A Puppeteer browser recording file from Chrome DevTools Recorder. You record the flow in Chrome, export it, and feed it here.

What does the output look like?

One `Cookie:` line, for example `Cookie: session=KSkooh8gYQ6WhkzyWSkgHyoh0PsV3cdQ; remember_me=1`.

Do I need a browser plugin?

No. Chrome's built-in Recorder produces the export.

Which downstream modules accept this header?

Any Library node that takes a `header` or `header-file` input: [Probe for Web Servers](/library/modules/probe-for-web-servers), [Fingerprint Web Technologies](/library/modules/fingerprint-web-technologies), the scan-for-* family, and [Fuzz Web Applications for Vulnerabilities](/library/modules/fuzz-web-applications-for-vulnerabilities). Path discovery behind an auth wall takes it too. Wire the `header` output into whichever of those needs authenticated access.

2026-08-13

Utilities

Get Cookies via Puppeteer Recording

Replay a Chrome DevTools Recorder login, capture cookies, and write a Cookie header file for downstream Library nodes. Utility, not a scanner.

What Get Cookies via Puppeteer Recording does

Authenticated scanning needs the cookies your own login set, not a stolen session. Cookie recording here means replaying a Chrome DevTools Recorder export of a login you already performed, capturing the cookies set at the end of that flow, and writing them as a Cookie: header file downstream nodes can consume. It is composition glue for your auth on your target, not a scanner and not cookie theft. You nest it once per workflow that needs authenticated access, close to the downstream scan so the session is still live.

You replay a Chrome DevTools Recorder export of a login you already performed. The module captures the cookies set at the end of that flow and writes a Cookie: header file. Downstream nodes that take header or header-file consume it. This is your authorized login, replayed. It is not a scanner.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

You, in Chrome DevTools Recorder, exporting the recording. That step is not a Library module.

Downstream

Any module that takes header or header-file: Probe for Web Servers, Fingerprint Web Technologies (header only), Fuzz Web Applications for Vulnerabilities, the scan-for-* family, and path discovery behind an auth wall.

Parallel

None. This is supporting glue. It does not sit on the network or web tail. It feeds auth into either.

When to use this

Nest this when a later Library node needs authenticated HTTP and you already recorded the login in Chrome. Skip it when the target is public, or when you do not have a Recorder export of a login you are authorized to use.

Inputs and outputs

Required: puppeteer-recording (FILE): a Puppeteer recording exported from Chrome
header: one Cookie: line, for example

Data

The tables this module produces. Sample rows are illustrative.

cookies6 columns · 3 sample rows

Cookies captured at the end of the replayed login flow, written as a Cookie header file.

	nametext	valuetext	domaintext	pathtext	securebool	http_onlybool
1	session	KSkooh8gYQ6WhkzyWSkgHyoh0PsV3cdQ	example.com	/	true	true
2	remember_me	1	example.com	/	true	false
3	csrf	aB3dE6gH9jK2mN5pQ8sT	example.com	/login	true	true

How it differs from similar modules

Session stealing / cookie exporter

Why this is not it

You replay a Recorder export of a login you already did on a target you are authorized to test. The header is that session, written for downstream nodes.

A scanner

Why this is not it

One Cookie: file out. No findings.

questions