Hunter browser extension

noxtica Hunter is a browser extension that shows which scripts on one web page you choose to audit read your browser’s fingerprint-related features, such as canvas, WebGL, audio, navigator and screen properties, fonts and timing. The analysis runs on your device.

Developers, security reviewers and privacy teams use it. You start every audit by hand. Sharing a report with your Noxtica workspace is a separate, optional step that is off by default.

What it is

Availability: depends on your organisation and the modules enabled for it; ask your account team.

Hunter is not an automatic scanner. Nothing is observed until you press Start audit or Quick look for the current tab. This page describes the extension as built from source. How your organisation receives a build, and for which browsers, is arranged with your account team.

What an audit gives you

• A rating: the share of fingerprint features the page touched, compared with published thresholds. The thresholds are marked Provisional until they are calibrated, so read the level as indicative.
• A risk score from 0 to 100 with a level (low, medium, high or critical) and the reasons behind it.
• Detections by feature area, with the calling script for each API.
• Vendors recognised from script addresses, code patterns and network traffic.
• Script sources, marked first party or third party.
• Network findings: requests whose payload looked like fingerprint data. Hunter keeps field names and keywords, never values.
• Bot-signal observations and Environment context labels (for example a privacy browser or developer tools) that explain why a reading may look unusual.

The report page says it is advisory: Hunter observes from inside the page, and a page can interfere with what it sees. Treat a report as a signal, never as evidence of intent.

Two ways to run

Hunter audits only http and https pages. It refuses to instrument a page that already runs the Noxtica SDK, so it cannot interfere with that page’s integrity signals. Only one audit can run at a time.

Permissions

The extension declares no static host permission and no always-on content script. It does not request tabs, webRequest, debugger, cookies or history. The minimum Chrome version is 116.

What is recorded and what is not

The About page states that Hunter records which APIs were called, how often and by which script address (origin and path only). It states that Hunter never records values: no pixels, text, coordinates, clipboard or storage contents, and no request bodies. Reports are kept only if you save them: up to 50, for 30 days, in the browser’s extension storage. You can delete one report or all of them at any time.

For how Noxtica handles data in general, see Privacy and Security.

Optional: send one report to your Noxtica workspace

Some builds can send a report you choose to your organisation’s Noxtica workspace. This is off by default and never automatic. A build without this feature shows no upload control and says “This build does not upload anything”.

Sending needs all of the following:

1. You turn sending on in Options and allow the browser to give Hunter access to the Noxtica ingestion endpoint (https://ingest.noxtica.com).
2. A workspace administrator has created a short-lived upload token in Backoffice and you have pasted it into Hunter.
3. You press Send on a specific report after you have seen a preview of the exact JSON.

What is sent: the report you previewed, which holds the origin and path of the audited page and of its scripts, API names and counts, and a vendor and risk summary. Query strings and fragments are removed when the report is built, and the ingestion endpoint refuses a report that still contains one. What is never sent: cookies, page content, keystrokes and API argument values. If a path itself contains a name or other identifier, it is part of the report, so read the preview before you press Send.

The token names your organisation and the administrator who created it. Every report sent with it is stored under that organisation and linked to that administrator. The token is kept in the browser’s session storage for that session and used for nothing else. Reports are stored in the EU and kept for 30 days; administrators can remove them sooner in Backoffice. See Hunter reports in Backoffice.

Prerequisites

• A Hunter build from your account team, in a Chromium-based browser at version 116 or later.
• A normal website (http or https) open in a tab. New-tab pages, chrome://, about: and browser store pages cannot be audited.
• For sending reports: a build that includes sending, a workspace administrator with the Hunter Reports page available (see the Backoffice page), and permission to let the extension reach https://ingest.noxtica.com.

Steps

1. Run an audit

1. Open the website you want to audit in a tab.
2. Click the Hunter icon in the toolbar. If you cannot see it, open the extensions menu and pin Hunter.
3. Optionally set Audit length (seconds).
4. Press Start audit and accept the browser prompt for access to that site. The page reloads.
5. Use the page normally. Press Stop when you are done, or wait for the timer.

For a quick read without a reload, press Quick look instead.

2. Open the report

Press View report in the popup or Open side panel. The report page has the sections Summary, Risk and rating, Detections, Vendors, Script sources, Network, Bot-signal observations, Environment context, Spy health, Frames and Errors.

Open the Hunter panel in the browser developer tools before you start an audit if you also want script-code analysis. It works only while that panel is open, and script text is analysed and then discarded; only pattern names, categories and counts are kept.

3. Export, save or delete the report

• Export JSON, Export HTML or Export text downloads the report. The HTML file is self-contained and loads nothing.
• Save report adds it to your saved reports (up to 50, kept for 30 days). Saved reports lists them with their expiry date and lets you view, delete one or Delete all.
• Under Options you can set a default audit length and turn on Save finished reports automatically (off by default).

4. Send a report to your workspace (optional)

1. A workspace administrator creates a token: Backoffice → Session Insights → Hunter Reports → Create upload token, picks a lifetime (5 minutes, 15 minutes, 1 hour, 4 hours or 12 hours) and copies the token. See Hunter reports in Backoffice.
2. In Hunter, open Options → Send reports to your organisation (optional). Press Turn on sending to this endpoint and allow the browser prompt.
3. Paste the token under Report token and press Use this token. Hunter refuses a collector secret key (sk_…) and any token that is not a Hunter report token.
4. Open a report and press Send to my organisation…. Read Exact JSON that will be sent, then press Send this report.

To stop, press Turn off sending and remove access, or Forget token. Forgetting a token removes it from the browser; it stays valid until it expires.

Limits at the ingestion endpoint (defaults): 512 KiB per report after decompression, 200 reports per organisation per day and one report per 5 seconds per token. Hunter tries a send up to 3 times for transient failures.

Verify it works

• After an audit, the popup shows Last audit with a live or finished result and the reason it ended (you stopped it, the audit length ended, the tab closed, the browser restarted or the tab moved to another site).
• The toolbar button shows the rating level, and its tooltip lists the touched and aggressive feature counts.
• The report page shows the Summary with the page, start time, duration, mode (Audit or Quick look) and a Report ID, and Export JSON shows exactly what was recorded.
• After Save report, the popup says “Saved. Saved reports: N”.
• After a send, the report page says “Sent. Your organisation’s Noxtica workspace stored report until ”, and the saved report shows “Sent ”. The report then appears in Backoffice → Hunter Reports.

Troubleshooting

Related

• Hunter reports in Backoffice for the list, detail, download and delete views and for creating upload tokens.
• Spot captures for operator-started recordings.
• Browser SDK troubleshooting if Hunter refuses a page that runs the Noxtica SDK.
• Privacy and Security for data handling.