Creating a scan with Chrome's Recorder Puppeteer script

The Google Chrome browser's built-in Developer Tools offer a Recorder feature that allows users to record browser interactions and then export them as a Puppeteer script. This can be very useful to enable complex authentication flows or complex interactions like checkout.

This guide covers creating a web scan with Chrome's recorder Puppeteer script. Puppeteer scripts can automate complex authentication or interaction flows, like user checkout.

Go to report.ostorlab.co

1. Go to New Scan

Click the New Scan icon in the top bar.

2. Select Web App

Select the Web App option to create a web scan.

3. Add target URLs

Add the target URLs or domain names, then click "Continue". The "Extra Context" step that follows is optional.

4. Click "Full Web Scan"

Select the Full Web Scan profile. A profile with a lock and an "Unlock Profile" button is not included in your organization's plan.

5. Click "Continue"

Click on the Continue button.

6. Click "Test Credentials"

In the "Test Credentials" step, click "+ Test Credentials".

7. Click "Script"

Select the Script credential type.

8. Upload script

Optionally give the credential a label, then upload the Puppeteer script file. A preview of the script appears below it.

9. Configure optional scan settings

The next steps are optional: SBOM files, scan settings like the QPS limit, proxy configuration, or a list of excluded URLs, custom checks, tags, and the execution window, which sets when the scan is allowed to run.

10. Click "Start scan"

Click "Start scan" and follow the scan from Scans in the top bar. The scan is queued first, then runs.

Create Puppeteer Script

To create a Puppeteer script from Chrome, follow these steps:

1. Open Developer Tools in Chrome

• Right-click on a webpage and select Inspect, or press Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac).
• This will open the Developer Tools pane, usually docked to the right or bottom of your browser window.

2. Access the Recorder Tool

• In the Developer Tools pane, click on the tab labeled Recorder.
• If you don’t see it, it might be hidden behind the ">>" icon. Click on this icon and select Recorder from the dropdown.

3. Start Recording

• Click on the Start Recording button. This will start capturing all browser interactions.
• Now, navigate through the authentication flow on your website. For instance:
  • Go to the login page
  • Enter your username and password
  • Click the login button, etc.

4. Stop Recording

• After completing the authentication flow, click the Stop Recording button in the Recorder pane.

5. Review and Export

• After stopping the recording, you can review all recorded steps in the Recorder pane. If necessary, you can remove unwanted steps or edit steps to correct any inaccuracies.
• To export the recorded interactions as a Puppeteer script, click the Save button or the Export button (the specific label may vary based on the version of Chrome) in the Recorder pane.
• Choose a location on your computer to save the script, and it will be downloaded as a .js file.