# Pown CDB | A Chrome Debug Protocol Utility **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking, freebies\ **Created:** [July 20, 2022, 8:39pm UTC](https://onehack.st/t/pown-cdb-a-chrome-debug-protocol-utility/221356 "2022-07-20T20:39:19Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [July 20, 2022, 8:39pm UTC](https://onehack.st/t/pown-cdb-a-chrome-debug-protocol-utility/221356/1 "2022-07-20T20:39:19Z")
![image](https://onehack.st/uploads/default/original/3X/4/a/4a50a0d5bf85008cb4fdbd543c3594c919aadc15.png) [![Follow on Twitter](https://camo.githubusercontent.com/6f6ddbf1e43cf5c47059ee2bc0843fd1cbcb13a973bbc403aa0d6d848385bfca/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f706f776e6a732e7376673f6c6f676f3d74776974746572)](https://twitter.com/pownjs) [![NPM](https://camo.githubusercontent.com/5a206c8fa7a11ca91750b489c1b0471c801e5439045adc9ca161e484d7aaddac/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f762f40706f776e2f6364622e737667)](https://www.npmjs.com/package/@pown/cdb) [![Fury](https://camo.githubusercontent.com/00fc98f0abebce3bf37c8a5689f2841cd427ff47d6aff393f56a44861dcc99a6/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d3278253230467572792d7265642e737667)](https://github.com/pownjs/lobby) [![SecApps](https://camo.githubusercontent.com/3535dac05ceec93aff677abddf7741fb4e947542370702da799c7f151977f6dd/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f637265646974732d536563417070732d626c61636b2e737667)](https://secapps.com/) # Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of security assessments and investigations. ## Credits This tool is part of [secapps.com](https://secapps.com/) open-source initiative. ```auto ______ _______ ______ / __|__ / __| /_\ | _ \ _ \/__ | \__\ _| (__ / _ \| _/ _/\__ \ | ___/___ \ ___/_/ \_\_| |_| |___ / https://secapps.com ``` ### Authors - [@pdp](https://twitter.com/pdp) - [https://pdparchitect.github.io/www/](https://pdparchitect.github.io/www/) ## Quickstart This tool is meant to be used as part of [Pown.js](https://github.com/pownjs/pown) but it can be invoked separately as an independent tool. Install Pown first as usual: $ npm install -g pown@latest Invoke directly from Pown: $ pown cdb ### Library Use Install this module locally from the root of your project: $ npm install @pown/cdb --save Once done, invoke pown cli: $ POWN\_ROOT=. ./node\_modules/.bin/pown-cli cdb You can also use the global pown to invoke the tool locally: $ POWN\_ROOT=. pown cdb ## Usage > **WARNING** : This pown command is currently under development and as a result will be subject to breaking changes. ```auto pown cdb Chrome Debug Protocol Tool Commands: pown cdb launch Launch server application such as chrome, firefox, opera and edge [aliases: start] pown cdb navigate Go to the specified url [aliases: goto, go] pown cdb network Chrome Debug Protocol Network Monitor [aliases: net, sniff, proxy, mon, monitor] pown cdb cookies Dump current page cookies [aliases: cookie] pown cdb screenshot Screenshot the current page [aliases: capture, shoot, shot] Options: --version Show version number [boolean] --help Show help [boolean] ``` ### `pown cdb launch` ```auto pown cdb launch Launch server application such as chrome, firefox, opera and edge Options: --version Show version number [boolean] --help Show help [boolean] --port, -p Remote debugging port [number] [default: 9222] --xss-auditor, -x Turn on/off XSS auditor [boolean] [default: true] --certificate-errors, -c Turn on/off certificate errors [boolean] [default: true] --pentest, -t Start with prefered settings for pentesting [boolean] [default: false] ``` ### `pown cdb navigate` ```auto pown cdb navigate Go to the specified url Options: --version Show version number [boolean] --help Show help [boolean] --host, -H Remote debugging host [string] [default: "localhost"] --port, -p Remote debugging port [number] [default: 9222] --secure, -s HTTPS/WSS frontend [boolean] [default: false] ``` ### `pown cdb network` ```auto pown cdb network Chrome Debug Protocol Network Monitor Options: --version Show version number [boolean] --help Show help [boolean] --host, -H Remote debugging host [string] [default: "localhost"] --port, -p Remote debugging port [number] [default: 9222] --secure, -s HTTPS/WSS frontend [boolean] [default: false] --output, -o Output directory/file [array] [default: []] --blessed, -b Start with blessed ui [boolean] [default: false] ``` ### `pown cdb cookies` ```auto pown cdb cookies Dump current page cookies Options: --version Show version number [boolean] --help Show help [boolean] --host, -H Remote debugging host [string] [default: "localhost"] --port, -p Remote debugging port [number] [default: 9222] --secure, -s HTTPS/WSS frontend [boolean] [default: false] ``` ### `pown cdb screenshot` ```auto pown cdb screenshot Screenshot the current page Options: --version Show version number [boolean] --help Show help [boolean] --host, -H Remote debugging host [string] [default: "localhost"] --port, -p Remote debugging port [number] [default: 9222] --secure, -s HTTPS/WSS frontend [boolean] [default: false] ``` ## Tutorials ### Web Application Security Assessment Let’s explore how to use Pown CDB during a typical web app security engagments. First, ensure that you have the latest pown installed: $ npm install -g pown If you have pown installed, make sure you have the latest version: $ pown update To get started with Pown CDB we need a Chrome browser instance (other browsers are also supported) with chrome debug remote interface enabled and listening on localhost: $ pown cdb launch --port 9333 Once the chrome browser instance is running, hook it with pown cdb network utility: $ pown cdb network --port 9333 -b The `-b` flag is used to start Pown CDB with a curses-based user interface: ![image](https://onehack.st/uploads/default/original/3X/4/a/4a50a0d5bf85008cb4fdbd543c3594c919aadc15.png) Use key-combo `shift + ?` to get a list of available shortcuts: ![image](https://onehack.st/uploads/default/original/3X/b/b/bba4159e79314e4eb411b0b2815f610cfe92b2d2.png) As soon as you start using the browser, Pown CDB will record and display the traffic in the user interface. To intercept requests use key-combo `ctrl + t`. ![image](https://onehack.st/uploads/default/original/3X/8/f/8f30905994d071d480d6aebc7357f027629f2247.png) Requests are captured and opened in your default shell editor (`$EDITOR`). Make the desired changes, save and quit. The original request will be replaced with your changes. ## GitHub: > **[GitHub - pownjs/cdb: Automate common Chrome Debug Protocol tasks to...](https://github.com/pownjs/cdb)** > > Automate common Chrome Debug Protocol tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses.