/screenshot

name: screenshot
description: Capture web-page / PoC screenshots into the engagement evidence (targets/<eng>/poc/) and embed them in walkthrough.md. Live pages + authenticated/exploited states (post-login dashboard, the flag page, an SSTI/cmdi render). Runs chromium on the Kali tooling host (VPN path to targets); hands off to the evidence skill for redaction before a real report. Use when building PoC evidence or asked to "take a screenshot / capture the PoC".

Screenshot: visual PoC capture

Turn the text walkthrough into evidence. Capture runs on the **Kali tooling host** (it has the VPN route to in-scope targets); the PNG is then pulled into the vault under `targets/<eng>/poc/`. Driver: `scripts/shot.py` (chromium headless). For redaction-before-report use `Skill(evidence)`.

**One evidence dir, captured by hand.** `poc/` = the curated story you choose to show (login, the exploited state, the flag). ALL PoC evidence is now captured MANUALLY and LIVE via `capture.sh` straight into `poc/` the moment a step lands - there is no auto-capture net.

Scope check

Only screenshot **in-scope** hosts (read `targets/<eng>/scope.md`). On `passive_only` RoE a screenshot is fine (it's a GET you already make). Never screenshot a host you would not curl.

What to capture: EVERY breakthrough, as it happens (with retries)

Screenshot the moment each step LANDS, not at the end - the box may expire. A breakthrough = anything you'd put in the report: the **entry page**, a **leaked secret / useful source** (deobfuscated JS, a config, an `app.log`), the **cipher / decrypt response**, the **vuln firing**, the **authed/exploited state**, the **flag**. Tell the arc (Entry -> Trigger -> Impact) AND capture the intermediate proofs (the leak, the crypto response) - those are exactly what a reviewer disbelieves without a picture.

• **Always show the URL.** Every web/source capture must carry its address bar so the image is

self-identifying - which page/path it is (`https://T/folder/folder/log.md`), not an anonymous blob. Live `<url>` mode adds it automatically; for `--html`/`--term` of a fetched resource pass `--url-bar "<full URL>"`.

• **Retry (box is up).** Renders fail transiently (nav timeout, cold chromium). Retry 2-3x and confirm

the PNG is non-empty (`[ -s out.png ]`) before moving on; while the box is up, go back and re-capture anything you missed rather than shipping evidence with gaps. Name `NN-slug.png` (NN = step order) so the evidence reads top-to-bottom.

Fastest path: `capture.sh ev` (one call, live - USE THIS by default)

Batching captures at the end of a box is the failure mode: you lose transient state AND the live situational awareness that helps pick the next move when stuck. The `ev` mode of `scripts/capture.sh` collapses the whole capture (render a card showing **command + request URL**, pull the PNG into `poc/`, print the md ref) into ONE call, so live capture has no friction. `cmd` and `url` are REQUIRED args - no anonymous card.

# 1) tee the step's output on the VM as you run it (safe for stateful exploits - no re-run needed):
bash /root/vm.sh 'python3 /tmp/exploit.py 2>&1 | tee /tmp/poc/flag3.log'
# 2) card it the MOMENT it lands:
scripts/capture.sh ev <eng> flag3-contract "POST http://T:8545 eth_sendTransaction" "reset()+transferDeposit()"
#   args: <eng> <slug> <request-url> <cmd-label> [logfile=/tmp/poc/<slug>.log]
#   -> saves targets/<eng>/poc/NN-flag3-contract.png (NN auto-numbered), prints the ![]() ref

The card shows `$ <cmd-label>` in the title bar AND `<request-url>` in a browser address bar (both required) so every image says what was run and where. Use the manual `shot.py` calls below only for the modes `capture.sh` does not wrap (a GUI `--window`/`--screen`, an authed `--html` render).

Rendered web page: `capture.sh web`

The most operator-legible shot is the target **as a browser renders it** - the actual page, not a curl card. `capture.sh web <eng> <slug> <url>` renders the live URL through chromium on the VM (browser-chrome frame + address bar) and pulls the PNG into `poc/`. This is the FIRST evidence to grab on any web target (capture-as-is before poking), and again at each rendered exploit state (an SSTI/cmdi output page, the flag page):

scripts/capture.sh web <eng> home http://T:PORT/            # the landing page, as seen in a browser
scripts/capture.sh web <eng> flag http://T:PORT/admin       # a rendered exploited/authed state
# opts: --no-bar (drop the address-bar frame), trailing `W H` to resize (default 1440 900)

A dead target makes it fail loud (chromium `net::ERR` -> non-zero exit, no error-page PNG pulled). For an **authed** page (needs a session cookie), curl-save the HTML and render it with the manual `shot.py --html --url-bar` call below; `web` is for GET-able live pages.

Request/response leads: `capture.sh req`

The highest-value CTF/pentest evidence is the **real curl request and response** for a lead (creds, a flag, a leaked source) - presentable as full-file PoC. Capture it deliberately, the moment the lead lands:

**Full fidelity (`capture.sh req`):** for a request you want as a clean PoC (request line + headers + body, response status + headers + body), run it through the `req` mode - it runs `curl -sS -iv`, colors the request(`>`)/response(`<`) Burp-style, and pulls the PNG into `poc/`:

scripts/capture.sh req <eng> <slug> -- -sk -X POST https://T:5000/login --data @/tmp/body.txt

For a **crypto-forged** request (envelope/signature), give the exploit script a `--curl` mode: it writes the forged body to a file and prints the `capture.sh req` args, so the PoC is a reproducible curl, not "run my python". Never settle for a script-summary card (`POST https://T/login` + python output) when the real curl request/response is the artifact a client / writeup needs.

Real tmux-session cards: `capture.sh tmux`

When the evidence should look like an ACTUAL Kali terminal session (real commands + re