Dark
Request a walkthrough
On this page
Developer overview

Hunter browser extension

noxtica Hunter is a browser extension that shows which scripts on one web page you choose to audit read your browser’s fingerprint-related features, such as canvas, WebGL, audio, navigator and screen properties, fonts and timing. The analysis runs on your device.

Developers, security reviewers and privacy teams use it. You start every audit by hand. Sharing a report with your Noxtica workspace is a separate, optional step that is off by default.

Key points

  1. You start every auditHunter observes one page, only after you press Start audit or Quick look, and gives the site access back when the audit ends.
  2. A report is advisoryHunter observes from inside the page, so a page can interfere. Treat a rating or risk score as a signal, never as evidence of intent.
  3. Sending is optional and offSome builds can send one previewed report to your workspace after you turn sending on and paste a token. A build without it makes no upload.
  4. Local reports expireSaved reports stay in extension storage for 30 days, up to 50 reports, and you can delete them at any time.
  1. What it is
  2. Prerequisites
  3. Steps
  4. Verify it works
  5. Troubleshooting
  6. Related
How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

What it is

Availability: depends on your organisation and the modules enabled for it; ask your account team.

Hunter is not an automatic scanner. Nothing is observed until you press Start audit or Quick look for the current tab. This page describes the extension as built from source. How your organisation receives a build, and for which browsers, is arranged with your account team.

What an audit gives you

  • A rating: the share of fingerprint features the page touched, compared with published thresholds. The thresholds are marked Provisional until they are calibrated, so read the level as indicative.
  • A risk score from 0 to 100 with a level (low, medium, high or critical) and the reasons behind it.
  • Detections by feature area, with the calling script for each API.
  • Vendors recognised from script addresses, code patterns and network traffic.
  • Script sources, marked first party or third party.
  • Network findings: requests whose payload looked like fingerprint data. Hunter keeps field names and keywords, never values.
  • Bot-signal observations and Environment context labels (for example a privacy browser or developer tools) that explain why a reading may look unusual.

The report page says it is advisory: Hunter observes from inside the page, and a page can interfere with what it sees. Treat a report as a signal, never as evidence of intent.

Two ways to run

ModeWhat happensLimit
Start auditAsks once for access to that one site, reloads the page so it sees every call from the start, records until the timer ends or you press Stop, then gives the access backDefault 30 seconds; whole seconds from 1 to 600
Quick lookNo permission prompt and no reload; records from now onCalls made before you pressed the button are missed (“Late attach”)

Hunter audits only http and https pages. It refuses to instrument a page that already runs the Noxtica SDK, so it cannot interfere with that page’s integrity signals. Only one audit can run at a time.

Permissions

PermissionWhy
activeTabLets Quick look run on the current tab after you click the extension
scriptingInstalls the observer in the one origin you chose and removes it when the audit stops
storageKeeps audit state, your preferences and the reports you save
sidePanelShows the live view and report next to the page
Optional host access to http://*/* and https://*/*Requested at run time for one origin at a time, on your click

The extension declares no static host permission and no always-on content script. It does not request tabs, webRequest, debugger, cookies or history. The minimum Chrome version is 116.

What is recorded and what is not

The About page states that Hunter records which APIs were called, how often and by which script address (origin and path only). It states that Hunter never records values: no pixels, text, coordinates, clipboard or storage contents, and no request bodies. Reports are kept only if you save them: up to 50, for 30 days, in the browser’s extension storage. You can delete one report or all of them at any time.

For how Noxtica handles data in general, see Privacy and Security.

Optional: send one report to your Noxtica workspace

Some builds can send a report you choose to your organisation’s Noxtica workspace. This is off by default and never automatic. A build without this feature shows no upload control and says “This build does not upload anything”.

Sending needs all of the following:

  1. You turn sending on in Options and allow the browser to give Hunter access to the Noxtica ingestion endpoint (https://ingest.noxtica.com).
  2. A workspace administrator has created a short-lived upload token in Backoffice and you have pasted it into Hunter.
  3. You press Send on a specific report after you have seen a preview of the exact JSON.

What is sent: the report you previewed, which holds the origin and path of the audited page and of its scripts, API names and counts, and a vendor and risk summary. Query strings and fragments are removed when the report is built, and the ingestion endpoint refuses a report that still contains one. What is never sent: cookies, page content, keystrokes and API argument values. If a path itself contains a name or other identifier, it is part of the report, so read the preview before you press Send.

The token names your organisation and the administrator who created it. Every report sent with it is stored under that organisation and linked to that administrator. The token is kept in the browser’s session storage for that session and used for nothing else. Reports are stored in the EU and kept for 30 days; administrators can remove them sooner in Backoffice. See Hunter reports in Backoffice.

Prerequisites

  • A Hunter build from your account team, in a Chromium-based browser at version 116 or later.
  • A normal website (http or https) open in a tab. New-tab pages, chrome://, about: and browser store pages cannot be audited.
  • For sending reports: a build that includes sending, a workspace administrator with the Hunter Reports page available (see the Backoffice page), and permission to let the extension reach https://ingest.noxtica.com.

Steps

1. Run an audit

  1. Open the website you want to audit in a tab.
  2. Click the Hunter icon in the toolbar. If you cannot see it, open the extensions menu and pin Hunter.
  3. Optionally set Audit length (seconds).
  4. Press Start audit and accept the browser prompt for access to that site. The page reloads.
  5. Use the page normally. Press Stop when you are done, or wait for the timer.

For a quick read without a reload, press Quick look instead.

