h5i-dev/h5i v0.4.2

h5i v0.4.2

on GitHub

Install

One binary. h5i is the confined development environment, and it
carries its own browser engine.

Linux / macOS:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.4.2/h5i-v0.4.2-<TARGET>.tar.gz | tar -xz
sudo mv h5i /usr/local/bin/

Windows: download the .zip, extract h5i.exe, and add it to your PATH.

The browser

h5i browser open https://example.com
h5i browser snapshot
h5i browser requests     # what it asked for, and what was refused
h5i browser audit        # the whole session, afterwards

The rendering engine is part of this binary. It used to ship as a
second archive (h5i-browser-light); h5i browser execs itself to
become it now, and h5i __engine reaches its own CLI for the cases
that want it directly.

The websec workbench

h5i-websec is a separate archive, and installing it is a
deliberate act:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.4.2/h5i-websec-v0.4.2-<TARGET>.tar.gz | tar -xz
h5i plugin install websec --from ./h5i-websec

It holds no privilege of its own: every verb runs the h5i browser
verbs a person would type, through the same policy, budget and
receipts.

The recon ledger

h5i-recon is the other plugin, and it arrives the same way:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.4.2/h5i-recon-v0.4.2-<TARGET>.tar.gz | tar -xz
h5i plugin install recon --from ./h5i-recon

It records what a target exposes, where each candidate came from,
and which stored message confirmed it. Discovery only: a URL read
out of a bundle stays a candidate until a request answers for it,
and nothing here is called a vulnerability.

Every request it makes is checked against an allowlist — every
request and every redirect hop — and written to the log before any
bytes move. A request that is not in h5i browser requests did not
happen. What a box adds, with --in, is that the record gains a
witness outside the browser; on a bare host that part is not
claimed.

Available targets

Intel Macs have no published build: Rosetta 2 translates x86_64 to
arm64, not the reverse, so the aarch64-apple-darwin archive will
not run there. Build from source instead:
cargo install --git https://github.com/h5i-dev/h5i

Each archive is accompanied by a .sha256 checksum file.

What's Changed

• Update README.md by @Koukyosyumei in #617
• fix page events, form submission and cross-site credentials by @Koukyosyumei in #618
• Improve scraping limitations by @Koukyosyumei in #619
• let a handled click keep the page it built by @Koukyosyumei in #620
• Update README to correct plugin command by @Koukyosyumei in #621
• recon plugin by @Koukyosyumei in #622
• show sessions in the console, and say which one wants a person by @Koukyosyumei in #623
• bump to v0.4.2 by @Koukyosyumei in #624

Full Changelog: v0.4.1...v0.4.2