Wirebrowser

@Sharo_k_h I've released v0.7.0 and updated the tutorial (see Technique 5). Breaking change: ctx.variables is now a list of variables that can be modified with ctx.setVariable (it can also modify a const! ). For your example: hook at `"true" === e` and set `onHit(ctx){e = true}`

@wirebrowser var e = new URLSearchParams(window.location.search).get("enableMessaging"); "true" === e ? window.addEventListener("message", function (e) { console.log("Received message:", e.data); }) : console.log("postMessage handler not enabled");

Most JavaScript functions aren’t accessible from window. You can still hook them, follow their return, and flip application state at runtime.

@Sharo_k_h Thanks!!

@wirebrowser That's cool🔥

Stop stepping manually. Skip execution until a condition flips and jump exactly where it happens: 🔥 loggedIn became true → line X (no monkeypatching, just CDP)

@Sharo_k_h For minified code, I agree — finding the right execution point is the hard part. I’m also improving the Sources panel (pretty print + better navigation / deobfuscation) to make this much easier.

@Sharo_k_h The good news is this is exactly what I’m working on right now: in the next release (coming in the next couple of days), you’ll be able to hook directly at a precise location and modify local state (including values derived from consts). This will replace Live Hooks.

@Sharo_k_h Hey! Curious if you had a chance to look at the tutorial — any feedback would be super helpful 👍

@wirebrowser Thanks

@Sharo_k_h Yes, great use case. Usually you hook the checks or nearby code and patch values/control flow so execution continues. I’ll make a tutorial 👍

@wirebrowser As a client-side security researcher, I often face this problem: For example, I may find a postMessage handler, but it only executes if certain checks pass. Is there a way to use Wirebrowser to trigger this handler directly? I mainly want to focus on passing the required checks.

@Sharo_k_h In the meantime, here are some API examples: fcavallarin.github.io/wirebrowser/ap…

@wirebrowser If possible, please provide more tutorials for this good tool and make it a little simpler so that even a junior security researcher can understand and test it.

Main limitation: no real async invocation identity in CDP. Correlation across async boundaries is heuristic (stack similarity + timing).

You can hook JavaScript functions at runtime (even inside closures) without monkeypatching. Wirebrowser v0.6.1 Frida-style instrumentation for the browser: onEnter / onLeave handlers, return control.

Some data used to generate network requests only exists in runtime memory. Wirebrowser → Heap Snapshot → search

Trace → Hook → Control Wirebrowser v0.5.0 - Live Hooks: • Identify the function via Origin Trace • Hook it live • Override return values • Inject arbitrary code Runtime instrumentation powered by CDP.

Wirebrowser 0.4.0 is out. Request workflow improvements, Origin Trace fixes, and better stability. macOS builds are now signed & notarised. Landing page is live → wirebrowser.dev

From network interception to API collection. Even heavy debuggers need to relax 😉 Wirebrowser isn’t just advanced tooling — it’s a complete workflow for everyday debugging tasks.

Wirebrowser 0.3.0 dev builds ✅ Cross-platform Electron builds Custom Chrome management Unsigned binaries for now. Signed release coming next.

Network → Memory → DevTools Rewrite a response → see the UI change → grab the JS object born from that response directly in the live heap → inspect/patch it from DevTools. No instrumentation. Just CDP.