Huntpad - The Bug Hunter's Notepad

Usr6 · May 6, 2018

Syhunt Huntpad is a notepad application with features that are particularly useful to penetration testers and bug hunters - a collection of common injection string generators, hash generators, encoders and decoders, HTML and text manipulation functions, and so on, coupled with syntax highlighting for several programming languages.

Huntpad borrows many features from Syhunt Sandcat's QuickInject sidebar. Like its cousin, it is focused on File Inclusion, XSS and SQL Injection and comes with the following options:

Syntax Highlighting - supporting HTML, JavaScript, CSS, XML, PHP, Ruby, SQL, Pascal, Perl, Python and VBScript.
SQL Injection functions
- Filter Evasion - Database-Specific String Escape (CHAR & CHR). Conversion of strings to quoted strings, conversion of spaces to comment tags or new lines
- Filter Evasion (MySQL-Specific) - String Concatenation, Percent Obfuscation & Integer Representation (eg: '26' becomes 'ceil(pi()*pi())*(!!!pi()+true)+ceil(@@version)', a technique presented by Johannes Dahse).
- UNION Statement Maker
- Quick insertion of common injections covering DB2, Informix, Ingres, MySQL, MSSQL, Oracle & PostgreSQL
File Inclusion functions
- Quick Shell Upload code generator
- PHP String Escape (chr)
Cross-Site Scripting (XSS) functions
- Filter Evasion - JavaScript String Escape (String.fromCharCode), CSS Escape
- Various handy alert statements for testing for XSS vulnerabilities.
Hash functions
- Hash Generators - MD5, SHA-1, SHA-2 (224, 256, 384 & 512), GOST, HAVAL (various), MD2, MD4, RIPEMD (128, 160, 256 & 320), Salsa10, Salsa20, Snefru (128 & 256), Tiger (various) & WHIRLPOOL
Encoders/Decoders
- URL Encoder/Decoder
- Hex Encoder/Decoder - Converts a string or integer to hexadecimal or vice-versa (multiple output formats supported).
- Base64 Encoder/Decoder
- CharCode Converter - Converts a string to charcodes (eg: 'abc' becomes '97,98,99') or vice-versa.
- IP Obfuscator - Converts an IP to dword, hex or octal.
- JavaScript Encoders - Such as JJEncode by Yosuke HASEGAWA
HTML functions
- HTML Escape/Unescape
- HTML Entity Encoder/Decoder - Decimal and hexadecimal HTML entity encoders & decoders
- JavaScript and CSS beautifiers
- JavaScript String Escape
Text Manipulation functions - Uppercase, Lowercase, Swap Case, Title Case, Reverse, Shuffle, Strip Slashes, Strip Spaces, Add Slashes, Char Separator
Time-Based Blind Injection code - Covering MySQL, MSSQL, Oracle, PostgreSQL, Server-Side JavaScript & MongoDB
CRC Calculators - CRC16, CRC32, CRC32b, and more.
Classical Ciphers - ROT13 & ROT[N]
Checksum Calculators - Adler-32 & Fletcher
Buffer Overflow String Creator
Random String & Number Generation functions
URL Splitter
Useful Strings - Math, character sets and more.