Skip to main content

page-renderer

The page-renderer tool visits a single URL in a real headless browser (Chrome DevTools Protocol via chromedp/Chromium) and captures either the rendered HTML or a full-page screenshot. Unlike a plain HTTP fetch, it executes JavaScript exactly as a real browser would, so it can visit authenticated dashboards, SPAs, and JS-heavy pages behind a loaded cookie jar rather than just their raw server response. It does not crawl or follow links beyond redirects — one visit per input line, then it exits.

Ideal Use Cases & Fit​

This tool is well suited for capturing what a real, authenticated user would actually see: replaying a session's cookies to render an internal dashboard or SaaS admin panel, taking evidence screenshots of a phishing page or suspected C2 panel for a threat report, or verifying a redirect chain / login flow before automating further steps against it. It excels wherever the raw HTML response wouldn't tell the full story — client-side redirects, SPA auth checks, or content that only appears after JavaScript runs. It is not the right tool for multi-page crawling or link discovery (that's web-scraper's job), and JS-heavy pages that redirect asynchronously (e.g. after an auth-check API call) need a large enough wait value or the capture can land before the page finishes settling.

Value in Workflows​

In security workflows, page-renderer is most valuable as a verification or evidence-capture step: confirming that a set of session cookies actually authenticates against a target application, rendering a flagged URL for visual triage during incident response, or producing a screenshot to attach to a report without a human having to open the link themselves. Because it can take structured input (cookies, headers, and settings) from an upstream node in one combined file, it also fits cleanly after a credential-harvesting or session-extraction step earlier in a workflow, turning raw session data directly into a rendered result. Its output is one JSON object per input line, so downstream nodes can consume either the HTML content or the base64-encoded screenshot without extra parsing.

Input Data​

The tool accepts a single input file in one of two shapes:

  • Plain text: a newline-separated list of URLs (scheme optional; example.com is treated as https://example.com).
  • Structured JSON: an object carrying targets plus cookies, headers, and any other setting together, for when a single upstream node needs to hand off everything in one file. Only targets is required; unknown keys are ignored.

Example (structured JSON):​

{
  "targets": ["https://example.com/dashboard"],
  "cookies": [{"name": "session", "value": "abc123"}],
  "headers": {"Authorization": "Bearer eyJhbGci..."},
  "mode": "screenshot"
}

Cookie entries only require name/value — anything else omitted (domain, path, secure, httpOnly, expires) is defaulted sensibly: domain falls back to the target's own host, secure matches the target's scheme, and expiry is set a year out so nothing expires mid-run.

Configuration​

  • cookies: JSON cookie array, either inline or a path to a file containing it. Only name/value are required per entry. Applied fresh before every target. Takes precedence over a cookies key in the input file.
  • headers: Extra HTTP headers, either inline or a path to a file: a JSON object ({"Header-Name":"value"}) or an array of {name,value} objects. Takes precedence over a headers key in the input file.
  • mode: Capture mode — html (rendered outer HTML) or screenshot (PNG, base64-encoded in the output). Default html.
  • full-page: Screenshot mode only. Captures the full scrollable page. If false (default), captures just the visible viewport.
  • follow-redirects: Follow HTTP redirects. If false, stops at the first redirect and reports its Location instead of continuing (status becomes redirect_blocked). Default true.
  • timeout: Navigation timeout in seconds, per target. Default 30.
  • wait: Extra time to wait after load fires, in milliseconds — needed for JS-heavy pages that fetch data or redirect asynchronously after their initial load. Default 0.
  • user-agent: Custom User-Agent header. Also suppresses Sec-CH-UA* client hint headers so they don't contradict it by still reporting the real browser.
  • viewport-width / viewport-height: Browser viewport size in pixels. Defaults 1920 / 1080.
  • insecure: Skip TLS certificate verification, for internal targets with self-signed certs. Default false.
  • output: One JSON object per input line (JSONL) — url, final_url, status (success / redirect_blocked / error), status_code, redirect_chain when applicable, and either html or screenshot_base64 depending on mode.