https://github.com/zbo14/puppetshow

A command-line utility for sequentially viewing webpages in a browser window
https://github.com/zbo14/puppetshow

browser-automation bug-bounty chromium cli puppeteer recon url urls

Last synced: 3 months ago
JSON representation

A command-line utility for sequentially viewing webpages in a browser window

• Host: GitHub
• URL: https://github.com/zbo14/puppetshow
• Owner: zbo14
• License: mit
• Created: 2020-06-03T18:18:36.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2022-03-26T20:18:25.000Z (almost 3 years ago)
• Last Synced: 2024-10-10T09:35:55.675Z (3 months ago)
• Topics: browser-automation, bug-bounty, chromium, cli, puppeteer, recon, url, urls
• Language: JavaScript
• Homepage:
• Size: 329 KB
• Stars: 2
• Watchers: 3
• Forks: 1
• Open Issues: 7
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# puppetshow

A command-line utility for sequentially viewing webpages in a browser window.

## Why?

A common process in bug bounty recon is taking screenshots of target URLs with a tool like Aquatone or EyeWitness. While this strategy provides important visual information, manually visiting endpoints in the browser is often more effective. This way, you can see redirects occur, monitor the Network tab for AJAX/fetch requests, inspect markup and JavaScript, and gain a better understanding of your target.

`puppetshow` allows you to consecutively view a list of endpoints in Chromium. In addition, you can cycle back and forth through the endpoints in case you want to take a second (or third) look. This provides a nice medium between opening dozens of tabs in your browser and scrolling through hundreds or thousands of screenshots. With each new tab you open, the former strategy becomes disproportionately more frustrating and cumbersome. The latter strategy has the benefit of convenience but inevitably comes at the cost of (some) information. Therefore, if you have a list of target endpoints that isn't prohibitively large, `puppetshow` provides a viable alternative without sacrificing information. You can even leave the browser and terminal windows open and resume viewing at a later time.

## Install

`npm i @zbo14/puppetshow`

## Usage

```

                     _       _

 ___ _ _ ___ ___ ___| |_ ___| |_ ___ _ _ _

| . | | | . | . | -_|  _|_ -|   | . | | | |

|  _|___|  _|  _|___|_| |___|_|_|___|_____|

|_|     |_| |_|

Usage: puppetshow [options] 

Options:

  -V, --version                      output the version number

  -d, --dev-tools                    open dev-tools in browser window

  -k, --insecure                     ignore HTTPS errors

  -p, --protocols            comma-separated list of protocols to prepend to IP addresses/hostnames (default: "http,https")

  -q, --quiet                        don't show banner and info

  -r, --reverse                      visit endpoints in reverse order

  -x, --proxy <[proto://]host:port>  use proxy for chromium

  -h, --help                         display help for command

```

`` contains a list of URLs, IP addresses, or hostnames.

For every non-URL, `puppetshow` will prepend "http://" *and* "https://" unless `--protocols` indicates otherwise.

When you run the command, it should open a Chromium browser window.

In terminal, you can enter the following commands to stdin:

  * `n` to go to the next webpage

  * `p` to go to the previous webpage

  * `ctrl-c` to close the browser window and stop the program