2. Open the report

Press View report in the popup or Open side panel. The report page has the sections Summary, Risk and rating, Detections, Vendors, Script sources, Network, Bot-signal observations, Environment context, Spy health, Frames and Errors.

Open the Hunter panel in the browser developer tools before you start an audit if you also want script-code analysis. It works only while that panel is open, and script text is analysed and then discarded; only pattern names, categories and counts are kept.

3. Export, save or delete the report

  • Export JSON, Export HTML or Export text downloads the report. The HTML file is self-contained and loads nothing.
  • Save report adds it to your saved reports (up to 50, kept for 30 days). Saved reports lists them with their expiry date and lets you view, delete one or Delete all.
  • Under Options you can set a default audit length and turn on Save finished reports automatically (off by default).

4. Send a report to your workspace (optional)

  1. A workspace administrator creates a token: Backoffice → Session Insights → Hunter Reports → Create upload token, picks a lifetime (5 minutes, 15 minutes, 1 hour, 4 hours or 12 hours) and copies the token. See Hunter reports in Backoffice.
  2. In Hunter, open Options → Send reports to your organisation (optional). Press Turn on sending to this endpoint and allow the browser prompt.
  3. Paste the token under Report token and press Use this token. Hunter refuses a collector secret key (sk_…) and any token that is not a Hunter report token.
  4. Open a report and press Send to my organisation…. Read Exact JSON that will be sent, then press Send this report.

To stop, press Turn off sending and remove access, or Forget token. Forgetting a token removes it from the browser; it stays valid until it expires.

Limits at the ingestion endpoint (defaults): 512 KiB per report after decompression, 200 reports per organisation per day and one report per 5 seconds per token. Hunter tries a send up to 3 times for transient failures.

  1. Open the page

    Open an http or https page in a tab and click the Hunter icon.

  2. Start the audit

    Press Start audit, accept the one-site permission prompt and use the page; press Stop when done.

  3. Read the report

    Open the report: rating, risk, detections, vendors, scripts and network findings.

  4. Export or save

    Export JSON, HTML or text, or save the report for 30 days.

  5. Get a token (optional)

    A workspace administrator creates an upload token in Backoffice → Hunter Reports.

  6. Preview and send (optional)

    Turn on sending in Options, paste the token, preview the exact JSON and press Send this report.

Run an audit and share a report

Verify it works

  • After an audit, the popup shows Last audit with a live or finished result and the reason it ended (you stopped it, the audit length ended, the tab closed, the browser restarted or the tab moved to another site).
  • The toolbar button shows the rating level, and its tooltip lists the touched and aggressive feature counts.
  • The report page shows the Summary with the page, start time, duration, mode (Audit or Quick look) and a Report ID, and Export JSON shows exactly what was recorded.
  • After Save report, the popup says “Saved. Saved reports: N”.
  • After a send, the report page says “Sent. Your organisation’s Noxtica workspace stored report until ”, and the saved report shows “Sent ”. The report then appears in Backoffice → Hunter Reports.

Troubleshooting

SymptomCauseFix
“Hunter cannot start on this tab” or “Open a normal website (http or https) tab first”The tab is a browser page, a store page or not a websiteOpen an http or https page.
“Refused: This page already runs the Noxtica SDK”Hunter does not instrument pages that Noxtica already instrumentsAudit a page without the Noxtica SDK.
“Permission denied: Hunter needs site access for this origin”You declined the browser promptPress Start audit again and accept, or use Quick look.
“Hunter could not register its page scripts”, “could not reload the tab” or “could not attach to this page”The page or browser blocked the observerTry again; use Quick look; note that nothing was recorded.
“An audit is already running on this page. Stop it first.”One session at a timePress Stop, then start again.
“The Hunter background could not be reached”The extension background is stoppedReload the extension and try again.
Counts look low and a “Late attach” notice appearsQuick look attached after the page made its callsUse Start audit.
“Rating not computed yet”The build has no rating taxonomyNot a good or bad result; use a build that includes it.
“Export refused: the report did not pass validation”The report failed Hunter’s own checkRun the audit again.
“Saved reports could not be read”Extension storage problemReload the extension.
“Sending is off. Turn it on in Options first.”Sending is not turned onComplete step 4.2.
“No token is stored, so nothing was sent” or “The stored token has expired”No token, or it expiredCreate a new token in Backoffice and paste it.
“That is a collector secret key (sk_…), not a report token”Wrong credential pastedPaste the upload token from Hunter Reports, never a server API key.
“The Noxtica ingest endpoint did not accept the token (401)”Token expired or invalidCreate a new token.
“The Noxtica ingest endpoint refused this organisation right now (403)”Noxtica refused the organisation at that moment and stored nothingTry again later. If it persists, ask your account team.
“This endpoint does not accept Hunter reports (404)”Report upload is not switched on at the endpointAsk your account team.
“refused the report’s strict check (422)”The report has a query string, a fragment, an unknown field or an unknown versionRun the audit again with an up-to-date build.
“This report is larger than the 512 KiB limit” or “(413)”Report too largeAudit a smaller page or shorten the audit.
“accepts one report per token every few seconds (429)”Rate limitWait a moment and send again.
“Your organisation has reached its daily report limit (429)”Daily limitTry again tomorrow.
“Noxtica already holds a different report with this id (409)”Report id clashRun a new audit and send that report.
“could not reach the Noxtica ingest endpoint” or “did not answer in time”Network or server problemCheck the connection and try again; sending again is safe.