DISCLAIMER: EvilPuppet is for educational and research purposes only. Do not use this tool for illegal activities. The author is not responsible for any misuse of this tool.
EvilPuppet is a proof-of-concept man-in-the-middle(MITM) tool that uses Puppeteer in the background to capture and stream HTML content to a target browser. More than just streaming, it provides an interface that allows the target browser to remotely control the Puppeteer browser instance, simulating a real user's actions.
- Stream Puppeteer controlled web content to target browsers.
- Allow remote control of the Puppeteer browser instance from the target browser.
- Simulate real user behaviors like clicking, scrolling, and typing.
- Node.js
- Clone the repository:
git clone https://github.com/nexon33/EvilPuppetJS.git- Navigate into the directory:
cd EvilPuppetJS- Install the dependencies
npm install-
Set config inside config.js
-
Start the server:
node app.js- Visit the local instance (check url in terminal) and when opening the browser a puppteer instance will also open.
-
Syncing the textfields between the browsers can be improved.
-
diffDOM library issues which end up also being EvilPuppet's problems.
-
Many other things too much to list for now.
-
Make use of MutationObserver instead of a loop to detect changes. (Maybe getting rid of diffDOM?)
-
Improve syncing between text fields.
-
Further improve typing
-
Add support for copy/paste and autofill
-
Complete refactoring the code and convert it to typescript.
-
Add mouse hover and drag.
-
fix the cssparser and html parser to make it more robust in edgecases. Especially get rid of regex.
-
Fix clicking and other functions inside iframes. (only rendering currently works)
-
...
This tool is powerful and can be misused. Always get proper permissions before conducting any testing. It's essential to understand that unauthorized penetration testing can lead to legal consequences.
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
This project is licensed under the MIT License - see the LICENSE.md file for details.
Please make sure that you always use such tools ethically and responsibly. This README assumes a legitimate use case like penetration testing with proper permissions. Always obtain permission before testing on any system or network.