan on /scans/new and enter a target URL.

2.The scan page opens a new tab pointing at the target, with a session ID in the URL.

3.The extension detects the session ID and connects to the Vulnara backend via WebSocket.

4.As you browse the target (log in, click around, trigger API calls), the extension intercepts every network request in scope and streams it to the backend.

5.The backend builds an API map from the captured traffic.

6.When you click "Done", the backend has all the endpoints it needs to run access-control tests.

flow

Your Chrome                         Vulnara backend
    |                                     |
    |--- browse target site ------------->|
    |    (extension captures requests)    |
    |                                     |
    |--- WebSocket: stream API calls ---->|
    |                                     |--- build API map
    |                                     |--- replay with User B token
    |                                     |--- detect access violations
    |                                     |
    |<-- findings report -----------------|

Scope enforcement

The extension only captures traffic for the target domain of the active scan session. It automatically filters out:

-Analytics and tracking (Google Analytics, Mixpanel, Segment, Hotjar)
-CDNs, fonts, and static assets (CSS, JS, images, fonts)
-Third-party services (Sentry, Intercom, Socket.io)
-Webpack dev server noise

When no scan session is active, the extension captures nothing.

Permissions

The extension requests the following Chrome permissions:

Permission	Why
webRequest	Intercept network requests to capture API traffic
cookies	Read session cookies for cookie-based auth targets
tabs	Detect the scan session tab and navigate to targets
scripting	Inject the content script for DOM interaction (clicks, form fills)
storage	Store the active session config locally
alarms	Keep the WebSocket connection alive with periodic keepalive pings

Troubleshooting

Problem	Fix
"Extension not detected" after 2 minutes	Make sure the extension is toggled on in chrome://extensions. Click Retry on the scan page.
WebSocket connection error	Check that vulnara.site is reachable. The extension connects to wss://vulnara.site/bridge-ws.
Extension installed but won't connect	Reload the extension in chrome://extensions (click the circular arrow icon). Then start a new scan.
Stale session from a previous scan	The extension auto-detects new sessions. If stuck, reload the extension and start a fresh scan.
No API calls captured	Browse the target more thoroughly. Log in, visit profile, settings, orders. Every page interaction generates API calls.

Getting started CLI reference